Administration
Permissions, settings, scheduled jobs, retention and the security posture — everything an administrator owns.
Permissions
Sixteen permissions, deliberately fine-grained. The separations that matter: reading attendance does not imply changing the server connection, watching a sync does not imply starting one, running a sync does not imply creating attendance records, and managing a connection does not imply being able to enter its password.
| Permission | Grants |
|---|---|
| Biotime | Base access and the dashboard. Without it the module is invisible and its pages unreachable. |
| Employees & Bindings | View mirrored personnel and their match state. |
| Bind / unbind employees | Change who a BioTime employee maps to; run the bulk accept. |
| Attendance transactions | View mirrored punches. |
| Devices | View mirrored terminals. |
| Organization | View departments, positions, areas and locations. |
| Analytics | View trends and breakdowns. |
| View sync history | Open the Sync Center and read past runs. |
| Run a sync | Start a sync. Separate from viewing, because starting one reaches an external server and consumes its rate limit. |
| Import punches into ERPat attendance | Turn mirrored punches into attendance records. Deliberately not implied by running a sync: mirroring reads a remote server, importing writes into ERPat's own payroll-facing attendance table. |
| View API logs | See the record of calls made to the BioTime server. |
| View raw API payloads | See the stored response excerpt behind a log entry. Separate, because a raw payload can hold more of the remote record than the listing shows. |
| Export mirrored data | Download attendance data. |
| Biotime settings | Open the settings page. |
| Manage connections | Add, edit and delete server connections. |
| Enter / rotate BioTime credentials | Supply or change the BioTime password. Deliberately not implied by managing connections. |
Settings
Six tabs under Biotime → Settings. Every numeric setting is clamped on save — an out-of-range value is corrected rather than stored, and read back with the same bounds.
Sync & retention
| Setting | Default | Range | Notes |
|---|---|---|---|
| Run the sync automatically | On | — | Turns the scheduled job on or off without disabling the module. |
| Overlap window (minutes) | 10 | 1–120 | How far before the last seen punch each run re-reads, so a late upload is never skipped. |
| Rows per page | 200 | 10–500 | How many records are requested per API call. |
| First-run window (days) | 30 | 1–365 | How far back the very first sync reaches. Full backfill is a separate, explicit action. |
| Maximum pages per tick | 5 | 1–50 | Work done per request. Higher is faster but each request runs longer. |
| Keep API logs for (days) | 30 | 1–365 | Pruned nightly. |
| Keep sync runs for (days) | 90 | 1–730 | Pruned nightly. |
| Keep transactions for (days) | 0 | 0–3650 | 0 means keep forever. Setting a window prunes older punches; the daily analytics rollup survives. |
Binding
| Setting | Default | Notes |
|---|---|---|
| Match employees automatically | On | Runs the matching pass as part of a sync. |
| Match on ERPat ID number | On | The primary rule: BioTime employee code against the ERPat ID number. |
| Offer name-similarity suggestions | On | Suggestions only — never applied automatically. |
| Write a canonical Kiosk enrollment row | On | Only does anything when the Kiosk module is present. Writes under a dedicated enrollment label for this connection, never the shared wildcard. |
Attendance import
Off by default, and additionally inert while the Human Resource module is switched off — the records it creates land in HR's Attendance screen, so there is nowhere for them to go without it.
| Setting | Default | Range | Notes |
|---|---|---|---|
| Create ERPat attendance from punches | Off | — | The master switch. Every other Biotime setting governs reading a remote server; this one writes into ERPat. |
| Import automatically after each sync | Off | — | When off, the import only runs when somebody starts it from the Sync Center. |
| New shift after a gap of (hours) | 6 | 1–12 | Consecutive punches more than this far apart start a new shift. Also the wait before a shift is imported — see the note below. |
| Ignore repeat taps within (seconds) | 60 | 0–600 | A second tap this soon after the first is the same arrival. 0 disables it. |
| Maximum shifts per batch | 100 | 10–500 | Work done per request. Higher finishes a backfill in fewer batches but each request runs longer. |
| Import a lone punch as an incomplete record | Off | — | Best left off. A shift with one punch has no clock-out, and ERPat treats any record without one as still open — so it blocks every later shift for that employee from importing, and the auto-clockout job closes it as "System Clockout" within hours. Measured on a real feed, switching it on cost about a quarter of the records. |
ℹ
Nothing is imported until the gap has elapsed. With the default 6 hours, a
17:00 clock-out becomes an attendance record that evening, not immediately. That delay
is what keeps a shift whole: importing at 08:00 would consume the clock-in and leave the
evening clock-out with no shift to join.
