Identity and access management
Darwinbox to Google Workspace integration: Google accounts that follow the lifecycle in Darwinbox
With an integration between Darwinbox and Google Workspace, every new employee from Darwinbox gets a Google account in the organisational unit of their group company, with job title, department and manager, and that account is suspended once the departure in Darwinbox is approved. Darwinbox has no Google Workspace integration of its own, so KoppelHet reads the Darwinbox APIs, writes through Google's Admin SDK and puts the new Google address back in Darwinbox.
What the integration does
Organisations that use Darwinbox as their HR system and have their staff work in Google Workspace often create Google accounts by hand after an email from HR. The Google address then still has to be retyped into Darwinbox, and a departure HR later withdraws leaves a suspended account that nobody restores.
- We request API access from Darwinbox for the Employee Core APIs, with a dataset holding only the fields for Google.
- Google gets a service account with domain-wide delegation and only the scopes for users, groups and file transfer.
- On the activation date KoppelHet creates the Google account in the right organisational unit, and writes the address back to Darwinbox.
- Changes in job, department and manager go to the Google profile every hour.
- After an approved departure KoppelHet suspends the account on the last working day and transfers the files to the manager after the retention period.
What to watch for with Darwinbox and Google Workspace
- We found no ready-made Google Workspace integration from Darwinbox. Darwinbox only opens API access on request for authorised users, with its own API key per endpoint. KoppelHet requests that access at the start of the project, so the lead time does not wait on Darwinbox.
- Darwinbox can fetch employees by the date they were activated in Darwinbox. Every morning KoppelHet requests that day's activations and then creates the Google account, even if nothing else about the employee changed.
- The Google address only exists once KoppelHet creates the account. Through Darwinbox's update call KoppelHet writes that address back as the email ID, so Darwinbox sends mail and notifications to the work address. The call can also activate, but KoppelHet leaves that to HR.
- A departure in Darwinbox is approved, pending or revoked. KoppelHet only suspends the Google account for an approved departure, and lifts the suspension if HR withdraws the departure after all, so mailbox and files come back untouched.
- Darwinbox keeps the manager as a series of periods with a start and end date. Google expects the email address of that person for the manager relation. KoppelHet takes the period running today and puts that manager's Google address in the relation.
- Deleted hires are in a separate list in Darwinbox, with date and reason. If a Google account already exists for such a person, KoppelHet deletes it, so no licence keeps running; a super administrator can restore it within twenty days if it was a mistake.
- Darwinbox is used by groups with many group companies. In Google the organisational unit decides which apps and policy apply. KoppelHet places each employee in the unit of their group company and skips group companies that do not belong in this Google environment.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to a leaver's files?
After the retention period KoppelHet transfers the Drive files to the manager and then deletes the account. A suspended account still costs a licence at Google.
Does salary data go to Google?
No. The dataset in Darwinbox only holds name, job, department, group company, manager and the departure data.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Darwinbox through the Employee Core APIs with basic auth plus api_key per endpoint, or OAuth 2.0: masterapi/employee with datasetKey and last_modified or date_of_activation, orgmasterapi/employeeManager (From, To), UpdateEmployeeDetails/separationDetails (Approved, Pending, Revoked), UpdateEmployeeDetails/getDeletedEmployees and writing back with UpdateEmployeeDetails/update (email_id). API access on request only.
- Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, orgUnitPath, organizations, relations type manager with email address, suspended; undelete within twenty days) and the Data Transfer API for Drive, with a service account with domain-wide delegation. Given and family name at most 60 characters.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Darwinbox | Field in Google Workspace | Notes |
|---|---|---|
employee_id | externalIds (type organization) | |
Voornaam en achternaam | name.givenName en name.familyName | |
Naamgevingsregel | primaryEmail | |
designation | organizations.title | |
department | organizations.department | |
group company | orgUnitPath | |
employeeManager (geldende periode) | relations (type manager) | |
separation_status en laatste werkdag | suspended |
Related
Darwinbox → Active Directory
Darwinbox to Active Directory integration: domain accounts that follow Darwinbox, per office location
Darwinbox → ADP iHCM
Darwinbox to ADP iHCM integration: CTC changes, extra payments and approved separations to Dutch ADP payroll
Darwinbox → AFAS Profit
Darwinbox to AFAS integration: Dutch employees from Darwinbox in AFAS payroll
ASDarwinbox → Arbodienst (SIVI)
Darwinbox to the occupational health service via SIVI: approved sick leaves as absence reports