Identity and access management
Loket to SailPoint integration: employees from Loket as an authoritative source in SailPoint
With an integration between Loket and SailPoint, every employee from Loket becomes an identity in SailPoint, with employer, department, job and the employment dates, so SailPoint grants access at the start and revokes it after departure. KoppelHet delivers the Loket data in a form SailPoint can read without a Loket connector of its own, without BSN or salary.
What the integration does
Organisations with their Dutch payroll in Loket and a SailPoint environment for access management often load employees into SailPoint by hand through an export from Loket. Such an export lags behind, misses employees of a second employer and sometimes contains more payroll data than SailPoint needs.
- A separate Loket user with read-only rights gives one-time consent, for all employers involved.
- KoppelHet reads employees and employments per employer and completes what SailPoint requires.
- KoppelHet reports an employee without a work email or with a duplicate username, instead of passing them on.
- KoppelHet loads the new file into the SailPoint source, after which SailPoint updates the identities.
- The lifecycle state follows the start and end date, and SailPoint revokes access once the employee has left.
What to watch for with Loket and SailPoint
- Loket has no client credentials for integrations. Access runs through consent from a Loket user, with a refresh token. A SailPoint connector that wants to sign in to Loket itself does not have that; KoppelHet manages the consent and gives SailPoint a ready-made file.
- SailPoint assigns every identity to exactly one identity profile, and with several HR sources the profile with the highest priority wins. By default that follows the order of creation. If Loket sits next to a global HR source, we set the priority deliberately, so a Dutch employee is not determined by the wrong source.
- Employments in Loket are a chain of periods, with or without gaps between them. An employee who returns after a break therefore has a new period in the same chain. KoppelHet calculates the lifecycle state across the whole chain, so a returning employee gets their existing identity back.
- A new employee can first exist in Loket as a concept, as an applicant who has not been converted yet. KoppelHet only includes converted employees in the file for SailPoint, so a withdrawn offer does not create an identity with access.
- SailPoint requires a username, work email and surname for every identity, and an empty required field becomes an identity exception. Loket often has no business address yet for a new employee. KoppelHet fills it in according to the naming rule, or reports the employee before SailPoint rejects them.
- Anyone who wants to manage access with lifecycle states in SailPoint must map the Lifecycle State attribute in the identity profile. KoppelHet delivers the start and end date from Loket in a fixed date format, so a transform in SailPoint reliably calculates the state from it.
- A payroll bureau often manages several employers in Loket. The consent applies to the employers the Loket user may see, so KoppelHet has a user created that only reads your employers, and sets the employer as an entity in SailPoint.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does payroll data end up in SailPoint?
No. The file only contains name, number, employer, department, job, work email and the employment dates.
Who manages the roles?
The SailPoint team. KoppelHet makes sure the Loket data is complete and on time in the source and reports employees SailPoint would reject.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Loket is read through the Loket REST API (oauth.loket.nl, authorization code and refresh token) under /v2/providers/employers/{employerId}/employees and the employments with startDate and endDate; pagination with pageNumber and pageSize. No BSN, pay or bank data in the output.
- The target is SailPoint Identity Security Cloud with a Delimited File source (.csv) as authoritative source. Required identity attributes uid, email and lastname; one identity profile per identity with priority; Lifecycle State mapped through a transform on the dates.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Loket | Field in SailPoint | Notes |
|---|---|---|
Werkgeverscode + employeeNumber | uid (User Name) | A duplicate uid causes an identity exception |
Zakelijk e-mailadres of naamgevingsregel | email (Work Email) | |
Voorvoegsel en achternaam | lastname | |
firstName | firstname | |
Werkgever | Identity attribute voor entiteit | |
Afdeling | Identity attribute voor afdeling | |
Functie | Identity attribute voor functie | |
startDate en endDate van het dienstverband | Lifecycle state (via transform) |
Related
ADP Workforce Now → Loket
ADP Workforce Now to Loket integration: hires, pay, hours and bonuses from ADP to the Dutch payroll run
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll
BambooHR → Loket
BambooHR to Loket integration: HR changes from BambooHR for Dutch payroll
Bullhorn → Loket
Bullhorn to Loket integration: placement as a concept employee in the right payroll administration