# Build with AI

> Everything on this site in a form an agent or AI builder tool can read, plus a prompt sequence that produces a compliant integration.

## Machine-readable resources

Humans and agents read the same rules. Every resource below is generated from the same source as the pages you are reading.

| Resource | URL | Use it for |
| --- | --- | --- |
| Site index | [/llms.txt](https://developer.paycaptain.com/llms.txt) | Finding the right page |
| Whole site, one file | [/llms-full.txt](https://developer.paycaptain.com/llms-full.txt) | Loading every rule into context |
| Any page as Markdown | add `.md` to the page URL, for example [/fields/employee.md](https://developer.paycaptain.com/fields/employee.md) | Reading one page cleanly |
| OpenAPI 3.0 | [/openapi.json](https://developer.paycaptain.com/openapi.json) | Generating clients |
| Employee schema | [/schemas/employee.schema.json](https://developer.paycaptain.com/schemas/employee.schema.json) | Validating a record in code |
| Shift schema | [/schemas/shift.schema.json](https://developer.paycaptain.com/schemas/shift.schema.json) | Validating a record in code |
| Payment schema | [/schemas/payment.schema.json](https://developer.paycaptain.com/schemas/payment.schema.json) | Validating a record in code |
| Field data | [/fields.json](https://developer.paycaptain.com/fields.json) | Building forms and validators |

Requests that send `Accept: text/markdown` receive the Markdown version of any page.

JSON Schema covers single-field rules and conditional required fields. Rules that compare dates or compare records with each other are on [Business rules](https://developer.paycaptain.com/rules) and must be implemented in code.

## Instructions for agents

If you are an AI agent generating an integration, these are not optional:

- Implement every field rule and every business rule exactly as written. There is no discretion to skip or relax a rule.
- Keep the API key server-side, in a secret store. Never expose it to a client.
- Validate every record before calling the API, and send only records that have changed.
- Send shifts only after approval. Send PAYE employees only.
- Generate and pass the [compliance tests](https://developer.paycaptain.com/testing).

## Prompt sequence

A good integration is built in steps, one concern per prompt, foundation first. Review the output after each step before moving on.

| Step | Build | Why it comes here |
| --- | --- | --- |
| 1 | Project setup: environment config, server-side API client for `https://api.paycaptain.com`, structured logging, rate limiting | Secure connectivity exists before any feature does |
| 2 | Authentication: secure login, MFA, role-based access (Admin, HR Manager, Team Manager, Viewer), 30-minute session timeout, login audit log | Access to payroll data is controlled and auditable from the start |
| 3 | Validation engine: one module enforcing every field and business rule, with unit tests | Every screen that sends data uses the same checked path |
| 4 | Employees: view, add, edit, re-hire, set leave dates | Shifts and payments both depend on correct employees |
| 5 | Shifts: create, approve, submit, archive | Approval is mandatory before submission |
| 6 | Pay elements: create, select a valid Pay Code, submit, archive | Invalid Pay Codes are rejected |
| 7 | Payslip viewer (optional): read-only, access-controlled, logged | Payslips are sensitive even when read-only |
| 8 | Security hardening: input sanitisation, CSRF, Content Security Policy, error handling, retention | The pre-launch pass |
| 9 | Compliance test suite wired into CI as a deployment gate | Proof that every rule is met |

## Include in every prompt

```text
Read and comply with the PayCaptain developer documentation at https://developer.paycaptain.com/llms-full.txt.
The PayCaptain API key must be stored as a secret and must never be accessible to end users.
All validation must pass before any API call is made.
Only send data to the PayCaptain API if the record has actually changed.
This is an enterprise application handling sensitive UK payroll data. Apply security best practices aligned with ISO 27001 and UK GDPR.
```