Hey,
Any kind of action or any other domain’s APIs would follow the same guidelines, which I have mentioned in the post.

The endpoint for promote would like
PUT /companies/3/employees/5/promote

Demote API endpoint would be
DELETE /companies/3/employees/5/promote

Bonus API endpoint would be
PUT /companies/3/employees/5/bonus with bonus details in the request body

Mark as an ill API endpoint would be
PUT /companies/3/employees/5/ill with a date in the request body

Please let me know, if this was sufficient to clear your doubts.

Thanks