Who is on site now

Everyone who is checked in **right now**: each open shift (checked in, not yet checked out) that is still inside the 12-hour auto-close window, oldest check-in first, paginated. Use it to answer "has Sam arrived at the job site?" before they check out — a diary entry only exists after check-out. A person who is not listed has not checked in, or has already checked out (finished shifts are in `GET /diary-entries`). An API key is **Admin-equivalent and tenant-wide**, so this returns every open shift in the tenant. The narrower in-app visibility (a Site Manager sees their sites plus their own shift; Site Crew see nobody) does not apply to a key; there is no crew-scoped API credential. **This read never writes.** A shift at or past 12 hours counts as closed and is simply left out; it is the diary reads (and an hourly job) that close it and write its `auto_closed` entry. Check-in and check-out themselves are not available over the API — shifts open and close only in the FOREMAN app.

curl -X GET "https://example.com/attendance/on-site"

{  "data": [    {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b",      "userName": "string",      "projectId": "5a8591dd-4039-49df-9202-96385ba3eff8",      "projectName": "string",      "shiftDate": "2019-08-24",      "checkInAt": "2019-08-24T14:15:22Z",      "siteTimezone": "string",      "autoCloseAt": "2019-08-24T14:15:22Z",      "checkInLocation": {        "verdict": "on_site",        "distanceM": 0,        "accuracyM": 0,        "missingReason": "no_site"      }    }  ],  "nextCursor": "string"}

{  "error": {    "code": "unauthorized",    "message": "Missing or invalid API key."  }}

{  "error": {    "code": "validation",    "message": "One or more inputs are invalid.",    "fields": {      "fieldName": "A message explaining what's wrong with this field."    }  }}