Connecting your HR system

If your company keeps its people in an HR system, you do not have to type them into TruStar Connect a second time. Connect it once, import everyone, and every night after that the two stay in step: a new hire gets an invitation, somebody terminated is deactivated, and names, job titles and managers follow the HR record.

Ten systems can be connected today: BambooHR, Dayforce, UKG Pro, UKG Ready, Humi, Avanti, Employment Hero, SAP SuccessFactors, Oracle Fusion Cloud HCM and Workday. If yours is not one of them, tell us which one it is — that is how the list grows.

Connecting

1. 1
   Get credentials from your HR system

   Each system hands them out differently; the section below says where. Whatever the system, make them from an account that can see every employee, or the sync will only see some of them.

2. 2
   Open Settings → People & HR in TruStar Connect

   Under HR system, pick your system, fill in the fields it asks for, and press Connect. The fields change with the system: a subdomain and a key for BambooHR, an address, a company and a sign-in for Dayforce, and so on.

3. 3
   Test the connection

   Connect tests as it saves, and Test connection does it again any time. It reports how many people the HR system lists, which is the quickest way to know the credentials can see everyone.

Where the credentials come from, system by system

Every system hands these out in its own place. Find yours below; everything after that is the same whichever one you use.

BambooHR

1. 1
   Make an API key

   Sign in to BambooHR as someone who can see all employees, open your name at the top right, choose API Keys, and add one. Copy it — BambooHR shows it once.

2. 2
   Find your subdomain

   It is the first part of the address you sign in at: for YOURCOMPANY.bamboohr.com, enter YOURCOMPANY.

Dayforce

1. 1
   Ask for a web services user

   Your Dayforce administrator creates one for TruStar Connect with a role that can read employees, HR data and contact details, and gives you its username and password.

2. 2
   Find the address and Company ID

   The sign-in address is the one your company opens Dayforce at, such as can252.dayforcehcm.com. The Company ID is the client namespace shown on that same sign-in page.

UKG Pro

1. 1
   Add a service account

   An administrator opens System Configuration → Security → Service Account Administration and adds an account with view access to Personnel Integration.

2. 2
   Copy the key and the address

   The Customer API Key and the Web Services address are both under System Configuration → Security → Web Services.

UKG Ready

1. 1
   Generate an API key

   Company Settings → Global Setup → Company Setup → Login Config → API Keys. Regenerating a key invalidates the old one, so keep the one you paste here.

2. 2
   Create a service account

   Give it a security profile that can view Employees.

3. 3
   Find the address and company short name

   Both are on the page you sign in at, such as secure3.saashr.com.

Humi

1. 1
   Ask Humi for a token

   Humi issues one Partners API token per company. Email support@humi.ca with the subject “Requesting Humi Partners API Token” and paste the token they send back.

Avanti

1. 1
   Create an Avanti user for TruStar Connect

   Your Avanti administrator creates a user whose access covers every employee you want synced.

2. 2
   Allow the two endpoints

   Under Subfunction Access Controls, allow that user the Employees and EmployeeJobData endpoints. Until they are allowed, the API returns nothing.

3. 3
   Make API client credentials

   System Configuration → API Settings produces a client ID and secret.

4. 4
   Find the portal and database names

   The portal is the part before .myavanti.ca. The company database name is in the desktop application under Companies.

Employment Hero

1. 1
   Register an application

   An administrator opens the Developer Portal from their profile and adds an application. API access is on the Platinum and Unlimited plans.

2. 2
   Use our address as the redirect

   Enter https://connect.trustarsafety.com/api/hr/employment-hero/callback as the redirect address, then copy the Client ID and Client secret.

3. 3
   Save, then approve it

   Paste the two values here and press Connect. Then press Connect with Employment Hero, approve the application on their page, and you are brought back here connected.

SAP SuccessFactors

1. 1
   Create a technical API user

   Give it a permission role that can read Employee Central through the OData API.

2. 2
   Register TruStar Connect as an OAuth client

   Admin Center → Manage OAuth2 Client Applications → Register Client Application. Use https://connect.trustarsafety.com as the application URL, choose Generate X.509 Certificate, and bind the client to that API user.

3. 3
   Save the private key before you finish

   Download the certificate file at that moment. SuccessFactors shows the private key once and only the public key afterwards. Paste the whole downloaded file into the private key box here.

4. 4
   Collect the rest

   The registration shows the API key. The Company ID and API server are on the same screen — api17.sapsf.com for Canadian tenants.

Oracle Fusion Cloud HCM

1. 1
   Create an integration user

   In the Security Console, create a user and give it the Human Capital Management Integration Specialist role.

2. 2
   Give it a data role

   Add a data role whose person security profile covers every worker you want synced, or the sync will only see some of them.

3. 3
   Find the address

   It is the address you sign in at, ending in oraclecloud.com.

Workday

1. 1
   Create an Integration System User

   Your Workday security administrator creates one for TruStar Connect.

2. 2
   Put it in a security group

   An Integration System Security Group with Get access to the Worker Data: Public Worker Reports and Person Data: Work Contact Information domains.

3. 3
   Activate the security policy changes

   Workday does not apply domain access until pending security policy changes are activated. This step is the one most often missed.

4. 4
   Find the address and tenant

   Both are on the View API Clients report, or in the address you sign in at — the tenant is the last part of it.

The first import

Press Preview import. Nothing happens yet — you see a list of every person in the HR system and what would happen to each: invited, linked to an account they already have here, deactivated, skipped, or kept out by your seat limit. Untick anyone you do not want, then press Import now.

• Everyone imported is invited as a worker. Promote managers and admins on the Users page afterwards; the sync never changes a role.
• Somebody with no work email in the HR system is skipped and named, so you can add the email there and they will be picked up next time.
• Somebody whose email already belongs to an account here is linked, not invited twice.
• If your plan has no seats left, the import stops at the limit and tells you how many more you need. Add seats on the Billing page and the rest come in on the next run.

Every night after that

With Sync every night switched on, the same check runs overnight. New employees are invited automatically. Employees marked terminated — on or after their termination date — are deactivated, and a pending invitation is cancelled. A rehire is reactivated. Names, job titles, hire dates, phone numbers and managers are updated to match the HR record.

Sync history at the bottom of the card shows each run: what was invited, updated and deactivated, and any problem. If a night’s run fails — revoked credentials, the HR system unreachable — every owner gets an email, and so do they when new employees could not be invited for lack of seats.