Identity and access management
Nedap ONS to Omada integration: care staff, teams and contracts as the source for Omada Identity
With an integration between Nedap ONS and Omada Identity, ONS becomes the authoritative source for identities in Omada, with team, expertise and a status that follows from the contracts in ONS. KoppelHet picks up the notifications from ONS, fetches the current data and makes it available on an address that Omada's REST collector reads, without client data.
What the integration does
Organisations that keep schedules and records in Nedap ONS and manage access with Omada Identity often have Omada read payroll, while the teams and expertise that access depends on are recorded in ONS.
- The care organisation requests the integration through the Ons API Dashboard; Nedap reviews the request and issues a certificate.
- KoppelHet fetches all employees with contracts, teams and expertise once and then keeps them current with the notifications from ONS.
- One record per employee is ready on a secured KoppelHet address, with status, team, expertise and employee type.
- Omada's REST collector reads that address as the authoritative source; Omada assigns roles on team and expertise.
- After the last contract the status becomes inactive and Omada revokes access.
What to watch for with Nedap ONS and Omada
- A notification from ONS only holds the kind of record, the event and an id, not the employee itself. Omada's REST collector cannot receive such notifications. KoppelHet catches them, fetches the current record from ONS for each one and so keeps the record that Omada reads up to date.
- ONS does not retry a failed notification itself and keeps it for 24 hours. KoppelHet requests failed notifications again within that period, and also runs a full comparison, so a one-day outage does not leave an identity in Omada behind.
- Notifications from ONS do not always arrive in order; a change can arrive before the creation. Because KoppelHet fetches the current record on every notification instead of applying the notification itself, the order makes no difference to Omada.
- Omada requires a status for every identity, but ONS has no status field for employees. KoppelHet derives the status from the contracts - active while there is a running contract - and asks you to switch off the status mapping in Omada if security also blocks identities itself, as Omada itself recommends.
- An employee in ONS can be in several teams at once, each with its own dates. KoppelHet only supplies the teams valid today, so a role in Omada lapses on the day a relief period ends and not only when the contract ends.
- Flex workers and freelancers are marked as external in ONS. That marking goes to Omada, so they can get their own identity type and a shorter recertification than own staff.
- The Nedap certificate gives access to a system with client records. It therefore stays on the KoppelHet platform and not in Omada's connection settings; Omada only gets the identity data, with its own OAuth key.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Nedap have to approve the integration?
Yes. The care organisation requests it through the Ons API Dashboard, and Nedap reviews the request before a certificate is issued.
Does client data go to Omada?
No. The integration only reads employees, contracts and their assignments.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS through the Ons API with webhooks for employee, contract, team_assignment and expertise_profile (metadata only, HMAC-SHA512 in X-Signature-SHA512, 200 within 3 seconds, no automatic retry, kept for 24 hours, requested again with PUT /webhooks/redeliver) and an initial full load through /v0/xstream/api/employees/data. Access with a client certificate signed by Nedap.
- Omada reads through the REST collector (Content: Identity data) with OAuth2 Client Credentials; required fields Business key, Unique ID, Name and Status; paging through Link header or Paging URL; Thresholds for new, modified and deleted objects (default 0, off).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Omada | Notes |
|---|---|---|
identificationNo | Business key en Unique ID | Required in Omada |
Naam volgens naamgebruik | Name | Required in Omada |
Begin- en einddatum van de contracten | Status | Required in Omada; derived by KoppelHet |
TeamAssignment (team, begin, einde) | Team | Only assignments valid today |
ExpertiseProfileAssignment | Deskundigheid | |
type (0 Regular, 1 External) | Soort identiteit | |
birthName en birthNamePrefix | Basis voor de accountnaam | Stays the same on marriage |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff