HiBob time-off requests and changes, balances, policy metadata, out-of-office views, and calendar-event search. Generated from HiBob's complete callable outbound surface in the official machine-readable endpoint index: each route is checked against its own official embedded OpenAPI fragment, with raw page and extracted-contract hashes retained in the audit fixture. Inbound webhook payload pages are recorded separately rather than misrepresented as callable operations. A single openapi_source is intentionally omitted because HiBob publishes separate Markdown-wrapped fragments rather than one fetchable OpenAPI document; pinning one fragment would falsely claim coverage for the rest. Reads are uncached and permission-scoped; sensitive HR, compensation, banking, document, report, performance, and hiring reads are marked sensitive-read and require approval unless session-granted, while ordinary reads remain unheld. Every mutation is grant-off and approval-gated. JSON unsafe integers remain exact strings. No work-entity Source is declared because the official task and project contracts do not yet prove both a mandatory stable identity and a mandatory version signal.