Hi:
Cloud for customer (C4C) offers 2 separate SOAP APIs.
- Replication of Business Role definitions from any external system to C4C. This API can be used to integrate with your Business Role definition work-flow, wherein you can invoke the API from your GRC system (project specific development) to provision and manage business roles into C4C system.
- Replication of Employees from any external system to C4C. In C4C, as you mentioned, the employee has an associated user / identity record that is used for logon and enforcing access control. This API allows you to manage the Employee data (e.g. employee biographical data with validity periods), Identity information (e.g. User id for logon to C4C system) together with the Business Role assignments for the employee / identity. Using this you can set the employee status (e.g. active / inactive) with validity dates and also add new Business Role, remove existing Business Role assignments for the employee (and consequently to the Identity), there by enabling you to manage the complete life-cycle of the Employee, Identity and Role assignment data for the identity from your On Premise systems.
Hope this clarifies.
Venki