Getting started
From an empty module to a working, matched attendance mirror — usually about twenty minutes, most of it waiting for the first sync.
Before you begin
You will need three things from whoever administers your BioTime server:
- The server address, for example
https://yourcompany.itime.minervaiot.com - A username and password for an account on that server
- The timezone your organization’s attendance is recorded in
One prerequisite for your hosting administrator
Biotime stores your BioTime password encrypted, and it needs a key to do that. Before a
connection can be configured, whoever manages the ERPat installation must add
BIOTIME_ENCRYPTION_KEY to the environment file — a base64-encoded 32-byte
random value.
php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"Step by step
-
Enable the module
Go to Settings → Manage Modules and switch Biotime on. It is off by default, because it does nothing at all until a connection exists.
-
Grant permissions
In Roles, give the relevant roles the Biotime permissions they need. At minimum, whoever is doing this setup needs Biotime, Manage connections and Enter / rotate BioTime credentials. See Administration for what each permission grants.
-
Add the connection
Open Biotime → Settings → Connections and choose Add connection. Give it a name, the server address, the username, and the timezone. Leave the profile on Auto-detect unless you know you are on an on-premises BioTime 9.5 server.
Enter the address as scheme and host only — for example
https://yourcompany.itime.minervaiot.com. ERPat appends the API paths itself. -
Run the connection test
Switch to the Connection Test tab, pick the connection you just made, type the BioTime password, and press Run connection test. Nine checks run one after another and stop at the first failure.
The Save button stays disabled until all nine pass. That is the point of the test: a connection that cannot actually sign in is never saved as if it could.
-
Run a first sync — start small
Go to Sync Center, leave all scopes ticked, set a short date window (a few days), and press Run sync. Watch the console. You are checking that data arrives and looks right, not trying to import history yet.
-
Review the employee matches
Open Employees & Bindings. Most people should already show auto_matched — a match found on employee code against the ERPat ID number, applied automatically but reversible and waiting for a human.
Use Accept safe matches to confirm them in one action, then work through whatever is left.
-
Let it run
Once you are happy, leave Run the sync automatically on. The scheduled job keeps the mirror current every fifteen minutes, picking up from where it left off.
-
Optional: turn punches into attendance records
With your employees bound, Biotime can create ERPat attendance records from their punches. Open Settings → Attendance Import and switch on Create ERPat attendance from punches. Leave the other settings at their defaults to begin with.
Then grant Import punches into ERPat attendance to whoever should run it, and start a sync from the Sync Center with the Attendance import scope ticked. Records appear in ERPat’s Attendance screen as Pending for review.
Two things to expect the first time. Today’s shift will not appear until about six hours after the last punch — that wait is what keeps a shift whole. And some punches will be skipped with a reason shown in the new Imported column; that is the importer refusing to guess, not a failure. Day-to-day operations explains each reason.
What the nine checks are actually testing
| # | Check | What passing it proves |
|---|---|---|
| 1 | Input & URL shape | The address is a usable server address — not a URL with a path, a login embedded in it, or a missing scheme. |
| 2 | Host policy & DNS pin | The name resolves, and to an address ERPat is allowed to reach. Internal and cloud-metadata addresses are refused. |
| 3 | TLS handshake | The encrypted connection succeeds and the server’s certificate genuinely matches its name. |
| 4 | Sign in | The username and password are accepted. This is the only step that sends the password. |
| 5 | Identity & company | The signed-in session works, and we can read which company account it belongs to. |
| 6 | Personnel employees envelope | Employee records can be read, and come back in the expected shape. |
| 7 | Transactions & punch-time filter | Punches can be read and the server honours a date filter — which the incremental sync depends on completely. |
| 8 | Devices | Terminals can be read. |
| 9 | Departments / positions / areas / locations | The organization tree can be read. A partial pass is fine — Locations exists only on cloud servers. |
Want to look around first?
You can load sample data to see every screen populated — including one of each binding state — without connecting to a real server:
php erpat db:seed BiotimeDemo # load sample data
php erpat db:seed BiotimeDemo --remove # take it away againThe demo connection is created as not tested and carries no credentials of any kind, so it cannot reach a network.