diff --git a/Gemfile.lock b/Gemfile.lock
index a610b53..bdeb076 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,20 +2,31 @@ PATH
   remote: .
   specs:
     xpm_ruby (0.1.0)
-      faraday
+      faraday (~> 1)
+      ox (~> 2.13)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.0)
+    byebug (11.1.3)
+    coderay (1.1.2)
     diff-lcs (1.3)
     faraday (1.0.1)
       multipart-post (>= 1.2, < 3)
     jaro_winkler (1.5.4)
+    method_source (1.0.0)
     multipart-post (2.1.1)
+    ox (2.13.2)
     parallel (1.19.1)
     parser (2.7.0.5)
       ast (~> 2.4.0)
+    pry (0.13.1)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    pry-byebug (3.9.0)
+      byebug (~> 11.0)
+      pry (~> 0.13.0)
     rainbow (3.0.0)
     rake (13.0.1)
     rspec (3.9.0)
@@ -48,6 +59,8 @@ PLATFORMS
 
 DEPENDENCIES
   bundler (~> 2.0)
+  byebug (~> 11)
+  pry-byebug (~> 3)
   rake (>= 12.3.3)
   rspec (~> 3.0)
   rubocop (= 0.77.0)
diff --git a/lib/xpm_ruby.rb b/lib/xpm_ruby.rb
index 4808228..edeb489 100644
--- a/lib/xpm_ruby.rb
+++ b/lib/xpm_ruby.rb
@@ -1,8 +1,8 @@
-require "xpm_ruby/version"
-
-require "xpm_ruby/connection"
-
 module XpmRuby
   class Error < StandardError; end
-  # Your code goes here...
+  class Unauthorized < Error; end
 end
+
+require "xpm_ruby/version"
+require "xpm_ruby/connection"
+require "xpm_ruby/staff"
diff --git a/lib/xpm_ruby/models/staff.rb b/lib/xpm_ruby/models/staff.rb
new file mode 100644
index 0000000..32a3bf9
--- /dev/null
+++ b/lib/xpm_ruby/models/staff.rb
@@ -0,0 +1,26 @@
+module XpmRuby
+  module Models
+    class Staff
+      attr_accessor :uuid, :name, :email, :phone, :mobile, :address, :payroll_code
+
+      def initialize(uuid: nil, name: nil, email: nil, phone: nil, mobile: nil,
+                    address: nil, payroll_code: nil)
+        @uuid = uuid
+        @name = name
+        @email = email
+        @phone = phone
+        @mobile = mobile
+        @address = address
+        @payroll_code = payroll_code
+      end
+
+      def ==(other)
+        uuid == other.uuid
+      end
+
+      def eql?(other)
+        self == other
+      end
+    end
+  end
+end
diff --git a/lib/xpm_ruby/staff.rb b/lib/xpm_ruby/staff.rb
new file mode 100644
index 0000000..0084f6f
--- /dev/null
+++ b/lib/xpm_ruby/staff.rb
@@ -0,0 +1,48 @@
+require "ox"
+
+require_relative "models/staff"
+
+module XpmRuby
+  module Staff
+    extend self
+
+    class Error < Error; end
+
+    def build(**args)
+      Models::Staff.new(args)
+    end
+
+    def list(api_key:, account_key:, api_url:)
+      response = Connection
+        .new(api_key: api_key, account_key: account_key, api_url: api_url)
+        .get(endpoint: "staff.api/list")
+
+      case response.status
+      when 401
+        hash = Ox.load(response.body, mode: :hash_no_attrs, symbolize_keys: false)
+
+        raise Unauthorized.new(hash["html"]["head"]["title"])
+      when 200
+        hash = Ox.load(response.body, mode: :hash_no_attrs, symbolize_keys: false)
+
+        case hash["Response"]["Status"]
+        when "OK"
+          hash["Response"]["StaffList"]["Staff"].map do |staff|
+            Models::Staff.new(
+              uuid: staff["UUID"],
+              name: staff["Name"],
+              email: staff["Email"],
+              phone: staff["Phone"],
+              mobile: staff["Mobile"],
+              address: staff["Address"],
+              payroll_code: staff["PayrollCode"])
+          end
+        when "ERROR"
+          raise Error.new(response["ErrorDescription"])
+        end
+      else
+        raise Error.new(response.status)
+      end
+    end
+  end
+end
diff --git a/spec/staff_spec.rb b/spec/staff_spec.rb
new file mode 100644
index 0000000..81a702b
--- /dev/null
+++ b/spec/staff_spec.rb
@@ -0,0 +1,35 @@
+require "spec_helper"
+
+module XpmRuby
+  RSpec.describe(Staff) do
+    describe ".list" do
+      context "when keys invalid" do
+        let(:api_key) { "" }
+        let(:account_key) { "" }
+        let(:api_url) { "api.workflowmax.com" }
+
+        xit "raises unauthorized error" do
+          expect do
+            Staff.list(api_key: api_key, account_key: account_key, api_url: api_url)
+          end.to raise_error(Unauthorized)
+        end
+      end
+
+      context "when keys valid" do
+        let(:api_key) { "" }
+        let(:account_key) { "" }
+        let(:api_url) { "api.workflowmax.com" }
+
+        xit "lists staff" do
+          expect(
+            Staff.list(api_key: api_key, account_key: account_key, api_url: api_url)
+          ).to include(
+            Staff.build(
+              name: "Dev Testing",
+              email: "dev@practiceignition.com",
+              uuid: "8c79202e-caf8-4a12-a3d7-ac338e50741f"))
+        end
+      end
+    end
+  end
+end
diff --git a/xpm_ruby.gemspec b/xpm_ruby.gemspec
index 26bc43d..569b56e 100644
--- a/xpm_ruby.gemspec
+++ b/xpm_ruby.gemspec
@@ -32,5 +32,9 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency("rubocop", "0.77.0")
   spec.add_development_dependency("rubocop-rspec")
 
-  spec.add_runtime_dependency("faraday")
+  spec.add_development_dependency("byebug", "~> 11")
+  spec.add_development_dependency("pry-byebug", "~> 3")
+
+  spec.add_runtime_dependency("faraday", "~> 1")
+  spec.add_runtime_dependency("ox", "~> 2.13")
 end