Skip to content

Integrating SailPoint with Employment Hero

Employment Hero is an employment operating system that combines HR, payroll, and benefits. Organisations manage their people records - employees and independent contractors, under an Employment Hero organisation, and group them into teams. This document covers how to configure a new direct connection between SailPoint and Employment Hero for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Employment Hero connector supports the following:

Account Management

  • Aggregate Employees

Entitlement Management

  • Aggregate Entitlement (Groups - Employment Hero teams)

Note

This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Both employees and independent contractors are aggregated as accounts. The independentContractor attribute distinguishes them.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Employment Hero API access requires a Platinum, eOS Plus, or Unlimited plan, or a trial or partner sandbox. Confirm the plan before you start. Complete these steps in Employment Hero before you add the source in SailPoint.

Register an Application

  1. Sign in to the Employment Hero Developer Portal.
  2. Register an application for SailPoint.
  3. Set a redirect URI you can access, for example your API client's callback URL.
  4. Copy the Client ID and Client Secret.

On the Scope field in the Developer Portal, select only the read scopes this connector needs:

Scope Why SailPoint Needs It
urn:mainapp:organisations:read Test connection and Organisation ID
urn:mainapp:employees:read Account aggregation (employees and contractors)
Team / group read (listed in the portal as the teams scope, typically urn:mainapp:teams:read or similar) Entitlement aggregation (Groups)

Get a Refresh Token

Employment Hero does not offer client credentials or a static API key. An administrator must complete an Authorization Code flow with PKCE (S256) once, outside SailPoint, using an API client such as Postman.

  1. Authorize at the Employment Hero OAuth authorize endpoint and sign in as an Employment Hero administrator.
  2. Exchange the returned authorization code at the Employment Hero OAuth token endpoint.
  3. Copy the refresh token from the response.

The refresh token is what SailPoint stores. PKCE is only part of this one-time handshake; the connector does not use it afterwards.

Find Your Organisation ID

Call GET /api/v1/organisations on the Employment Hero HR API with the access token from the refresh token step. Copy the id (a UUID) of the organisation you want to aggregate.

Record These Values for SailPoint

  • Base URL
  • Token URL
  • Client ID
  • Client Secret
  • Refresh Token
  • Organisation ID

Caution

Keep the client secret and refresh token on the SailPoint source only. Do not store them in a browser or a shared document. Anyone with these values can read the people data in that Employment Hero organisation.

Required Permissions

An Employment Hero administrator with access to the organisation you want to aggregate must complete the authorize step. The refresh token inherits that administrator's access. SailPoint exchanges the refresh token for a short-lived access token, then reads organisation, employee, and team data. Access tokens expire after 15 minutes, and the connector requests a new one automatically. No manual token refresh is needed. If the administrator's access is removed, or the refresh token is revoked in Employment Hero, aggregation fails and a new refresh token must be supplied. For more information about Employment Hero, refer to the following:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.