Identity and access management
Visma Peple to Ping Identity integration: PingOne users per school and contract from Peple
With an integration between Visma Peple and Ping Identity, every employee from Peple gets a PingOne user in their company's population, with a group per organisational unit from their contracts. A substitute is only enabled in PingOne while their replacement runs, and after the end date of the last contract KoppelHet disables the user.
What the integration does
Organisations that use Visma Peple for HR and payroll and PingOne as their sign-in environment now put new colleagues and substitutes into PingOne by hand. Someone who starts working at a second school lacks the applications there, and a substitute often stays enabled after the replacement has ended.
- KoppelHet gets read access to Peple's Reporting API through Visma Connect, and PingOne gets a Worker app with the Identity Data Admin role.
- KoppelHet starts the exports of employees, contracts, organisational units and replacements and processes them as soon as Peple reports that they are ready.
- A new employee becomes a PingOne user in their company's population, enabled from the start date of their contract or replacement.
- KoppelHet puts the user in the group of every organisational unit where they have a running contract, and removes them from a group when that contract stops.
- After the last contract or replacement date KoppelHet disables the user and deletes them after the agreed period.
What to watch for with Visma Peple and Ping Identity
- Besides the Reporting API, Peple also has its own IAM API. According to Peple it is meant for accounts and rights in Visma.net itself and for sign-in, not for filling another directory. KoppelHet therefore reads the Reporting API and writes the PingOne users itself.
- A Peple export is started first and becomes ready later. The API accepts a public callback address that Peple calls when the file is ready. KoppelHet passes that address, so a change in Peple reaches PingOne without waiting rounds.
- When a subcontract is deleted in Peple, the export returns a so-called ghost record with only the employee and the IDs. KoppelHet recognises such a record and only removes the user from that unit's group in PingOne, instead of disabling them completely.
- An employee with contracts at two schools belongs to exactly one population in PingOne, but can be in several groups. KoppelHet chooses the population by the company from Peple and makes a group of every unit with a running contract, so both schools assign their applications through groups.
- PingOne's SCIM entry point does not manage groups and returns at most 200 users, without a next page. KoppelHet manages the groups per unit through PingOne's Platform API and looks up a user specifically by employee number, instead of comparing lists.
- Besides the business address, Peple also returns a private address and other addresses, while PingOne accepts one email value per user. KoppelHet does not request the scope for contact details and only sends the business address, so a password reset never goes to a private mailbox.
- Peple marks per employee whether they are a manager. KoppelHet maintains a managers group in PingOne based on that flag, so applications for approving or appraising are only open to those listed as managers in Peple.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can PingOne use Peple's IAM API?
That API manages accounts in Visma.net itself. Signing in to Peple through PingOne can be added later as an extension; this integration fills PingOne from the Reporting API.
What happens to a substitute without their own contract?
KoppelHet uses the replacement export with start and end date. How substitutes are recorded in your Peple, we check during the intake.
Does salary or BSN data go to PingOne?
No. KoppelHet does not request the scopes for contact and tax data.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Peple through the Visma.net HRM & Payroll Reporting API (HRM Analytics Public Api, Visma Connect client credentials): POST /v1/command/nl/hrm/... with optional callbackAddress, result through GET /v1/query/nl/hrm/.../{jobId}; incremental with changeTimestampAfter and changeTimestampBefore; two full refreshes per endpoint per tenant per 24 hours; ghost records for deleted (sub)contracts; dates in UTC; 503 with Retry-After during maintenance on Saturday evening. Fields include employeeid, companyid, ismanager, businessemailaddress, orgunit, subcontractid, enddate and the replacement export.
- PingOne through a Worker app with the Identity Data Admin role: users through the SCIM API (population per company, externalId, a single email value, active mapped to enabled; lists at most 200 without paging; /v2/Groups returns 501), groups and memberships through the PingOne Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Peple | Field in Ping Identity | Notes |
|---|---|---|
employeeid | externalId | Fixed key, does not change |
Naamgevingsregel | username | |
nickname of firstname | name.given | |
Achternaam en partnername volgens nameusage | name.family | |
businessemailaddress of naamgevingsregel | email | Never homeemailaddress |
companyid | population.id | |
orgunit per lopend contract | Groepslidmaatschap (Platform API) | |
ismanager | Groep leidinggevenden | |
Contract- en vervangingsdatums | enabled |
Related
Visma Peple → Active Directory
Visma Peple to Active Directory integration: accounts from Peple HRM & Payroll
ASVisma Peple → Arbodienst (SIVI)
Visma Peple to occupational health service via SIVI: sick and recovery notifications from Peple to the health service
Visma Peple → Microsoft Entra ID
Visma Peple to Entra ID integration: Microsoft accounts from Peple HRM & Payroll
Visma Peple → Exact Online
Visma Peple to Exact Online integration: cost centres ready in Exact and employee changes on a worklist