HR system

Where: Menu → Manage → Integrations → HR system

People, departments, locations, job titles and line managers can come from your HR system: Personio, a self-hosted Frappe HRMS, OrangeHRM 5, Odoo 18/19 or Horilla, or a CSV file your HR system exports. The first run is a preview that changes nothing; after you confirm it, the system is read daily at the hour you choose. People who left are locked on their last day, never deleted.

How to

1. Choose the system and enter its credentials (and, for self-hosted systems, the https address of your instance; for Odoo the database).
2. Personio: API credentials under Settings → Integrations → API credentials.
3. Factorial: an API key from Settings → API Keys. HiBob: a service user (ID and token) with read access to the employees’ basic, work and lifecycle fields. Both send webhooks: set them up with the address shown under “Webhook”.
4. Workday: an Integration System User with read access to worker data, and an advanced custom report of all workers (terminated ones included) with the column aliases Employee_ID, Email, First_Name, Last_Name, Business_Title, Department, Location, Hire_Date, Termination_Date, Active and Manager_ID, enabled as a web service and shared with that user. Enter the report’s JSON address and the user’s name and password.
5. SAP SuccessFactors: a technical user with read permissions on users and job information, and an OAuth client under Admin Center → Manage OAuth2 Client Applications with your X.509 certificate. Enter the API server of your data centre, the company ID, the technical user, the client’s API key and the private key. The platform signs in with OAuth (SAML bearer); Basic authentication, which SAP is retiring, is not used.
6. Frappe HRMS: a user with read rights on Employee and Department; Settings → API Access → Generate Keys gives the API key and secret.
7. OrangeHRM 5: under Admin → Configuration → Register OAuth Client, register a client with the redirect address shown after saving. Then click “Allow access in OrangeHRM” and agree there once.
8. Odoo: an API key of a user with read access to Employees (Preferences → Account Security → New API Key), with the user’s login and the database.
9. Horilla: user name and password of an account that may see all employees.
10. CSV file: an export (Workday report, DATEV, SAP, Excel) fetched over HTTPS or SFTP. The first row names the columns (download the sample file); choose other columns per field if yours differ. Over SFTP, compare the host key shown with your server’s and trust it once; if it ever changes, runs stop until you confirm the new one.
11. DATEV Lohn und Gehalt or LODAS: export the personnel master data in the Daten-Analyse-System (for example the evaluation “Stammdatenexport”, with the field “Email Mitarbeiter” added) as CSV with a header row, and put it where the platform fetches it. German field names such as Personalnummer, Vorname, Familienname or Name, E-Mail, Tätigkeit, Abteilung, Betriebsstätte, Eintrittsdatum and Austrittsdatum are recognised. Choose Windows-1252 and the semicolon; the sample file shows the names. If DATEV runs only inside your network or at your tax adviser, the local connector reads the same file with the column names “DATEV”.
12. Other HR API: describe a JSON API that lists people (address, sign-in, pages, and the path of the id and each field, such as contact.email). “Load fields” lists the paths of the first person.
13. Local connector: for sources behind your firewall (local DATEV, Active Directory or LDAP, an HR database). Create the connector here, copy its token, start it inside your network (see the connector documentation), then save and check. Knowledge sources need not be on.
14. Click “Preview”, check the list, then “Confirm and run”.

Fields and buttons

• Fields the HR system leads: These can no longer be changed here by hand, by SCIM or by import.
• Own source fields: Personio: custom attributes by id. Other systems: a field by its technical name, for example a staff number.
• Teams from department or location: One team per department or location, members kept in step.
• Webhooks (Personio, Frappe HRMS): Changes start a run straight away. In Frappe, create a webhook for Employee with the address shown and security enabled, and enter its secret.

Tip

• Self-hosted systems must be reachable from the internet over https. Instances only on your internal network will connect through the local connector.
• If your directory (Microsoft Entra ID or another SCIM source) is already fed from Workday or SuccessFactors, you can keep people coming through Entra or SCIM instead of connecting the HR system here.
• Horilla lists active employees only: someone archived there is locked after two runs without them.
• To try a system first, the platform’s repository has setup notes under deploy/hr-sandboxes.