PHP / API Quick Reference

5 steps to connect your app. Works with Postman, cURL, or any HTTP client.

Base URL: https://api.punchconnect.com/api/v2/zk

Set Your Auth Headers

Every request needs these headers. Get your credentials from the dashboard.

Header	Value
`X-CLIENT-ID`	Your API client ID
`X-CLIENT-SECRET`	Your API client secret
`Content-Type`	application/json
`Accept`	application/json

bashPostman / cURL

curl https://api.punchconnect.com/api/v2/zk/devices \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json"

List & Update Devices

Devices are registered through the dashboard. Use the API to list and update them.

bashGET /devices

curl https://api.punchconnect.com/api/v2/zk/devices \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Accept: application/json"

Update a device:

bashPUT /devices/{id}

curl -X PUT https://api.punchconnect.com/api/v2/zk/devices/1 \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Main Entrance",
    "site_name": "Head Office",
    "site_id": 1,
    "timezone": 1
  }'

Also available: GET /devices/{id} to get a single device's details.

Add an Employee to a Device

bashPOST /employees

curl -X POST https://api.punchconnect.com/api/v2/zk/employees \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "EMP-0042",
    "uid": 1001,
    "name": "Ahmed Mansouri",
    "card_no": "0012345678",
    "privilege": "user",
    "verify_mode": 1,
    "device_id": 1
  }'

Field	Type	Required
`user_id`	string	Yes
`uid`	integer	Yes
`name`	string	Yes
`device_id`	integer	Yes
`employee_id`	integer	No
`card_no`	string	No
`password`	string	No
`privilege`	"user" or "admin"	No
`verify_mode`	integer (1–15)	No

Other endpoints: PUT /employees/{id} (update), DELETE /employees/{ids} (remove, comma-separated), GET /devices/{device}/employees (list employees on a device), POST /employees/{id}/sync-from-device (pull from device).

Push Attendance Records

bashPOST /attendances/push

curl -X POST https://api.punchconnect.com/api/v2/zk/attendances/push \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "id": 5001,
      "uid": 1001,
      "timestamp": "2026-03-10 08:01:23",
      "site_id": 1,
      "site_name": "Head Office",
      "device_name": "Main Entrance",
      "mac_address": "AA:BB:CC:DD:EE:FF"
    }
  ]'

jsonResponse

{
  "status": true,
  "data": [5001]
}

Fetch records: GET /devices/{device}/attendances. Delete: DELETE /devices/{device}/attendances/{ids}.

Send Device Commands

bashPOST /commands

curl -X POST https://api.punchconnect.com/api/v2/zk/commands \
  -H "X-CLIENT-ID: your_client_id" \
  -H "X-CLIENT-SECRET: your_client_secret" \
  -H "Content-Type: application/json" \
  -d '{ "device_id": 1, "command": "reboot" }'

Command	What it does
`reboot`	Restart the device (~30s downtime)
`clear_log`	Clear attendance log on the device
`clear_data`	Remove all employees + attendance from device
`clear_admins`	Remove admin privileges from all users on device

Error Codes

Status	Meaning
200	Success
401	Invalid or missing API credentials
404	Resource not found
422	Validation error (check your fields)
429	Rate limited — slow down
500	Server error — retry later

Next steps

API Reference

Full endpoint documentation

Pricing Plans

Choose the right plan