Sign inBook a Demo

How do I connect our HR system?

For admins: connect HaileyHR, Workday, SAP SuccessFactors or Velory so your people and teams come from your HR system instead of manual entry, and see how your own edits sit alongside a sync.

Only a company admin can connect an HR system. A manager reads results and nothing else.

A connected HR system becomes the source for your roster. Each sync reads everyone your HR system holds. It adds the people Flow does not have yet. It updates the ones it manages. It marks anyone who left as inactive. HaileyHR, Workday, SAP SuccessFactors and Velory are supported today. Flow only reads from them. It never writes anything back.

In this guide:

  • Step 1 — Get a HaileyHR access token
  • Step 1b — Or set up Workday
  • Step 1c — Or get a Velory API token
  • Step 1d — Or set up SAP SuccessFactors
  • Step 2 — Connect
  • Step 3 — Preview the first sync
  • Step 4 — Proceed or cancel
  • What a sync brings in
  • Your edits and the sync
  • Disconnecting

Where to connect it

Bring in your people is the first step of the Get Flow ready checklist on Home, and Connect HR system on it opens People. Connecting always happens on People, with the preview described below. Connect HR system is the filled button above the table on People. You can also open People from the sidebar at any time.

Have no key yet? Add people by hand or from a file under Add people instead, or point people at the sign-in page and let them come to it. Nothing blocks you.

Your HR system is not listed

Flow connects directly to HaileyHR, Workday, SAP SuccessFactors and Velory. For anything else, export your people to a CSV file and import that instead. It builds the same roster. See how do I import people from a file.

Step 1 — Get a HaileyHR access token

On Workday, skip to Step 1b. On Velory, skip to Step 1c. On SAP SuccessFactors, skip to Step 1d.

  1. Sign in to HaileyHR as someone who can create a personal access token.
  2. Create a token that can read employees and company data.
  3. Copy it. You paste it into Flow once.

Step 1b — Or set up Workday

Your Workday administrator does this part. You need three things back from them, plus two names.

  1. Ask them to register an API client for integrations in Workday, with the Staffing, Organizations and Roles and Contact Information scopes. That gives you a client ID and a client secret.
  2. Ask them for a refresh token for the integration user that client runs as. That is the third value.
  3. Ask them to give that integration user’s security group View and Get access to these domains: Worker Data: Public Worker Reports for the people, Worker Data: Business Title on Worker Profile for each person’s role, View: Supervisory Organization and Reports: Organization for who manages each team, and Person Data: Work Email and Person Data: Home Email for people whose work email is not public. Many tenants have no separate Home Email domain, and home email addresses sit inside Person Data: Home Contact Information. Grant that one: in large companies it is common for a company address to be filed as a home email, and without it those people are skipped. It also covers home phone numbers and postal addresses, but Flow reads only email addresses, and keeps a home one only if it is on your company’s domain. Without the email domains, those people are skipped and everyone else still comes in. Then they run Activate Pending Security Policy Changes. Flow only reads and never writes to Workday.
  4. Ask them for your tenant name. It is the short name in your Workday URLs, such as acme_dpt1.
  5. Ask them for your host. The View API Clients task shows a Workday REST API Endpoint such as https://wd3-services1.myworkday.com/ccx/api/v1/acme. The host is the part up to and including .com: https://wd3-services1.myworkday.com. Flow accepts Workday addresses only.

Keep the three secrets together. Each one goes in its own field in the next step.

Step 1c — Or get a Velory API token

  1. Sign in to Velory as a company admin who sees the whole company. A token works with the access of the person who made it. If an admin can see only some departments or offices, their token reads only those people, and Flow can’t tell that anyone is missing.
  2. Go to company settings, then API Tokens, and create a token. When Velory asks what the token is for, pick API access. A token for AI usage telemetry won’t work.
  3. Set Scope to Company. A wider scope reads whichever company you have open in Velory, so Flow refuses it as soon as it reads a different company from the one you connected.
  4. Pick the longest expiry Velory offers. Company tokens last up to a year.
  5. Copy it. You paste it into Flow once.

