The API provisioning was definitely our biggest technical challenge, so I’ll share our complete approach.
System Integrations:
We integrated with Active Directory, Okta for SSO, Office 365, and our HRIS (Workday). Each has different API capabilities and reliability profiles.
Automated Task Routing for Provisioning:
We created a sub-process that handles all provisioning tasks with smart routing based on system availability and employee requirements. The process uses a priority queue where critical systems (AD, email) provision first, followed by departmental tools. If an employee doesn’t need access to certain systems, those provisioning tasks are automatically skipped through conditional routing.
Cloud Forms Integration:
The employee intake form captures all required information in structured fields that map directly to API parameters. We implemented field-level validation that checks against each target system’s requirements in real-time. For example, the username field validates against AD naming conventions and checks availability before submission. This prevents provisioning failures due to data format issues.
API Provisioning Implementation:
// Core provisioning pattern (simplified)
POST /api/identity/provision
Headers: Authorization: Bearer {token}
Body: {
"employeeId": "EMP-2024-0156",
"systems": ["ad", "okta", "o365"],
"retryPolicy": "exponential"
}
We use Appian’s integration objects with exponential backoff retry logic (3 attempts: immediate, 5min, 15min). Each integration writes status to a provisioning tracker CDT that maintains state across all systems.
Error Handling Strategy:
For failures after retries, the process creates an exception task assigned to IT with full context about what succeeded and what failed. This prevents the entire onboarding from blocking. The IT team can manually provision the failed system and mark it complete in Appian, which updates the tracking table and notifies the employee.
We also implemented a daily reconciliation job that queries each system’s API to verify account creation and flags discrepancies. This catches edge cases where an API returned success but the account wasn’t actually created.
Polling vs Webhooks:
Since not all our systems support webhooks, we use a hybrid approach. Systems with webhooks (Okta, Workday) push status updates immediately. For others (legacy departmental tools), we poll every 2 minutes for up to 30 minutes, then fall back to the exception task if still pending.
Monitoring Dashboard:
We built an Appian report that shows provisioning status across all systems for each new hire. HR can see at a glance if someone is fully provisioned or has pending items. Managers love this visibility.
Results:
- 94% of provisioning completes fully automated within 2 hours
- Remaining 6% require IT intervention (usually due to unusual access requirements)
- Zero instances of new hires arriving without basic access (email, network)
- IT ticket volume for access requests dropped 78%
The key to success was treating provisioning as a resilient distributed system rather than assuming all APIs would work perfectly. Building in observability, retry logic, and graceful degradation made the difference between a fragile integration and a production-ready solution.