Darwinbox
Setup guide.

Before you start

Ask your Darwinbox integration administrator to enable the V1 Fetch Employee Data (Full Load) API for a dedicated integration identity. Confirm your tenant supports the SHA-512 authentication contract below; other API versions need a separate adapter.

Obtain the base URL, Uid, API admin email, secret key and dataset key through your approved secret-sharing process. Also request the dataset response schema and exact employment-status values. Never send credentials through email, chat or support screenshots.

Read-only permissions

Request access only to the employee export endpoint, with a dataset limited to employee ID, work email, display name and employment status. Have Darwinbox confirm that the integration identity cannot invoke employee updates, activation, termination or other write APIs. A dataset key alone is not proof of read-only authorization.

Exclude payroll, salary, personal contact details, medical data, attendance and performance records from the dataset at the source.

Connect Darwinbox

1. Confirm the restricted API identity and dataset with your Darwinbox administrator.
2. Confirm that the full-load response includes the intended active and exited population. Record any dataset filters, row limits or pagination requirements.
3. In KeySkope, open Connectors → Darwinbox and enter the vendor-provided connection details.
4. Enter the field mapping below using the exact keys in your dataset. The example is illustrative, not a vendor-default schema.
5. Run the first sync and follow the verification checks below before relying on the results.

Connection fields

• Base URL: HTTPS tenant hostname under darwinbox.in, darwinbox.com or darwinbox.io, with no path.
• Uid, API admin email, secret key and dataset key: values supplied by Darwinbox for the restricted integration identity.
• Field mapping: JSON containing the records path, four employee field paths and explicit active/inactive values. Dot-separated paths are supported.

{
  "records_path": "data.employees",
  "id": "employee_id",
  "email": "work_email",
  "name": "name",
  "status": "status",
  "active_values": ["Active"],
  "inactive_values": ["Exited"]
}

Use your actual dataset schema. Unknown statuses, duplicate IDs or missing fields fail the sync rather than silently classifying employees. A blank work email remains unmatched.

What appears in KeySkope

Employee inventory and the explicit mapped status, matched to existing identities by work email. This initial connector does not replace the identity source, update identity employment status or automatically start offboarding. It does not enumerate application privileges or sign-in activity.

The adapter calls only POST /masterapi/employee. This POST retrieves data; it does not modify employees. It signs each request using the documented V1 SHA-512 mechanism. Credentials are stored in Secrets Manager; full employee payloads are not retained.

This version reads one full-load dataset response, up to 20 MiB. It does not implement a tenant-specific pagination contract. Missing employees never cause account deletion or termination. If your export is paginated or filtered, do not treat its count as a full workforce inventory.

Verify the first sync

1. Compare the export count and population with Darwinbox using the same dataset filters.
2. Compare an active employee, exited employee and employee without a work email. Check ID and status as well as name.
3. Confirm the integration identity has no write endpoint access in Darwinbox’s permission configuration.
4. Confirm an unknown status or rejected API request produces a failed sync and preserves the previous inventory.
5. Record the credential owner and rotation process. Validate again after a dataset schema or status-value change.

Live tenant acceptance is pending. A passing fixture test does not certify your vendor configuration.

Troubleshooting

• Authentication rejected: confirm the V1 API contract, exact API admin email, Uid, dataset key and secret; ensure system time is correct.
• Mapping error: compare the sanitized response schema with the configured field paths and status values.
• Missing employees: review dataset filters and export limits with Darwinbox. Do not infer termination from absence.
• Different API version or pagination: provide a redacted vendor specification before enabling the connection.

Official references

Darwinbox Integration Team: authentication and employee export API

Vendor request contract reviewed on 2026-09-24. Response fields and permissions must be confirmed for your configured dataset.