Integrations FAQ
Answers to common setup and operating questions about integrations.
For what each integration surface is and how to set it up from scratch, see the
Integrations Overview.
Setup
Do I need to configure SSO if a system-wide default is already in place?
No. If a system-wide default SSO configuration exists for a provider (Google Workspace, SAML, or Microsoft Entra ID), your tenant uses it automatically with no setup required. You can optionally add your own custom configuration alongside the system default — both will appear on the login page. To use only your custom configuration, change the provider setting on the SSO Settings page to Custom Configurations Only.
What information do I need to set up SAML SSO?
You need three things from your identity provider: the SSO target URL (or the IdP metadata URL — the platform can parse the XML and fill in the fields automatically), a certificate or certificate fingerprint, and the name identifier format (defaults to email address). You can paste raw metadata XML instead of entering fields individually. After saving, use Test Configuration to verify the handshake before enabling it for users.
How do I connect an HRIS, payroll, or accounting provider?
Go to Admin → Integrations → Browse All Integrations, pick a category, and select your provider. Six categories — HRIS, ATS, CRM, Accounting, Ticketing, and File Storage — connect through a guided OAuth handshake. All other categories use API credentials you enter directly. After connecting, choose which data types to synchronise, set a sync frequency, and click Sync Now to run the first pull.
Permissions and access
Who can manage integrations, SSO, and webhooks?
All three surfaces require the Admin or Super Admin role. Webhooks have an additional requirement: the admin must also hold the API → Manage permission. SSO configuration additionally requires the Standard billing tier or above — tenants on Lite cannot access the SSO settings page.
What roles can a service account have?
A service account can be assigned the Member, Manager, or Admin role — never Super Admin. The default is Member with read-only access and token-only authentication (no web login). Admins can upgrade a service account to read-write access and widen its role on the service account’s detail page.
Day-to-day
How often do third-party integrations sync automatically?
The available sync intervals are every 4 hours (the default), every 6 hours, every 12 hours, and daily. Setting the frequency to manual disables the automatic schedule entirely — you sync only by clicking Sync Now. Each sync is a delta pull: only records changed since the previous sync are fetched.
What is the difference between a regular sync and a force full resync?
A regular sync is a delta pull — it asks the provider for records modified since the last sync (with a five-minute overlap to account for clock differences). A Force Full Resync clears all locally imported data for the selected entity type and re-imports everything from scratch. Use it when upstream deletions are not being reflected, or when you suspect the delta watermark has drifted. Force full resync is available for HRIS and Accounting integrations.
How do I rotate a service account token without downtime?
On the service account’s token detail page, click Rotate. This generates a new token and immediately revokes the old one in a single step. The new token and secret are displayed once — copy them before navigating away. The platform also sends expiry reminders at 14 days and 3 days before a token expires, so you can rotate ahead of time.
Can a webhook subscribe to all event types at once?
Yes. When creating or editing a webhook, select the wildcard option to receive every event type. The platform currently supports 44 event types across shifts, attendance, leave, calendar, users, skills, certifications, recognition, training, eligibility, recruiting, workplace, Power Tables, and Live Boards.
When something looks wrong
My SAML SSO stopped working — what should I check first?
Check your identity provider certificate. The platform runs a health check that warns 30 days before the certificate expires, and flags it as an error once it has expired. Go to Admin → SSO Configurations, open your SAML config, and look for a certificate-expiry warning. Other common causes: the configuration was disabled, the IdP SSO URL changed, or the name identifier format no longer matches what your IdP sends.
Why was my webhook automatically deactivated?
A webhook is deactivated after five consecutive delivery failures. Each successful delivery resets the counter to zero. To re-enable it, open the webhook’s detail page and click Reactivate — this resets the failure counter and turns the webhook back on. Before reactivating, check the delivery log to see the response codes — the most common cause is the receiving system being down or rejecting payloads.
A webhook delivery failed — will it retry automatically?
Yes. Failed deliveries are retried up to five times with exponential backoff: after 1 minute, then 5 minutes, 15 minutes, 1 hour, and 4 hours. You can see the retry count and next retry time on each delivery in the webhook’s detail page. If all five retries fail, the delivery is marked as permanently failed and counts toward the consecutive-failure deactivation threshold.
SSO login failures are spiking — will I be alerted?
Yes. When five or more SSO failures occur within a one-hour window for your business, the platform automatically sends an alert to all business admins — both as an in-app notification and by email. You can review every authentication attempt at Admin → SSO Logs, filtered by configuration, outcome, or date range.
My HRIS sync ran successfully but some employee records look outdated — what happened?
A regular sync only pulls records that the provider marks as modified since the last sync. If a record was changed in a way the provider did not flag, it will not be included. Try running a Force Full Resync from the integration’s detail page — this bypasses the modification watermark and re-imports all records. If the data still looks stale after a full resync, check the provider’s own sync status on their side.
I set up JIT provisioning with the system default SSO, but new users are not being created on first login — why?
When using JIT provisioning with a system-wide default SSO configuration, a domain allowlist is required. Enter the email domains permitted for auto-provisioning on the SSO Settings page (for example, yourcompany.com). Without an allowlist, JIT will not create accounts — this restriction exists because the system-level configuration is shared across tenants, so each tenant must declare which domains belong to it.
Limits and retention
Are there limits on the number of webhooks or integrations I can create?
There is no hard cap on the number of webhooks or integrations per business. Each webhook URL must be unique within your business — you cannot point two webhooks at the same destination. For integrations, the platform supports over 220 providers across 31 categories.
How long are webhook delivery logs and SSO logs kept?
The webhook detail page shows the last 50 deliveries for that webhook, including status, response code, and response time. SSO authentication logs at Admin → SSO Logs are retained indefinitely and are paginated at 50 entries per page. Expired or revoked API tokens are cleaned up after 30 days.
Does SAML SSO work on mobile?
SAML defaults to web only. If your identity provider supports mobile browser-based authentication, you can change the channel setting to Both (web and mobile) in the SAML configuration form. Google Workspace and Microsoft Entra ID default to Both and work on web and mobile out of the box.
More help
- Integrations Overview
- Ask AI — the assistant answers integration questions from these articles.