Platform access level: Org Admins

This guide is the technical reference for connecting Arist to SAP SuccessFactors. It covers the bidirectional OData v4 connection end to end: how your employee data flows into Arist to create and target learners, and how the courses and completions Arist generates flow back onto each employee's SuccessFactors profile. It is written for the IT and SuccessFactors administrators who provision and secure the integration.

1. One connection, data flowing both ways

Arist connects directly to your SuccessFactors tenant over its OData v4 web services, authenticated with OAuth 2.0. Employee Central is your HRIS system of record for employees and metadata, and Learning holds your course catalog and learning history. Two things move across the one connection.

Direction	What moves	Why
Arist reads	User and HRIS metadata	Creates learners and triggers automations
Arist writes	Course records	Gives completions something to tie back to
Arist writes	Completions	Recorded on the learner's history as external learning events

The result is a full circle. Your employee data creates and targets learners in Arist, and the learning Arist generates, courses first and then completions, syncs back to the same employee in SuccessFactors so every record lands on their profile and can drive downstream automations.

Note: Arist can also connect to SuccessFactors through an ad hoc CSV exchange or a Workato-managed connector. This guide covers the direct OData v4 integration, which is bidirectional and needs no middleware.

2. Before you begin

Confirm the seven items below in the weeks before your setup session, not on the day itself. Each is a credential, an access grant, or a mapping decision that can take time to track down, and having all seven ready is the difference between a single working session and a stalled one.

Item	What to confirm
OAuth client created	Generate the Client ID, Client Secret, and Company ID on the OAuth Token Server. Capture the secret at creation, since it cannot be retrieved later.
API service account provisioned	A dedicated admin or API user for the integration to run as, with an active, non-expiring or rotation-managed credential.
Write access to learning events	The service account holds the Add Learning Events or Add History Record permission, so courses and completions can post back.
Root domain confirmed	The host of your SuccessFactors Learning environment, the base URL the integration connects to.
HRIS metadata fields selected	Decide which user fields Arist receives, and confirm they are populated and synced from Employee Central into Learning.
Learner identifier mapping confirmed	Identify the stable key for each learner, for example person ID or user ID, and whether it matches across Employee Central and Learning.
Endpoints reviewed with security	Share the endpoint list in sections 5 and 6 with your security team, and apply any IP allow-listing your policy requires.

3. Decisions to settle before mapping

These questions define who syncs to Arist and what happens when an employee's situation changes. They are the items most likely to surface mid-project if they are not decided up front, so bring answers, or the right people, to your first session.

Question	What to decide
Which employee populations are in scope	Whether the sync includes full-time only, or also part-time, fixed-term, and external or contingent workers, and confirm the filters match.
What happens when someone changes employment type	Conversions and transfers can issue a new person or user ID, so decide which record wins and whether learning history follows the person.
How active and inactive employees are handled	Map employment status as a synced field, and decide whether someone on leave keeps receiving training, pauses, or deactivates.
What happens at termination and rehire	How quickly messages stop, whether the learner record deactivates or is removed, and whether a rehire reuses the same person ID or a new one.
Which email is authoritative	Employee Central email, corporate UPN, and Learning contact email can differ, so name the system of record and which address reaches each learner.
What other systems create or update users	If Teams or a device-management sync also provisions learners, list every source and the identifier each keys on so no one arrives twice.
Whether legacy, shared, or generic emails exist	Acquired-company domains, regional domains, and shared mailboxes break one person to one email, so decide how each is reconciled.
How fresh the data must be	Agree a sync frequency that matches how fast your workforce changes. Daily is typical, so say so now if transitions must reflect within hours.
Who is excluded	Executives, works councils, specific countries, or people without corporate email are easiest to handle as sync filters, so name them now.

4. Establishing the connection

Arist authenticates to your tenant using OAuth 2.0 against your SuccessFactors Learning instance. No user passwords are stored. Arist exchanges a client credential for a short-lived bearer token, presents it on every API call, and refreshes it automatically.

It posts to the token endpoint at https://<root-domain>/learning/oauth-api/rest/v1/token, which returns a bearer token valid for about 30 minutes. All traffic is encrypted in transit over TLS 1.2 or higher, and the credential is tied to a dedicated service account scoped only to the Learning OData services this integration uses.

Your IT team provides the five values below, all generated or located inside your SuccessFactors Learning administration environment.

