Identity and access management
Officient to SailPoint integration: Exact Officient as the authoritative source in SailPoint
With an integration between Officient and SailPoint, SailPoint gets an identity for every person in Exact Officient with team, role, manager and the employment dates, so roles move along with a team change and access lapses after the last day. KoppelHet turns Officient's webhooks into deliveries to a Delimited File source in SailPoint.
What the integration does
Organisations that use Exact Officient for HR and payroll and SailPoint for access management often run access reviews on a list HR exports now and then.
- In Officient we create a client app for KoppelHet with read rights on personal information only, and register the webhooks.
- The SailPoint team creates a Delimited File source as authoritative source with lifecycle states.
- On a webhook KoppelHet fetches the person's details and updates its own full state.
- KoppelHet sends the updated file to SailPoint, which aggregates straight away.
- After the last day of the employment the transform sets the identity to inactive.
What to watch for with Officient and SailPoint
- KoppelHet delivers to a Delimited File source, so the SailPoint team manages the source itself without connector code for Officient.
- An Officient webhook only contains the person's ID, while a Delimited File source expects the whole file per aggregation. On every notification KoppelHet fetches the details, updates its own full state and then delivers the whole file, so a team change is in SailPoint shortly afterwards.
- Officient allows thirty calls per five seconds. A reorganisation brings dozens of webhooks at once. KoppelHet bundles notifications that arrive close together into one delivery, so SailPoint does not aggregate for each person separately and Officient does not hit its limit.
- Besides the manager Officient has an extra manager. SailPoint links one manager per identity through manager correlation. KoppelHet puts the regular manager in the column for manager correlation and the extra manager in a separate column, which you can use as a second approver, for example.
- On person_reactivated KoppelHet keeps the Officient ID as uid. SailPoint then sets the same identity back to active, instead of a new identity next to the old one.
- If HR deletes a person in Officient, person_deleted arrives. KoppelHet keeps that person in the file with an end date until after the agreed period, so SailPoint makes the identity inactive and the revocation of access stays visible.
- Officient only fills the payroll provider number for some of the Dutch integrations. KoppelHet therefore uses the Officient ID as uid, which always exists for Belgian and Dutch employees.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Does salary data go to SailPoint?
No. The client app only reads personal information, and the file only contains identity fields.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Officient REST API (api.officient.io/1.0) with a bearer token from a dedicated client app (scope personal.info:read): GET /people/{id}/detail with email, team, current_role, current_reports_to (person_id, extra_manager_id) and employment (first_employment_date, last_employment_date). Webhooks person_added, person_updated, person_deleted, person_reactivated, person_team_updated, person_manager_updated and person_role_updated; at most 30 calls per 5 seconds.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source; delivery through the import-accounts API, which starts the aggregation. Required attributes uid, email and lastname; Manager Name through manager correlation; Lifecycle State through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Officient | Field in SailPoint | Notes |
|---|---|---|
id (Officient) | uid | Key of the identity |
Voornaam | firstname | |
Achternaam | lastname | |
email of naamgevingsregel | email | |
team | department | |
current_role | title | |
current_reports_to.person_id | manager | |
current_reports_to.extra_manager_id | extraManager | |
employment.first_employment_date en last_employment_date | startDate en endDate |
Related
Officient → Active Directory
Officient to Active Directory integration: AD accounts from Exact Officient
Officient → ADP iHCM
Officient to ADP iHCM integration: Dutch wages and leavers from Exact Officient to ADP iHCM
Officient → AFAS Profit
Officient to AFAS integration: Dutch employees from Exact Officient in AFAS Profit Payroll
ASOfficient → Arbodienst (SIVI)
Officient to the occupational health service via SIVI: absence periods from Exact Officient as absence reports