A new API for Time & Attendance has been added with BioStar v2.8.13.
Just like the BioStar 2 New Local API, there’s no need to install anything separate for the TA API.
You can simply install or upgrade to BioStar v2.8.13 or a higher version to use the TA API.
With the TA API, you can now perform various Time and Attendance (T&A) functions through API calls, such as creating, retrieving, editing, and deleting Time Codes, Shift Schedules, Punch Logs, and more.
All TA API requests are made to endpoints beginning with https://[BioStar 2 IP Address]:[TA port]/tna
How to access TA API Swagger
[BioStar 2 address] + ':’ + (your TNA https port) + ‘/docs/#'
*You can check the https port for T&A in setting.conf file in BioStar install location.
TNA https port is usually set to ‘3002'.
How to Log In to TA
There are 2 ways of logging in.
1) POST /login
2) POST /login/sso
* Before you run this API, login to BioStar 2 server using the AC API /api/login and obtain the bs-session-id value from the response.
Here's a link on how to obtain the bs-session-id : [BioStar 2 API] How To Use BioStar 2 New Local API
* You must use the 'user_id' of the logged in user AC API /api/login for the 'user_id' parameter. You can not use ‘user_name’ or 'login id'. 
Once you are successfully logged in, you’ll see the logged-in user’s information in the ‘Response Body’ and ‘200’ in the ‘Response Code’.
Postman Example of T&A Login API
This is how to login to T&A via API using Postman.
1) POST /login
[Request Example]
2) POST /login/SSO
* Obtain "biostar_session_id" from AC API /api/login.
Here's a link on how to obtain the bs-session-id : [BioStar 2 API] How To Use BioStar 2 New Local API
[Request Example]
[Response Example]
Unlike the AC API, you don't need to manually copy and paste the be-session-id value for other TA API calls. After logging in to T&A, the server session saves user information, and the web browser stores a bs-ta-session-id cookie. When an API request is sent to the TA server, the browser automatically includes the bs-ta-session-id in the API request header. This bs-ta-session-id value identifies the session location on the server, allowing it to verify if user information is saved in that session. If the cookie and session information match, the API request will be processed and returned successfully. If the information doesn’t match or the cookie is missing, BioStar will log out, and the API call will fail.