The same token lets Tools import your software list from Velory. See how do I keep a register of our tools.

The first check after you connect records which Velory company the token reads. Any token you paste later has to read that same company, or Flow refuses it. To connect a different company, disconnect first, then connect again.

Velory doesn’t let Flow see when a token expires, so Flow can’t warn you before it does. When the token stops working, the next sync fails and the panel says Velory refused the token. Create a new one and paste it in.

Step 1d — Or set up SAP SuccessFactors

Your SuccessFactors administrator does this part. You need five values back from them: the API server, the company ID, a service user ID, an API key and a private key.

  1. Ask them to create a user for Flow to sign in as, such as flow_sync. Use a separate user, not a person’s own account. Its user ID is the first value.
  2. Ask them to give that user a permission role that can see every user in the company. The role’s target population has to cover everyone. It needs view access to first name, last name, email, title, department, hire date, status and manager. Flow only reads, so the role needs no import permission.
  3. Ask them to make an RSA key pair and a certificate for it. We recommend they make these on their own computer with the tools they normally use, so the private key goes only from them to Flow. SuccessFactors can also generate the certificate and let them download the private key.
  4. Ask them to register Flow in SuccessFactors. They open Manage OAuth2 Client Applications and choose Register Client Application. The name can be anything. The application URL is only a label, so https://flow.velory.com is fine. They tick Bind to Users, enter the user ID from the first step, paste the certificate into X.509 Certificate and register. When they view the registration, it shows the API key.
  5. Ask them for your company ID. It is the one you type when you sign in to SuccessFactors.
  6. Ask them for your API server, such as https://api55.sapsf.eu. It depends on which SAP data centre your company is in, and SAP publishes the full list of SuccessFactors API servers. Flow accepts SAP’s own addresses only.

The private key must match the certificate they registered, and it can’t have a passphrase. Paste all of it, from the -----BEGIN line to the -----END line.

Flow’s requests don’t come from a fixed set of IP addresses, so you can’t add Flow to an IP allow list. If your SuccessFactors accepts API sign-ins only from listed IP addresses, the connection check is refused. Contact us before you set it up.

Step 2 — Connect

  1. Open People and press Connect HR system above the table. A side panel opens.
  2. Pick your HR system under HR system. The panel then shows only that system’s fields.
  3. Fill in the fields for your system.
    • HaileyHR: paste the token into Access token.
    • Velory: paste the API access token into Access token.
    • Workday: fill in Tenant and Host with the two names from Step 1b, then Client ID, Client secret and Refresh token with the three secrets. A refresh token that contains a colon is fine.
    • SAP SuccessFactors: fill in API server and Company ID, then Service user ID, API key and Private key with the values from Step 1d.
    • CSV file: there is nothing to fill in. See how do I import people from a file.
  4. Press Connect. Flow stores what you pasted and checks it against your HR system in the same step.

Secrets are encrypted before they are stored, and never shown again, to you or to anyone else. The Workday tenant and host, and the SuccessFactors API server and company ID, are not secrets. They stay visible, so you can correct one without retyping the other.

If the host is not a Workday address, or the API server is not a SuccessFactors one, nothing is saved and the panel says so. Check that you pasted the whole address, starting with https://, and nothing after the domain.

Replacing Workday secrets takes all three at once, and so does replacing the SuccessFactors service user ID, API key and private key. Fill in one or two and nothing is saved.

Flow reads a SuccessFactors private key before it saves it. If the key has a passphrase, isn’t an RSA key, is a certificate instead, or can’t be read, nothing is saved and the panel says which.

A connection that works shows Connected. The panel then reads which HR system you are on, when the connection was last checked, and what the last sync did.

