Coming next
Mobile
The API is ready; there is no client yet.
Not built yet. Described here so it can be planned around.
Every endpoint already accepts a bearer token and resolves the same context as a browser session, so the whole product is reachable from a mobile client today. Token issuance and refresh are built. What does not exist yet is the client.
The case for it is strongest for exactly the people who have no desk: recording attendance, booking leave, and seeing a rota. That work waits until the other modules are finished.