Field	What it is	Where to find it
Root Domain	Your SuccessFactors Learning instance URL	The host of your Learning environment, for example `https://<tenant>.lms.hr.cloud.sap`
Client ID	The OAuth client (application) identifier	System Admin, Configuration, OAuth Token Server
Client Secret	The secret paired with the Client ID, shown once	The same OAuth Token Server page. Regenerating it deprecates the previous secret
Username	The admin or API service account the calls run as	Profile settings of the service account on your Learning instance
Company ID	Your tenant identifier	The same page as the Client ID and Client Secret

Important: The Client ID, Client Secret, and Company ID all live together at System Administration, Configuration, OAuth Token Server in Learning Administration. Capture the Client Secret at creation, because it cannot be retrieved later and must be regenerated if lost.

5. HRIS endpoints Arist reads

Arist reads from your Learning OData v4 services to identify learners and pull the metadata attached to each. Learner records and their HRIS metadata are synced into Learning from Employee Central upstream, so the fields you map there become the fields Arist can read.

Purpose	Endpoint
Find learners	`GET /learning/odatav4/searchStudent/v1/Students`
User record and HRIS metadata	`GET /learning/odatav4/public/user/userlearning`
Existing learning history	`GET /learning/odatav4/public/user/learningHistory/v1/learninghistorys`

The Find learners and Learning history calls filter by a learner criteria such as learnerID or targetUserID, and the learning history call is queried per user so Arist has a complete view of prior completions.

As part of setup, decide which user metadata fields should reach Arist, since this metadata is what Arist uses to create learners, segment audiences, and trigger automations. Commonly mapped fields are Employee ID, Email, Manager, Department, Division, Business unit, Job title, Job code, Location, Country, Hire date, Employment status, Preferred language or locale, and custom fields custom01 to custom15.

Important: Confirm each field you want Arist to use is populated on the employee record and included in your Employee Central to Learning user sync. A field that is not mapped or kept current in SuccessFactors is not visible to Arist and cannot be used for targeting.

6. LMS endpoints Arist writes

Learning created in Arist is written back into SuccessFactors in two stages, first the course record and then each learner's completion against it, so the activity is captured on the employee's profile. First, when a course is built in Arist, it is sent to your Learning instance as Open Content Network (OCN) content for an administrator to import into the catalog. A completion cannot attach until its course is imported. Second, as learners finish in Arist, each completion is posted as an OCN learning event and lands on the user's learning history, closing the loop against the imported course.

Stage	Channel or endpoint	Purpose
Publish course	SAP Open Content Network (OCN)	Publishes the Arist course to your catalog for an admin to import
Record completion	`POST /learning/odatav4/public/admin/learningevent-service/v1/OCNLearningEvents`	Posts each completion as an OCN learning event on the learner's history

Each completion carries the learner ID, the course or content reference, and the completion date, sent as completionDate and completionTimeZoneID. The exact OCN course-import endpoint is set in your connector at onboarding.

Important: The service account must hold the permission to record learning events, for example Add Learning Events or Add History Record. Without write access scoped to the learning event service, course and completion records cannot post back to SuccessFactors.

7. Responsibilities and security

Your responsibilities during and after setup are the following.

Provide and maintain credentials: Supply the OAuth Client ID, Client Secret, Username, Company ID, and Root Domain, and tell Arist before you rotate the secret so the connection is not interrupted.
Grant write access to completions: Scope the service account with permission to record learning events, so course records and completions can post to the learning history tables.
Select and populate HRIS metadata: Decide which user fields Arist receives, and ensure they are filled in and synced from Employee Central into Learning.
Keep the service account healthy: Maintain an active, non-expiring or rotation-managed API account, and apply any IP allow-listing your security policy requires.

Arist's security and data handling posture is deliberately narrow.

OAuth 2.0, no passwords: Access uses short-lived bearer tokens of about 30 minutes, and no end-user passwords are stored or transmitted.
Encrypted in transit: Every call between Arist and SuccessFactors runs over TLS 1.2 or higher.
Least privilege: The service account is scoped only to the Learning OData services this integration needs.
Data minimization: Only the metadata fields you choose to map are read, nothing beyond what is needed to run learning.

HRIS Integration - SuccessFactors
LMS Integration - SuccessFactors
HRIS Data Preparation

Note: Need help at any point? Reach out to your Arist Customer Success contact, or email [email protected].

Arist and SuccessFactors - Technical Guide