If the check is refused, the panel reads “The connection was refused.” What you pasted stays stored, so you do not have to paste it again to try something else:

  • Make sure that the token is current.
  • For Velory, make sure that it is an API access token with Scope set to Company, made by a company admin who sees the whole company. If the token can’t see employees, the panel says so.
  • Make sure that it came from the account you meant to connect.
  • For Workday, make sure that the tenant and the host belong to the same Workday tenant the credentials came from, and that the read domains from step 3 are granted.
  • For SuccessFactors, the panel says what was refused: a private key that doesn’t match the registered certificate, an API key or company ID SuccessFactors doesn’t know, or a role that can’t see your people.
  • To try different credentials, open Replace token, fill the fields in again and press Connect.

Step 3 — Preview the first sync

Press Preview sync. It is the main button on the panel once you are connected. Flow reads your HR system and shows you what a sync will do, without any change yet:

  • The totals: how many people the sync will add, update, mark inactive, and skip.
  • Teams: one row per team, with what happens to it. New means the sync creates it. Already here means your people join a team you have. Renamed from means the department was renamed in your HR system, so the sync renames the team it made for it. Each row says how many people end up in that team.
  • The four lists below sit in tabs, each with its own count.
  • To add: each new person, their role, and the team they will join.
  • To update: each person and each field that changes, from what to what. This includes a move to a new email address. If someone is on your list twice, once under each address, the preview says so. The entry under the old address is removed. What you typed on it fills anything left empty on the one that stays. Anything that entry already has stays as it is. Under Left as you set it you will see what your HR system holds for a field you edited by hand. The sync will not write that field.
  • Who manages people: anyone who starts or stops managing people because of this sync. Flow reads this from the reporting lines across your whole list, so a person can appear here when nothing on their own record changes. When someone moves to a new manager, their old one may be left managing nobody.
  • To mark inactive: everyone who is no longer in the export.
  • Not imported: each record Flow cannot use, and why. A person left out because of Who to import is here too.

Every row on those four tabs also carries the state your HR system holds that person in, in its own words. Someone marked inactive is not in the export at all, so there is nothing to show for them.

The preview opens as its own page, under People in the breadcrumb. If the sync will refuse something, it says so under Read this first. Examples are an empty export or too many people missing at once. Those people are left out of the list.

Step 4 — Proceed or cancel

Press Proceed with import to run it. The sync runs while you wait and reports what it did. The same figures stay on the panel under Last sync, so you can see later what the last run changed. It also says how many people started or stopped managing someone, without naming them.

Press Cancel to walk away. Nothing is written. Nothing about the preview is kept. Cancel returns you to People with the HR system panel open.

When you proceed, Flow reads your HR system again. Anything that changed while you read the preview is picked up. The safeguards below still apply.

Preview it again whenever you want the roster refreshed. A second press on either button does no harm. Only one sync runs at a time. A second run reads your HR system again and writes the same result.

What a sync brings in

For each person your HR system holds:

  • Their name and their work email address. In HaileyHR, if they have no work address, the private one is used. In Workday, Flow reads the worker’s public work email. When there isn’t one, it uses their other work email, or a home email on your company’s domain, such as one filed as Home by mistake. A personal address like Gmail is never imported, and the preview names it so you can see why that person was skipped. In SuccessFactors, Flow reads the email address on the person’s user record. In Velory, only the work address is read. Anyone with no address Flow can use is counted under “skipped” and left out.
  • Their job title, which becomes their role in Flow.
  • Their department, which becomes their team. In Workday this is their supervisory organisation. In SuccessFactors it is the department on their user record. A department that matches a team you already have joins that team instead of creating a second one. When you rename a department in your HR system, the sync renames the team it made for it.
  • Who they report to, when their manager is also in the same sync. When the manager is not included, the reporting line is left empty and the sync says how many people that affected. Whether someone counts as a manager follows from these lines: if anyone on your list reports to them, they manage people. There is nothing to set by hand. In Workday, someone’s manager is the manager of their supervisory organisation. If they are one of that organisation’s managers themselves, Flow looks one level up, and keeps going until it finds someone else.
  • Whether they are in service, joining, leaving, or gone. For Workday, Flow treats everyone Workday lists as in service, because Workday does not say who is joining or leaving. Someone it stops listing counts as gone. A state Flow cannot read counts as gone, so nobody stays on your roster by accident.

