Identity and access management
Darwinbox to SailPoint integration: Darwinbox as authoritative source in SailPoint Identity Security Cloud
With an integration between Darwinbox and SailPoint Identity Security Cloud, Darwinbox becomes the authoritative source, so every employee gets an identity with job title, department, group company and manager, and the lifecycle state follows on hire and approved departure. SailPoint has no Darwinbox connector; KoppelHet reads the Darwinbox API and delivers to a Delimited File source through SailPoint's API.
What the integration does
Organisations that use Darwinbox as HR system and SailPoint for identity governance often load Darwinbox with a report someone exports by hand. A departure still waiting for approval is then already treated as a departure, or an approved departure only reaches SailPoint days later.
- We request API access from Darwinbox, with a dataset containing the fields SailPoint needs.
- In SailPoint we create a Delimited File source as authoritative source, with an identity profile.
- Together with you we record the lifecycle states, and which Darwinbox status belongs to which state.
- KoppelHet builds the file from the Darwinbox API and delivers it through SailPoint's API, which starts the aggregation straight away.
- After a trial aggregation in a sandbox the integration goes live.
What to watch for with Darwinbox and SailPoint
- SailPoint's connector documentation contains no connector for Darwinbox. KoppelHet therefore does not build a custom SaaS connector that the SailPoint team would have to maintain, but delivers to a Delimited File source, with the same columns in every delivery.
- A departure in Darwinbox has the status approved, pending or revoked, and Darwinbox only returns that data for a given list of employees. KoppelHet requests it for all employees in the delivery and only sets an end date when approved. A transform in SailPoint turns that into the lifecycle state.
- Darwinbox keeps a list of deleted hires, with date, reason and who deleted them. If such a person already exists as an identity in SailPoint, KoppelHet delivers them with a status of their own, so SailPoint revokes the staged account and an audit shows why.
- Besides the direct manager Darwinbox also gives a second-level manager. SailPoint uses the manager for certifications and approvals. KoppelHet delivers both, so a certification can go to the second line if the direct manager leaves.
- Darwinbox returns dates in several formats, such as 12-Aug-2011. A transform in SailPoint expecting another format then sets a lifecycle state wrongly or not at all. KoppelHet delivers all dates in one fixed format, recorded in the identity profile.
- Darwinbox can record a change of manager with a future effective date, visible in the employment history. KoppelHet puts the manager who applies today in the delivery, so certifications do not run ahead of a transfer.
- In Darwinbox the employee_id can be changed; according to Darwinbox the email call also updates employee IDs. A changed account ID would be seen by SailPoint as a new account. KoppelHet therefore uses the internal user_id as account ID and delivers the employee_id as an attribute.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not a custom SailPoint connector for Darwinbox?
Your SailPoint team would have to maintain it. A Delimited File source is standard in SailPoint; KoppelHet makes sure the file is right.
Does a departure awaiting approval count?
No. Only an approved departure gets an end date in SailPoint.
Do leavers remain visible in SailPoint?
Yes, with their end date, so certifications and audits can look back.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Darwinbox Employee Core APIs (api_key with basic auth, or OAuth 2.0 client credentials with a 3600-second token): masterapi/employee with datasetKey and last_modified (including employee_id, first_name, last_name, department_name, designation_name, direct_manager_employee_id, l2_manager_employee_id, office_country, company_email_id, date_of_joining, date_of_exit); UpdateEmployeeDetails/separationDetails (separation_status and employee_ids required); UpdateEmployeeDetails/getDeletedEmployees; UpdateEmployeeDetails/employeehistory with filter_on_effective_date.
- SailPoint Identity Security Cloud: Delimited File source as authoritative source, CSV through the import accounts API (load-accounts), which starts the aggregation; identity profile with transforms on startDate, endDate and separationStatus for the lifecycle states; manager correlation on employeeNumber.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Darwinbox | Field in SailPoint | Notes |
|---|---|---|
user_id | Account ID (uid) | |
employee_id | employeeNumber | |
first_name, last_name | firstname, lastname | |
company_email_id | email | |
designation_name | jobTitle | |
department_name | department | |
Group company, office_country | company, country | |
direct_manager_employee_id, l2_manager_employee_id | manager, secondManager | |
date_of_joining, separation (Approved, Pending, Revoked) | startDate, endDate, separationStatus (lifecycle state) |
Related
Darwinbox → Active Directory
Darwinbox to Active Directory integration: domain accounts that follow Darwinbox, per office location
Darwinbox → ADP iHCM
Darwinbox to ADP iHCM integration: CTC changes, extra payments and approved separations to Dutch ADP payroll
Darwinbox → AFAS Profit
Darwinbox to AFAS integration: Dutch employees from Darwinbox in AFAS payroll
ASDarwinbox → Arbodienst (SIVI)
Darwinbox to the occupational health service via SIVI: approved sick leaves as absence reports