# PingOne DaVinci: Identity Orchestration as a Canvas

> What identity orchestration is and why it became its own product category: DaVinci's drag-and-drop flows, the connector catalog that turns vendors into nodes, server-driven orchestration that lets journeys change without app releases, the Singular Key origin story, and how DaVinci coexists with the ForgeRock-heritage journeys and trees under one SDK family.

Source: https://ronutz.com/en/learn/pingone-davinci-orchestration  
Updated: 2026-07-22  
Related tools: https://ronutz.com/en/tools/oidc, https://ronutz.com/en/tools/jwt, https://ronutz.com/en/tools/pkce

---

Registration, login, MFA step-up, password reset, identity proofing, fraud checks - a real user journey crosses half a dozen systems, and for years the wiring between them was custom code that broke on every vendor change. **Identity orchestration** is the product category that replaced that code with a canvas, and **PingOne DaVinci** is Ping's orchestrator. (Facts follow Ping's official documentation and announcements, verified at the time of writing.)

## Flows: the journey as a diagram

DaVinci's unit is the **flow**: a drag-and-drop graph where each node does one thing - collect a credential, call a risk engine, branch on a condition, invoke MFA, write to a directory - and the edges are the user's possible paths, including the unhappy ones. The pitch at launch was "if you can whiteboard it, you can orchestrate it," and the substance behind the slogan is that the *journey logic leaves the application code*: product teams change the login experience by editing the diagram, not by shipping an app release. Flows are versioned, testable, and composable - a proofing sub-flow built once gets reused by every journey that needs it.

## Connectors: vendors as nodes

The second half of the model is the **connector catalog**: pre-built integrations that surface external services as nodes on the canvas - Ping's own services ([PingOne MFA, Protect, Verify](https://ronutz.com/en/learn/pingone-platform)) alongside a large third-party ecosystem of proofing providers, fraud engines, CRMs, and communication services. Connectors are what make orchestration an *integration* strategy rather than just a flowchart: swapping one fraud vendor for another becomes a node replacement inside the flow, with the surrounding journey untouched. This is also the honest limit to name: your journey is as reliable as the services its nodes call, so orchestration concentrates monitoring exactly where it concentrates integration.

## Server-driven: the client stays dumb on purpose

DaVinci executes flows server-side, and the client SDKs (JavaScript single-page apps, Android, iOS) implement **server-driven orchestration**: the flow tells the client what to render next - which fields to collect, which challenge to present - through typed collectors, and the app supplies its own look and feel. Handle the collector types generically and *the flow can change in production without an app update*: add a proofing step, reorder MFA, insert a risk gate, all without touching the binary users already installed. That single property is much of orchestration's operational value, and it is the design center of Ping's current unified SDK family, which speaks to DaVinci flows and to the ForgeRock-heritage journeys through one model.

## Origin, coexistence, and the exam angle

DaVinci entered the catalog through Ping's 2021 acquisition of **Singular Key**, re-launched as PingOne DaVinci in early 2022 - young by identity-infrastructure standards, which explains its cloud-native shape. Since the ForgeRock merger, it coexists with a second orchestration tradition: **journeys and authentication trees** in PingAM and [Advanced Identity Cloud](https://ronutz.com/en/learn/ping-forgerock-lineage), a different engine with a similar canvas philosophy; the platform direction is convergence at the SDK and experience layer while both engines serve their installed bases. For certification, DaVinci carries its own Certified Professional exam - orchestration is considered its own competency, not a PingOne footnote - and [the study guide](https://ronutz.com/en/certifications/ping-cp-pingone-davinci) tracks the official objectives as they land.