Display & advanced
| Setting | Default | Notes |
|---|---|---|
| Show capture photos | Off | Capture photos are images of employees. Opt in deliberately. |
| Show body temperature | Off | Health data. Additionally inert on cloud servers, whose feed carries no such field. |
| Dashboard range (days) | 7 | 1–90. |
| Default connection | — | Which connection the pages read when more than one exists. |
| Allow private / internal hosts | Off | On-premises servers only. See the security note below. |
Scheduled jobs
| Job | Schedule | What it does |
|---|---|---|
Biotime — incremental syncbiotime_sync |
Every 15 minutes | Mirrors new data from each active connection, resuming from the stored cursor. Does nothing when the module is off or automatic sync is disabled. When automatic attendance import is also on, the same job turns bound punches into pending attendance records. |
Biotime — retention & analytics refreshbiotime_retention |
Daily, 02:30 | Prunes API logs, sync runs and (if configured) old punches, then refreshes the daily analytics rollup. |
ℹ
The retention job refreshes the rollup only for days whose punches still exist.
Purging raw attendance therefore never erases your historical daily totals — which is
the entire reason the rollup is kept separately.
Security posture
Credentials
- The BioTime password is encrypted at rest with AES-256-GCM, using the key in
BIOTIME_ENCRYPTION_KEY. Access and refresh tokens are encrypted the same way. - Each encrypted value is bound to the connection row and the field it belongs to, so a stored secret copied into another row or another field simply will not decrypt.
- A credential is only stored after a real sign-in succeeds. There is no path that saves an unproven password.
- Passwords, tokens and authorization headers are stripped from every stored error message and log excerpt. API log paths are stored without their query strings.
- Repeated credential failures temporarily lock a connection. Network problems and server errors deliberately do not count toward that — otherwise one bad afternoon on the network would lock every connection.
Outbound requests
- The server address is re-resolved and re-checked before every single request, including from the scheduled job, and the connection is pinned to the approved address. A single check at setup time can be defeated by changing DNS afterwards.
- Loopback, link-local and cloud-metadata addresses are refused unconditionally.
- Allow private / internal hosts widens this to ordinary LAN ranges, applies only to the on-premises profile, and is off by default. It is a security decision, not a convenience toggle.
- Redirects are never followed, and response size is capped.
✓
There is no “ignore TLS errors” switch anywhere in this module, and there is no
plan to add one. Certificate and hostname verification cannot be disabled by a tenant.
What is never collected
- Biometric templates are never mirrored. Fingerprint and face data stay on your BioTime server. Only enrollment counts are copied.
- Capture photos and body temperature default to off. Both are personal data and require a deliberate decision.
- The integration API never exposes credentials, tokens, or the raw remote record.
The integration API
Seven read-only endpoints under /api/v1/biotime/*, requiring the
biotime:read scope. Grant it in Settings → API Access like any other
scope. A token with the scope still receives a 404 on a tenant where the Biotime module is
switched off.
There is no write scope — the module is a read-only mirror, so there is nothing for a machine to contribute. Endpoint details are in Reference.
Audit trail
These actions are recorded in ERPat's audit log: creating, updating and deleting a connection; rotating a credential (the fact, never the value); running a connection test; changing settings (only the keys that actually changed); creating, changing and removing a binding; starting a sync; and importing attendance. Bulk acceptance writes one entry per batch rather than one per employee.
Attendance import writes at two levels, because they answer different questions:
| Entry | Written | Answers |
|---|---|---|
| Biotime attendance imported | Once per batch | What did this sync do? — records created, updated, skipped, failed. |
| Attendance added / updated from BioTime | Once per record | Where did this record come from? Filed against the record itself, so it appears in its Log Details history — the screen an approver is already on. |
ℹ
A scheduled import is recorded as performed by System, because cron has no
signed-in user. An import somebody starts from the Sync Center names them.