FixControl
Visma Raet Youforce integration

Youforce data read-only, answers only after approval

An employee of your organization asks about their leave balance or a line on their payslip. FixControl reads the named fields it needs from the Youforce endpoints you expose, filtered on that one person, and writes nothing back. The answer about their own situation is a draft until someone on your team approves it.

Book a demoSee the HR permission model
Read-only — nothing is written backNamed fields, not a personnel fileCredentials per organization
What it does

What the Visma Raet Youforce connection covers

Read-only by construction

The connection has read methods and nothing else. No leave request, no profile change, no record created in Youforce — FixControl reads what an answer needs and leaves your HR system exactly as it was.

Endpoints you expose, on templates you control

FixControl does not prescribe which Youforce domain API you run. You give it three endpoint templates — employee, leave, payroll — with a placeholder for the person, and it reads the prescribed field ids back from whatever you expose there.

Templates pinned to your own host

A template must stay on the same host as the domain-API base URL and travel over https. A foreign host, a protocol-relative URL or an unresolved placeholder is refused before a single request is made — a typo in a template cannot ship your bearer token somewhere else.

Credentials per organization

An OAuth2 client id and secret — the secret encrypted at rest — plus the token endpoint and the domain-API base URL. A half-filled entry is ignored rather than merged with platform defaults, so one environment's secret can never be paired with another environment's host.

A connection check on the credential

A periodic check forces a fresh token exchange, so a cached token cannot keep a badge green. A revoked client or a rotated secret surfaces as a failing check, an audit event and an administrator notification. The check covers the credential — it does not walk your endpoint templates.

The data is read; the answer still needs a person

What comes back from Youforce does not become an outgoing answer on its own. A question about someone's own situation becomes a draft or a review case, bound to a named reviewer, and a second person approves before it is delivered.

Capabilities & health

What the Youforce connection can and cannot do

The connection has one health capability on purpose: the connection itself. A single missing employee record is a data condition, not a broken integration, so it routes that one question to a person instead of colouring the connection red for everyone.

Remaining leave hours
Configuration-dependent

Read from the leave endpoint you expose, with the as-of date that belongs to the value. Available where that template resolves and returns the prescribed field ids.

Payroll explanation code
Configuration-dependent

An explanation code with an as-of date — never an amount, never a payslip document. Reading it also requires the separate payroll permission on the reader's project role.

Same-host, https-only templates
Supported

Not configurable away. A template on a foreign host, a protocol-relative URL or a placeholder that stayed unresolved is refused before the request leaves FixControl.

Connection check (credential)
Supported

A forced token refresh proves the client id and secret still work. It deliberately touches no data endpoint, so a green check confirms the credential — not that every endpoint template resolves.

Writing anything back to Youforce
Not available — by design

Not part of the connection, at any level. There is no create, update or delete path — no leave request, no absence registration, no profile change.

Salary amounts & payslip documents
Not available — by design

Out of scope on purpose. The payroll endpoint returns an explanation code and its as-of date; amounts and documents are not read, so they cannot appear in an answer or in an audit record.

When Youforce cannot answer

A missing value never becomes a made-up one

Honest failure, with a reason on record
A missing record, a value that cannot be parsed, an unexpected response shape and an unreachable endpoint all lead to the same place: the question is handed to a person, and the reason is recorded. No number is invented, and a leave balance is never quietly defaulted to zero. Error messages carry a stable code and at most an HTTP status — never a token, a URL, a response body or an e-mail address. The model never sees any of this: it receives the question text to propose a classification, and personnel data, retrieved documents and answer bodies are not sent to a model at all.
FAQ

Questions about the Visma Raet Youforce integration

Does FixControl write anything back to Youforce?+
No. The connection is read-only by construction: it has read methods and no create, update or delete path. An employee cannot request leave or change a record through FixControl, and no answer flow can either.
Which fields does FixControl read?+
The ones your three endpoints return under prescribed field ids: employee id, e-mail, employment percentage, employment type and collective agreement; remaining leave hours with an as-of date; and a payroll explanation code with an as-of date. Never a salary amount, never a payslip document.
Which Youforce API do I have to expose?+
That is your choice — the connection is deliberately not tied to one domain API. You supply three URL templates relative to your domain-API base URL, each with a placeholder for the person. They have to stay on that same host and use https; anything else is refused before a request is made.
What does the connection check actually prove?+
That the client id and secret still exchange for a token, because the check forces a refresh instead of trusting a cached one. It touches no data endpoint on purpose, so it does not prove that every endpoint template resolves — a read failure on one endpoint still routes that question to a person, with its reason recorded.
What happens when we rotate the client secret?+
The new secret is picked up on the next connection build. Because the token cache is keyed by the token endpoint and the client id, rotating only the secret leaves an already-issued access token valid for the rest of its lifetime — rotate the client id alongside it when you need an immediate cut-off.
Does an answer about my leave balance go out automatically?+
No. Anything touching an employee's own situation becomes a draft or a review case. The approval is bound to that exact answer text, the person who requested it cannot decide it, it expires after 72 hours on the server, and delivery consumes it so a double click cannot send twice.
Keep exploring
HR questions with the right permissions

The permission model, assignment and approval around the answer.

AFAS Profit

The same read-only contract on AFAS GetConnector views.

AI approval ledger

Who approved what, from which channel, on which grounds.

See what a Youforce-backed answer has to pass

Book a demo and follow one leave question from the Youforce read through assignment, approval and delivery.

Book a demoTalk to us