HubstaffDeveloper Portal

Changelog

Changes to the Hubstaff API — new endpoints, updates, and breaking changes, newest first.

October 2026

Update

Organization access tokens only see their own organization

Requests made with an organization access token now return data from the organization that issued the token only.

GET /v2/organizations
Was: Listed every organization of the token's userNow: Lists only the organization that issued the token
GET /v2/users/{user_id}
Was: Found any user the token's user could report on, in any organizationNow: Finds only members of the organization that issued the token; other users return `404 Not Found`

Other token types are not affected. Organization-scoped endpoints already rejected other organizations for these tokens.

TagsOrganizationsUsers
Update

Organization invite URL and metadata limited to owners and managers

Organization responses now omit the invite URL and metadata for members who cannot manage them.

invite_url
Was: Returned to every organization memberNow: Returned to owners and organization managers allowed to invite members; omitted for everyone else
metadata
Was: Returned to every organization memberNow: Returned to owners and organization managers; omitted for everyone else

Treat invite_url and metadata as optional: when the key is missing, the authenticated user does not have access to it.

TagsOrganizations

September 2026

Update

Attachment in time off request responses

Time off request objects now include the attachment's filename and a download URL, so it can be reviewed before approving or denying the request.

`attachment_original_filename` field
Was: Not presentNow: Original filename of the attachment
`attachment_url` field
Was: Not presentNow: Download URL, expires in 2 hours

Both fields are returned only when the request has an attachment. The fields are additive — existing integrations are unaffected.

TagsTime off requests
Update

Limited client details for project members

Client read responses now blank sensitive client details for users who can see clients through project membership but cannot manage clients.

Restricted client responses
Was: Project members could receive full client fields, including contact, invoice, metadata, and budget detailsNow: Project members receive the same stable client keys with sensitive contact and metadata values blanked and project_ids limited to visible projects
Project side-loading
Was: Side-loaded clients on project list responses used the full client payloadNow: Side-loaded clients use the same blanked sensitive values unless the user can manage clients

Owners and organization managers still receive the full client payload. For users without client-management access, GET /v2/organizations/{organization_id}/clients, GET /v2/clients/{client_id}, and GET /v2/organizations/{organization_id}/projects?include=clients keep the stable client response shape while blanking client contact details and metadata, limiting project_ids to visible projects, and omitting budget and invoice-term details.

TagsClientsProjects