Identity and access management
HoorayHR to Okta integration: HoorayHR as HR source for Okta users and groups
With an integration between HoorayHR and Okta, every employee from HoorayHR becomes an Okta user with job title, entity, contract type and the teams as groups, so Okta assigns the right apps. After the end date of the employment in HoorayHR Okta deactivates the user, and BSN, bank details and private address never reach Okta.
What the integration does
Organisations that do HR in HoorayHR and use Okta as their access layer now create Okta users by hand based on a Teams notification or an email. A team change in HoorayHR changes nothing about the apps in Okta, and an intern gets the same access as a permanent employee.
- An admin in HoorayHR creates an API key with read scopes only; Okta gets a custom HR source with a service app for KoppelHet.
- Every round KoppelHet reads all employees, contracts, teams and entities and drops sensitive fields immediately.
- KoppelHet compares the list with the previous state and puts only new and changed employees, groups and memberships into one Okta session.
- Okta creates or updates the users and assigns apps through the groups.
- After the end date KoppelHet delivers the employee as a deletion, and Okta deactivates the user.
What to watch for with HoorayHR and Okta
- KoppelHet uses the entry point Okta offers for a custom HR source, Anything-as-a-Source. HoorayHR then becomes the source in Okta for who works there.
- HoorayHR only lets you filter employees by ID, not by change date, and Okta only accepts changes for a custom HR source. KoppelHet therefore reads the full list every round, compares it with the previous state and delivers only the differences to Okta, in one session.
- A HoorayHR API key works with the rights of the admin who created it, and an admin sees BSN, bank account number and private address. KoppelHet discards those fields as soon as they arrive, so they do not end up in logs or in Okta.
- Teams are stored in HoorayHR as a list on the employee, but Okta only accepts plain text from a custom HR source, no lists. KoppelHet makes each team an Okta group with memberships, and only puts the team you designate as department into the department field.
- Extra fields in HoorayHR can be selection lists with several values, and they only come along when the integration asks for them separately. KoppelHet puts a single-value field as a text attribute in Okta and turns a multi-select field into groups, so custom fields can also drive access.
- A contract in HoorayHR is fixed-term, permanent or internship, with the status future, active or inactive. KoppelHet puts the contract type as text in Okta, so an intern gets other apps through a group rule, and already delivers an employee with only a future contract along with their start date.
- HoorayHR can hide users from non-admins and has an archived status. KoppelHet agrees whether hidden users go to Okta, and treats an archived employee without an end date as a signal for HR instead of deactivating them in Okta straight away.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens when the API key expires?
The expiry date is fixed at creation. KoppelHet warns well in advance, so an admin creates a new key.
Does the Okta address go back to HoorayHR?
No. HoorayHR's API cannot update an existing employee.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HoorayHR through api.hoorayhr.io with a personal API key (pk_…, admin role, scopes and expiry date not editable afterwards) as Bearer token: GET /users (filter only on id; fields id, employeeNumber, firstName, nickName, formattedLastName, email, jobTitle, entityId, teams, status 0 to 3, isHidden, companyStartDate, companyEndDate; extraFields only with includeExtraFields), /contracts (type, status ACTIVE/FUTURE/INACTIVE), /teams-information and /entities. A 403 for an inactive subscription stops the round.
- Okta through the Identity Sources API (Custom Identity Source) with a service app: sessions (one at a time per source, expire after 24 hours of inactivity, INCREMENTAL only), bulk upsert with externalId and text attributes only (200 per request, 50 requests per session), groups and memberships separately, bulk delete deactivates the user.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HoorayHR | Field in Okta | Notes |
|---|---|---|
id (HoorayHR) | externalId | Fixed and immutable |
employeeNumber | employeeNumber | |
nickName of firstName | firstName | |
formattedLastName | lastName | |
Naamgevingsregel of email | email en login | Never emailPrivate |
jobTitle | title | |
entityId (naam uit entities) | organization | |
teams | Groep per team | |
Contracttype (1, 2 of 3) | userType | |
companyStartDate | Eigen attribuut startdatum (tekst) | |
companyEndDate | Uit de HR-bron (deactiveren) |
Related
HoorayHR → Active Directory
HoorayHR to Active Directory integration: domain account from the personnel file
ASHoorayHR → Arbodienst (SIVI)
HoorayHR to occupational health service via SIVI: sickness dossiers and their phases from HoorayHR to the health service
HoorayHR → Microsoft Entra ID
HoorayHR to Entra ID integration: Microsoft 365 account on the start date from HoorayHR
HoorayHR → Google Workspace
HoorayHR to Google Workspace integration: a Google account from the start date