BiAccounts in applications
YouForce to Bitwarden integration: Bitwarden members and groups from Visma Raet, revoked after leaving
With an integration between Visma Raet YouForce and Bitwarden, a new employee from YouForce is invited to the Bitwarden organisation on their start date, in the group of their organisation unit. A temporary assignment to another team gives access to that team's collections for that period, and after the last employment the integration revokes the member, so the licence seat is freed.
What the integration does
Organisations that record HR and payroll in YouForce and keep shared passwords in Bitwarden often manage members and groups by hand. An invitation only goes out when someone raises a ticket for it, and anyone helping another team for a while keeps access to its collections long after the assignment has ended.
- Together we decide which organisation units get a Bitwarden group and whether managers get their own group.
- KoppelHet fetches the changed persons, employments, assignments and role assignments from YouForce.
- On the start date KoppelHet invites the employee at their work address, in the group of their unit. An administrator confirms the member after acceptance.
- An assignment to another team adds that team's group for the duration of the assignment; on the end date KoppelHet removes it again.
- After the last employment KoppelHet revokes the member. After the period you choose, KoppelHet removes the member from the organisation.
What to watch for with Visma Raet YouForce and Bitwarden
- Bitwarden sends the invitation to an email address, but that address is not in YouForce's basic data. It falls under a separate scope that also releases BSN, home address and private phone. KoppelHet only requests that scope if HR keeps the work address in YouForce, stores only that address and discards the rest straight away.
- A temporary assignment is a separate record within the employment in YouForce, with a start and an end. KoppelHet puts the member in the other team's Bitwarden group for that period, so that team's shared logins are within reach, and takes them out again on the end date, even if nobody remembers.
- YouForce records the manager as a role on the organisation unit, not on the employee. Where you have a collection for managers only, for example with logins for staff portals, KoppelHet fills a separate Bitwarden group from that role assignment. Anyone who loses the role loses that collection on the role's end date.
- With a temporary contract and a short break, one employment ends in YouForce and a new one starts later under the same person number. KoppelHet revokes the member after the end date and restores it on the new start date. According to Bitwarden a restored member does not need to be invited or confirmed again.
- YouForce shows planned changes of organisation unit before HR has processed them; processed changes disappear from that list again. KoppelHet remembers the planned move and only switches the Bitwarden group on the effective date, so nobody can reach the passwords of their new department weeks too early.
- A leaver disappears from YouForce's IAM data once their end date falls outside the configured number of historical days. KoppelHet keeps track of which Bitwarden members come from YouForce, so the member is still removed from the organisation after the agreed period, even when YouForce no longer returns the person.
- Revoked members take no licence seat in Bitwarden. Someone with two employments stays active while one is running; only after the end date of the last one does KoppelHet revoke, and the seat is freed straight away for a new colleague.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We already connect YouForce to Entra ID. Can Bitwarden not use SCIM then?
Yes, if the groups in Entra ID already follow teams and assignments, Bitwarden's SCIM integration from Entra ID is simpler. This integration fits when only YouForce knows the temporary assignment and the manager role.
Can KoppelHet see the passwords in the vault?
No. Bitwarden's Public API manages members, groups and collections, not vault items. After acceptance one of your administrators confirms the member in Bitwarden.
Does the integration create collections?
No. You set up collections and which group may use them yourselves. The integration makes sure the right people are in the groups; creating collections can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API (api.youforce.com/IAM, token from Visma Connect with client_credentials) with the Youforce-IAM:Get_Basic scope for Persons, Employments, Employment Planned Changes, Assignments, Organization Units and Role Assignments, filtered on latestSync and paged with take and nextLink. The work email only with Youforce-IAM:GetPrivateContactDetails.
- Bitwarden is written through the Bitwarden Public API (api.bitwarden.com or api.bitwarden.eu) with the organisation API key (client_id organization.ClientId, grant_type client_credentials, scope api.organization; token 3600 seconds). Members and groups with externalId, revoke and restore through the member endpoints, lists with continuationToken. The Public API is available to Teams and Enterprise organisations and does not manage vault items.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in Bitwarden | Notes |
|---|---|---|
Persoonsnummer | externalId van het lid | Fixed key, also on rehire |
Zakelijk e-mailadres | email | Only with the contact details scope |
Organisatie-eenheid (ID en naam) | Groep: externalId en name | |
Inzet bij een andere eenheid | Extra groep voor de duur van de inzet | |
Rol leidinggevende op de eenheid | Groep voor leidinggevenden | Only if you want that group |
Startdatum dienstverband | Moment van uitnodigen of herstellen | |
Einddatum laatste dienstverband | Lid intrekken, na een termijn verwijderen |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce