How Workniva reads punches from the biometric and card terminals commonly found in Indian offices — and how to get from "the machine has the data" to "attendance is in Workniva" without exposing your device to the internet.
The principle. Workniva never reads fingerprints or face templates and never connects inbound to your terminal. It ingests punch events — who · when · in/out — either as a file you export, or pushed by a small connector program that runs on a PC in your office. The original device log stays the source of truth; Workniva keeps every event as received and computes attendance days from them.
Three ways in
Pick the path that matches your setup.
Upload an export
Best for small teams and for trying Workniva. Export the attendance log from your device software (or the terminal's USB download), arrange four columns, and upload it on Device connections → Import punch CSV / XLSX. Do this daily, weekly or at month end. Re-uploading is safe — duplicates are recognised by their event ID.
Run the connector
Best for daily automation. A single Python script (connector/connector.py) runs on any always-on Windows or Linux PC that can read the vendor export and reach Workniva over HTTPS. It queues events locally, delivers them in batches, retries after outages and sends a heartbeat so you can see a device going quiet.
Use the ingestion API
Best if your vendor's server (COSEC Centra, BioStar, iVMS, a custom middleware) can call a webhook or run a scheduled job. POST /api/connector/events/ with a Bearer device token and up to 500 events per call. Same idempotency rules as the connector.
The format
Four columns, that's all.
Column
Meaning
Example
event_id
A stable, unique ID for this punch from the source. Never build it from the timestamp alone — two people can punch in the same second.
K40-A-000412
biometric_id
The user number enrolled on the terminal (called Enroll No., User ID, PIN or Badge number depending on the vendor). Mapped to an employee inside Workniva.
105
timestamp
ISO-8601 with the timezone offset. India is +05:30; no DST.
2026-09-01T09:02:14+05:30
direction
in, out or unknown. See the note on direction below.
in
Sample file: connector/sample-punches.csv in the repository. Excel users: keep the ID columns as text so leading zeros survive.
About direction
Most terminals don't know "in" from "out".
Unless staff press an In / Out function key before scanning (or the device is configured as an entry- or exit-only reader), the log only says someone punched at 09:02. Export that as unknown. Workniva keeps such days as incomplete for review rather than guessing, so decide up front: either configure the terminal to record status, use two readers (one per door side), or accept a review step. Reviewed corrections never overwrite the raw punch.
Device families
Where the export lives, vendor by vendor.
Menu names vary by model and firmware; treat these as the usual places to look and confirm with your dealer. None of these models is individually certified by Workniva yet — the export path works for all of them, direct adapters are on the roadmap.
Where the log is: ZKTime / ZKBio Time (formerly ZKAccess) → Report → Attendance / Transaction log → export to Excel or CSV. Standalone units also write a .dat file to a USB stick (Menu → Data Mgt → Download attendance data). ADMS/Push SDK models can post to a server URL — that path needs a direct adapter (roadmap).
Map these columns: User ID / PIN → biometric_id; Time or Punch Time → timestamp; Verify/Status (0 = in, 1 = out on most firmware) → direction; build event_id as device-serial + row number or the device log ID.
eSSL, Realtime, Biomax and several Indian brands are ZKTeco platforms; the same steps usually apply.
Fingerprint · face · card
eSSL
X990 / K90 / iFace / MB160 / eSSL Ai-Face · with eTimeTrackLite or eSSL Etimetrack
Where the log is: eTimeTrackLite → Reports → Device Logs (or Raw Punches) → Export. The desktop edition stores logs in an MS Access/SQL Server database (DeviceLogs_<month> tables) that a scheduled query can dump to CSV.
Map these columns: UserId → biometric_id; LogDate → timestamp (add +05:30); Direction/C1 column if the terminal records In/Out, else unknown; DeviceLogId → event_id.
Most eSSL sites never configure In/Out keys — plan a review step or configure attendance status on the device.
Fingerprint · face · card · access control
Matrix COSEC
VEGA FAX / ARGO FACE / DOOR / PATH series · COSEC Centra or COSEC Lite server
Where the log is: COSEC Centra → Time & Attendance → Reports → Raw Events / Punch Events → export CSV or Excel. Centra also exposes REST APIs (COSEC APIs) that a scheduled job can poll and post to the Workniva ingestion API.
Map these columns: User ID → biometric_id; Event Date + Time → timestamp; Entry/Exit (COSEC records this when readers are configured as entry or exit) → direction; Event ID / SequenceNo → event_id.
