Identity and access management
HoorayHR to SailPoint integration: HoorayHR as authoritative source in SailPoint
With an integration between HoorayHR and SailPoint, every employee from HoorayHR becomes an identity in SailPoint, with entity, team, job title, team lead as manager and the employment dates. KoppelHet delivers HoorayHR as a complete file to a Delimited File source, so SailPoint grants access at the start and revokes it after departure.
What the integration does
Organisations that record HR in HoorayHR and govern access with SailPoint have no source in SailPoint that knows HoorayHR yet. Identities then come from a manual export, which lacks an end date or a team change from last week.
- An admin in HoorayHR creates an API key with read scopes only; SailPoint gets a Delimited File source with an identity profile.
- KoppelHet reads all employees, contracts, teams and entities and drops sensitive fields immediately.
- KoppelHet writes one row per employee, with the agreed team, the team lead and the dates in a fixed format.
- SailPoint aggregates the file and calculates the lifecycle state with a transform.
- Roles and access profiles in SailPoint follow team, entity and lifecycle state.
What to watch for with HoorayHR and SailPoint
- SailPoint has no source for HoorayHR, and HoorayHR lists no integration with an IAM system. KoppelHet delivers the employees as a file to a Delimited File source, which SailPoint can use as an authoritative source.
- The HoorayHR API has no change-date filter for employees, so the integration always reads the whole list. That fits a Delimited File source, which wants to see all accounts at every aggregation. KoppelHet therefore writes the file completely every round, without its own change logic.
- An employee can be in several teams in HoorayHR, and a SailPoint transform only uses the first value of a multi-value attribute. KoppelHet puts the agreed team as a single column for the department, and all teams in a separate multi-value column for the roles.
- SailPoint finds a manager through manager correlation on an account in the same source. In HoorayHR a team has team leads, and a team lead can have rights over themselves. KoppelHet puts the team lead's User Name in the Manager Name column, and for a lead of their own team chooses a fixed other source, so nobody becomes their own manager.
- SailPoint requires a work email for every identity, but does not check whether it is a business address. The sign-in address in HoorayHR can be a private address for employees without work email. KoppelHet checks the domain and fills in an address according to the naming rule where needed.
- A contract in HoorayHR has the status future, active or inactive, and an employee has a historical seniority date besides the start date. KoppelHet delivers the start date of the current employment and the contract status as columns, so the transform does not see a returning employee as long-serving.
- With an inactive subscription or overdue payment HoorayHR rejects every request. KoppelHet then leaves the previous file in place instead of delivering an empty file, so SailPoint does not see all identities as departed.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can SailPoint not call HoorayHR itself?
HoorayHR's API key acts as an admin and also sees BSN and bank details. We prefer to keep that key at KoppelHet, which only passes on the necessary fields.
Which team becomes the department?
We agree that during the intake, for example the team with a fixed name code or the first team from a fixed list.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HoorayHR through api.hoorayhr.io with a personal API key (pk_…, admin role) as Bearer token: GET /users (filter only on id; fields id, firstName, nickName, formattedLastName, email, jobTitle, entityId, teams, companyStartDate, companyEndDate, seniorityDate), /contracts (status ACTIVE, FUTURE, INACTIVE), /teams-information (teamLeadersIds, teamMembersIds) and /entities. A 403 with INACTIVE_COMPANY or PAYMENT_OVERDUE stops the round.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source (multi-value attributes supported). Required identity attributes uid (unique across all profiles), email (not validated) and lastname; Manager Name with manager correlation; Lifecycle State through a transform on the dates and the contract status.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HoorayHR | Field in SailPoint | Notes |
|---|---|---|
id (HoorayHR) | uid (User Name) | |
email of naamgevingsregel | email (Work Email) | Never emailPrivate |
formattedLastName | lastname | |
nickName of firstName | firstname | |
Afgesproken team | Identity attribute afdeling | |
Alle teams | Meerwaardige kolom voor rollen | |
Teamleider van het afgesproken team | Manager Name | |
entityId (naam uit entities) | Identity attribute entiteit | |
companyStartDate, companyEndDate en contractstatus | Lifecycle State (via transform) |
Related
HoorayHR → Active Directory
HoorayHR to Active Directory integration: domain account from the personnel file
ASHoorayHR → Arbodienst (SIVI)
HoorayHR to occupational health service via SIVI: sickness dossiers and their phases from HoorayHR to the health service
HoorayHR → Microsoft Entra ID
HoorayHR to Entra ID integration: Microsoft 365 account on the start date from HoorayHR
HoorayHR → Google Workspace
HoorayHR to Google Workspace integration: a Google account from the start date