HRIS

HighQ

Connect HighQ to Ploy to automatically discover the users in your HighQ instance, the groups you use to control access, and who belongs to each group. This keeps your HighQ access picture up to date in Ploy, and lets Ploy add or remove group members for you — for example as part of an onboarding or offboarding flow.

What Ploy syncs from HighQ

  • Users: every user in your HighQ instance, with their email address, user ID, account status, the date they were invited, and their last login. Ploy uses the account status to tell active users from deactivated ones.

  • Groups: your HighQ groups, with their name, description, type, and creation date. Groups appear in Ploy as resources you can review and act on.

  • Group memberships: which users belong to each group, so Ploy always has the full membership list for every group.

Data syncs periodically to keep Ploy up to date.

Before you begin

  • You need administrator access to your HighQ instance so you can register an OAuth application (this is what gives Ploy a client ID and client secret).

  • Ploy connects using OAuth 2.0: after you enter the client credentials, a HighQ user signs in and authorizes the connection. Ploy accesses HighQ as that user, so authorize with an administrator account that can see all users and groups — otherwise the data Ploy syncs will be limited to what that user can see.

  • Have your HighQ domain and instance name to hand. If you sign in at a URL like https://example.highq.com/myinstance/, the domain is example.highq.com and the instance name is myinstance.

Register an OAuth application in HighQ

  • In your HighQ instance's system administration area, register a new OAuth application (sometimes called an API client) for Ploy.

  • Set the redirect URI (also called the callback URL) to exactly:

https://api.joinploy.com/integrations/auth/highq/callback

  • Copy the client ID and client secret HighQ gives you — you will paste both into Ploy in the next section.

Connect HighQ to Ploy

  • In Ploy, click Integrations in the left sidebar.

  • Click Add new integration and search for HighQ.

  • In HighQ Domain, enter your HighQ domain (for example example.highq.com) — just the domain, without https://. This field is required.

  • In HighQ Instance Name, enter your instance name (the part of your HighQ URL after the domain). This field is required.

  • Continue to the next step.

  • In Client ID, enter the client ID provided by HighQ. This field is required.

  • In Client Secret, enter the client secret provided by HighQ. This field is required.

  • Continue to the next step.

  • Click Authorize with HighQ. You are taken to your HighQ instance to sign in and approve the connection, then returned to Ploy.

Once authorized, Ploy exchanges the approval for access tokens and refreshes them automatically — you do not need to re-authorize unless the connection breaks.

What Ploy can change in HighQ

  • Add a user to a group: when you ask Ploy to grant access (for example from an onboarding flow or an approved access request), Ploy adds the user to the HighQ group.

  • Remove a user from a group: when access is revoked (for example during offboarding or after an access review), Ploy removes the user from the group. If the user is already not in the group, Ploy treats the removal as complete rather than failing — so deprovisioning flows are safe to re-run.

These are the only writes Ploy makes in HighQ.

Troubleshooting

The authorize button does not do anything

The Authorize with HighQ button only becomes active once your domain, instance name, and client ID have all been saved. Complete the earlier steps of the wizard first, then return to the authorization step.

"HighQ authentication failed - check API credentials"

Ploy could not authenticate with HighQ when trying to sync. This usually means the authorization has expired or been revoked, or the client secret changed in HighQ. Check the client ID and client secret are still valid, then go through the connection steps again and re-authorize.

Authorization completes but the connection fails

Check that the redirect URI registered in HighQ is exactly https://api.joinploy.com/integrations/auth/highq/callback, and that the client ID and secret in Ploy match the OAuth application in HighQ. Then re-run the authorization step.

Was this helpful?
Was this helpful?