Entry/exit readers make direction reliable here; Matrix is the most consistent vendor for in/out.
Where the log is: iVMS-4200 → Access Control → Time & Attendance → Attendance Records (or Event Search) → Export to CSV/Excel. Hik-Connect / HikCentral Professional also export. ISAPI event push to a server URL exists — direct adapter on the roadmap.
Map these columns: Person ID / Employee No. → biometric_id; Time → timestamp; Attendance Status (Check-in / Check-out) → direction when configured, else unknown; Serial No. + record index → event_id.
Set the terminal to attendance mode with Check-in/Check-out status keys for direction.
Where the log is: Vendor desktop software (Realtime Attendance Software, BioTime, Mantra AMS…) → Reports → Punch / Log report → Excel. Many units are ZKTeco-based and also support the USB .dat download.
Map these columns: Enroll No. → biometric_id; Date + Time → timestamp; Status/Mode → direction or unknown; device + log index → event_id.
Firmware varies a lot across these brands; do one day's test import before automating.
Where the log is: BioStar 2 → Monitoring → Event Log → export CSV, or the Time & Attendance module → Report. BioStar 2 has a documented REST API for scheduled polling; the database can also be queried with a service account.
Map these columns: User ID → biometric_id; Datetime → timestamp; T&A key (In/Out) → direction when the T&A module is used; Event index → event_id.
A strong fit for the ingestion API path via a small scheduled script.
SaaS terminals & apps
Cloud attendance services
ZKBio Cloud, Jibble, uAttend, Spintly, Truein and similar
Where the log is: Their dashboards export punch logs as CSV; several offer webhooks or APIs. Point a webhook or a scheduled export at the Workniva ingestion API or upload the CSV.
Map these columns: Their user/employee code → biometric_id; ISO timestamp → timestamp; in/out if present; their event or record ID → event_id.
Phone · GPS · selfie
Workniva field app
Any Android/iOS phone with a modern browser, over HTTPS
Where the log is: No export needed — reviewed field check-ins enter attendance directly as a separate, clearly labelled source.
Map these columns: Configured per worksite: geofence radius, GPS accuracy limit, selfie required or optional, evidence retention.
Best for outdoor, travelling and multi-site staff without a terminal.
Step by step
From unboxed terminal to first attendance day.
1
Enrol users with the same IDs you use in Workniva
Set each person's user number on the terminal to their Workniva employee ID where the device allows it. If IDs differ, that's fine — you map them in the next step — but consistent numbering saves work when staff move between branches.
2
Create a device connection
Device connections → New connection: name it after the physical terminal ("Reception, 2nd floor") and pick the branch. Copy the one-time token into the connector's environment — Workniva stores only its hash.
3
Map machine users to employees
Map a machine user links each biometric ID to an employee, per device. Unmapped events are kept and highlighted; mapping them later re-computes the affected days. Reusing an ID for a new joiner needs an effective from date so history stays correct.
4
Check the terminal clock and timezone
Set the device to Indian Standard Time and, if supported, NTP time sync. Events more than five minutes in the future are rejected so clock drift shows up immediately instead of corrupting a month.
5
Upload one day, compare, then automate
Import a single day's export and compare the count on the Devices page with what the terminal shows. Once it matches, run the connector on a schedule (Windows Task Scheduler or a Linux systemd timer, every 5–15 minutes) using the same export path.
6
Watch the health signals
The Devices page shows last sync, last heartbeat, backlog and the last error class. A device that stops heart-beating while people are punching is the first thing to check before payroll.
Running the connector
Copy-paste for the office PC that can read the export.
Outbound HTTPS only — no port forwarding, no inbound access to the terminal.
One queue file per device; keep it on the PC's private disk and back it up.
Rotate the token from Device connections if the PC is replaced; the old token stops working immediately.
Windows: run it as a scheduled task under a dedicated user; Linux: a systemd service with Restart=on-failure.
No terminal at all?
Options that work today.
Field attendance appGeofenced or travelling-worker check-ins from a phone, with optional selfie, an encrypted offline queue and reviewer approval. Built into every plan.
Register / spreadsheetA supervisor's daily sheet can be typed into the four-column CSV and uploaded; mark direction unknown where only presence was recorded.
Any RFID / QR reader that logs to a PCIf it writes a file, the connector can read it. If it calls a URL, point it at the ingestion API.
Compatibility check
Not sure about your model?
Tell us the make, model and the software you use with it. We'll confirm the export path, or tell you honestly if a direct adapter is needed first.