Epicor Kinetic and ADP integration

What moves between them

The main flow runs from ADP into Epicor Kinetic. After each payroll run, ml-connector reads ADP's general ledger documents and posts the labor cost journals into Epicor's general ledger, mapped to the matching GL accounts and segment values. Reference data such as cost centers, departments, and job codes is aligned so payroll allocations land on valid Epicor dimensions. GL documents are read-only in ADP, so ml-connector never writes financial entries back to payroll, and Epicor's chart of accounts stays admin-managed rather than overwritten. The cadence follows your payroll calendar, with polling between runs.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, refreshing the ADP bearer token when a call returns 401. On the Epicor side it accepts the full server URL, instance, and company per customer, sends the required x-api-key header alongside Basic or IdP token auth, and refreshes the one-hour Epicor token before it expires. Cost centers and departments are mapped first, so every payroll journal line references a GL account and segment value that already exists in Epicor. Because Kinetic has no webhooks, ml-connector polls ADP general ledger documents on a schedule tied to your payroll calendar using OData $top and $skip paging, and where ADP event notifications are enabled it can receive them as well. Writes into Epicor use the UpdateMaster call so GL lines post in a single operation, avoiding the known empty-account bug on individual line endpoints. ADP rate limits return HTTP 429 per gateway node, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized discrete manufacturer with around 400 employees runs Epicor Kinetic for production, procurement, and finance, and uses ADP Workforce Now for payroll across two plants and a head office. Before the integration, the finance team exported payroll registers from ADP every pay period and keyed the labor totals into Epicor by hand, then spent the first days of month-end close chasing differences between the payroll registers and the labor accounts in the ledger. With Epicor Kinetic and ADP connected, each payroll run's GL document posts into Epicor automatically, allocated to the cost center for each plant, so month-end close starts with the labor accounts already reconciled and the manual re-keying step is gone.

What you can do

• •Post ADP general ledger documents into Epicor Kinetic's general ledger after every payroll run.
• •Allocate payroll journal lines to the correct Epicor GL accounts and chart-of-accounts segments.
• •Map ADP cost centers, departments, and job codes to Epicor GL dimensions so lines stay valid.
• •Authenticate ADP with OAuth2 and mutual TLS, and Epicor with its instance login and x-api-key header.
• •Poll ADP on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between Epicor Kinetic and ADP?

The main flow is ADP into Epicor Kinetic. Payroll general ledger documents move from ADP into Epicor, while cost centers and departments are aligned so the journal lines map to valid Epicor accounts. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 client credentials, and the handshake fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.

How does the integration handle Epicor's lack of webhooks?

Epicor Kinetic has no native outbound webhooks, so ml-connector reads finance records by polling, using an OData filter on a modified-date field. It runs on a schedule tied to your payroll calendar and pages through results with $top and $skip rather than relying on a push from Epicor.