Identity and access management
Sympa to SailPoint integration: Sympa as the authoritative HR source for SailPoint Identity Security Cloud
With an integration between Sympa and SailPoint, SailPoint gets an identity for every employee from Sympa with job title, organisational unit, legal entity, manager and the right lifecycle state, so roles and access follow hiring, transfer and departure. KoppelHet reads Sympa through the Integration API and delivers the employees as an authoritative source in SailPoint.
What the integration does
Organisations that use Sympa as their HR system and introduce SailPoint for roles and reviews look for a source that gives the current state of all employees every day.
- The Sympa administrator creates an interface for KoppelHet with only the fields for identities, without salary or bank details.
- Every hour KoppelHet reads the changed employees, with the state that applies today.
- KoppelHet builds the file for the SailPoint source and starts the aggregation straight away.
- SailPoint sets new colleagues to pre-hire and assigns the roles on the start date.
- After the end date in Sympa the identity becomes inactive and access lapses.
What to watch for with Sympa and SailPoint
- KoppelHet reads Sympa through the Integration API and gives SailPoint identity fields only, without compensation or benefits.
- An authoritative source in SailPoint should show the full current state. KoppelHet delivers the changes every hour and all employees every night, so a missed run is corrected automatically.
- Sympa organisational units form a tree under the entity. KoppelHet delivers the path above as well as the unit itself, so a role in SailPoint for a whole division can be made with one rule rather than per team.
- A transfer is in Sympa with a validity date, often weeks ahead. KoppelHet requests today's state every run, so SailPoint only assigns the new role on the effective date and no double access arises in the weeks before.
- Sympa answers read requests from a reporting database that can lag up to half an hour. KoppelHet therefore only sets an identity to inactive through an end date from Sympa, never because an employee is briefly missing from a read run.
- SailPoint rejects an identity without a work email, while that is often still empty for a new colleague in Sympa. KoppelHet fills the address following the naming rule per entity and delivers the manager as their uid, through the email address the Sympa interface passes along with the manager.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (OData v4) on a dedicated interface with X-ApiKey, with $filter on modified, $top and $skip, at= for the valid state of tables with effectivity and a target field on the manager. By default 100 requests per hour per interface; GET reads from the reporting database (delay up to 30 minutes).
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the CSV through the import-accounts API, which starts the aggregation right away. Required attributes uid, email and lastname; lifecycle states prehire, active and inactive through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in SailPoint | Notes |
|---|---|---|
Personeelsnummer | uid en employeeNumber | Key of the identity |
Roepnaam of voornaam | firstname | |
Achternaam | lastname | |
Werk-e-mail of naamgevingsregel | email | |
Functie | title | |
Organisatie-eenheid (code en pad) | department en departmentPath | |
Entiteit | company | |
Leidinggevende (e-mail via doelveld) | manager | Translated to the manager's uid |
Begin- en einddatum dienstverband | startDate en endDate |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension