← Back to Policy Core on Find Care ScotlandThis is a demonstration with sample data. It resets every night; please do not enter real information.All software

Connecting Care Core

Keep staff, job titles and teams up to date automatically.

For: Administrators · About 7 minutes to read · Checked 14 Nov 2026

Care Core is the single record of an organisation's staff, teams and the people it supports. Connect it and Policy Core keeps your staff list, job titles and teams up to date by itself: joiners are asked to read what applies to them on their first day, and leavers lose access when Care Core records it.

Who can do this: Administrators only.

What you need #

  • A Care Core for your organisation, and an administrator there.
  • Its address, which must begin https://.
  • An API key from Care Core. In Care Core open Admin → Integrations, find API keys and press Create a key. Give it a name such as "Policy Core", tick the permissions below, and press Create API key. Care Core shows the key once: copy it straight away. The permissions:
    Permissions the key needs
    PermissionWhyRequired?
    people.readNames and email addressesYes
    staff.readWho is currently employed, job titles and last daysYes
    teams.readTeams and who is in themOptional: without it, people sync but teams do not
    webhooks.manageSo Care Core can tell Policy Core straight away when something changesRecommended: without it, changes arrive on the nightly check or when you press Sync now
    Do not give the key write permissions. Policy Core only ever reads.

Connect #

  1. Open Settings and find the Care Core box.
  2. Type the address and paste the key.
  3. Press Connect.

You should see: "Connected. 14 added, 0 updated, 0 left, 9 teams." The box now says Connected with the address and the time of the last sync.

The Settings page with the organisation name and, beside it, the Care Core box asking for an address and an API key. (opens a larger view)
Settings, before Care Core is connected. (Sample data. Select the picture to enlarge it.)

If something is wrong you are told in plain words: "Care Core did not accept the API key", "That API key is missing a permission", "Use an https:// address".

What happens automatically #

What Care Core controls
In Care CoreIn Policy Core
Someone starts a jobAn account is created (as a member of staff) with their name, email and job title. They are asked to read every policy that applies to them.
Their job title or name changesIt is updated. Audiences chosen by job title follow.
They join or leave a teamAudiences chosen by team follow.
Their employment ends (a last day in the past)Their account is switched off at once. They drop out of every audience and cannot sign in. What they confirmed is kept.
A last day is set in the futureThey can still sign in and read until that day, and stop the day after.
A team is created, renamed or closedThe team list is refreshed.

Changes reach Policy Core within about a minute. A nightly check catches anything that was missed, for example if either system was unavailable.

What Policy Core keeps for itself #

  • Roles. New people are members of staff. You give someone a manager or administrator role in Policy Core, and a sync never changes it.
  • Sign-in links. Staff sign in with an emailed link. While Care Core is connected, Policy Core does not let anyone set or change a password: Care Core is the one place people are looked after, and a second password here would be a second credential to keep track of. A password that was set before you connected keeps working.
  • Policies, appendices, readings and everything else you do here.

It never receives anything about the people your organisation supports.

Change someone's details #

Do it in Care Core. Policy Core is not the place to edit a name, a job title or a team once Care Core is connected. If you try to, you will find the boxes are not there.

Sync now #

Press Sync now to check straight away, for example after fixing a problem. The result shows how many were added, updated and left, how many teams, and any problems.

Problems it reports #

has no email address in Care Core, so they cannot be given a sign-in
Add the person's work email in Care Core. They appear on the next sync.
that email address already belongs to an account in another organisation
An email address can have only one account in the system. Check which address is right in Care Core.
Teams were not read: the API key needs the teams.read permission
Add the permission to the key in Care Core. People are unaffected.
Care Core could not be told where to send changes
You are connected and people sync, but live updates are off. Updates arrive on the nightly check or Sync now. Check the key has webhooks.manage and that Policy Core's address is reachable from Care Core.

Disconnect #

Press Disconnect and confirm. Everyone stays, their accounts and all records are kept, and you can manage the list by hand from then on (Adding people, roles and leavers). Policy Core also asks Care Core to stop sending changes.

Security of the connection #

  • The key and the webhook's signing secret are stored encrypted, never in plain text.
  • Care Core's messages are accepted only with a valid signature and a secret token in the address. A message that fails either check is refused.
  • The same message arriving twice is recognised and applied once.
  • Only https:// addresses are accepted (and localhost for developers).

Is something wrong, unclear or missing on this page? Tell us what is wrong or missing on this page. We read every message and fix what we get wrong.