On the preview page, under Who to import, you decide which states a new person may join under. The boxes are your HR system’s own states, in its own words, with a count beside each one for how many people are in that state right now. In HaileyHR that is In service, Being hired, Will join, Leaving and Has left. In Velory it is Active, Onboarding, Offboarding and Inactive. In SuccessFactors it is Active and Inactive, plus four external states for people who are not your employees: reviewers SuccessFactors holds for 360 reviews, and outside users of Learning or Onboarding. They come in as inactive rows if you tick them. If someone already on your list shows up in SuccessFactors in one of those four states, the sync marks them inactive. Workday does not say who is about to join or leave, so its preview has no boxes: everyone it lists is imported as in service.

Only In service (Active in Velory and SuccessFactors) starts ticked, and you can untick it. Tick Has left (Inactive in Velory and SuccessFactors) and leavers come in as inactive rows, which stay off People and every count. Untick everything and no new person is added at all. The preview then shows nothing under To add. The choice is saved with the connection, and every later sync uses it. Someone already on your list keeps their record whatever you tick.

Nobody is ever deleted. A person your HR system no longer sends, or says has left, is marked inactive with an end date, so your past results still make sense.

People marked inactive drop off People. They get no invites or reminders, and they are left out of team sizes and job title counts. They no longer manage anyone in Flow, and they can no longer sign in to your company. Someone serving their notice stays on your list until your HR system says they have left.

A sync will not mark a large group inactive on its own. If the export comes back empty, the sync leaves everyone as they are and says so under Connection. If a big share of your people are suddenly missing from it, the sync does the same. A broken token or a changed filter in the HR system looks exactly like a mass departure. Flow stops rather than get that wrong. If the change is real, contact us and we will put it through.

Your edits and the sync

Anything you edit by hand under People stays yours. If you correct someone’s role, the sync will not write over it again, even when their HR record says something else. The same holds for a team you moved someone into by hand, and for a name you typed.

This works field by field. When you correct one person’s role, the sync can still keep their team, their reporting line, and their employment state up to date.

A field that is still empty stays the sync’s to write. This also covers people you added by hand before you connected anything. The first sync matches those people by email address and fills their blanks.

Disconnecting

Open People, press Connect HR system above the table, then Disconnect at the bottom of the panel. You are asked to confirm. If a sync is running, the panel says so and nothing is disconnected; wait for it to finish and press it again. The stored token is deleted with the connection, and so is the record of which ID your HR system used for each person. Your people and teams stay exactly as they are. Updates to them stop. To reconnect later you will need to paste a token again, and the first sync after that matches everyone by email address and picks the IDs up again.

If someone asked us to delete their data, a sync will not bring them back. We keep their email address on a do-not-import list for your company, and nothing else about them. A later sync skips their record instead of adding them again. You will see them counted under “skipped”. See what happens to your data.

Good to know

  • Flow reads from Workday, SAP SuccessFactors and Velory. It never writes to any of them. Nothing about a result, a level or an answer goes back into them.
  • Only a company admin can connect an HR system or run a sync. A manager cannot open People at all. They get Home and nothing else.
  • Employment type (employee, contractor, or partner) is not read from your HR system. It stays a judgment you make under People, because it decides who your AI literacy coverage counts. See setting up your company.
  • A sync does not invite anyone or send any email. It only configures who is on the roster. An assessment send is still a separate step. See sending an assessment.
  • No person from your HR system is sent to an AI model. Names, email addresses, reporting lines and HR system ids stay between your HR system and Flow’s own database. See what happens to your data.