IFS Cloud and Gusto integration

What moves between them

The main flow moves from Gusto into IFS Cloud. When Gusto webhooks fire for payroll events (processing, paid, calculated), ml-connector receives the event and fetches the full payroll, employee, and compensation details from Gusto. It then constructs GL vouchers (journal entries) representing payroll accrual and expense accounts, allocating amounts to IFS GL accounts per company code. Employee records sync into IFS as customers or project resources so IFS headcount matches active Gusto employees. Changes are one-directional: Gusto is authoritative for payroll and HR, while IFS owns GL posting and financial reporting.

How ml-connector handles it

ml-connector registers an HTTPS endpoint as a Gusto webhook receiver and validates signatures using Gusto's HMAC-SHA256 X-Gusto-Signature header with the subscription verification token. When a payroll event fires, ml-connector fetches the payroll, employees, and compensations from Gusto using OAuth 2.0 bearer tokens (refreshing when a token approaches expiry). It maps Gusto employees to IFS customers or project resources by email or employee ID, and allocates payroll amounts to IFS GL accounts based on job codes and company assignment configured per customer. Each GL voucher is posted to IFS via OData PATCH/POST, including the ETag header required for mutations. If IFS returns HTTP 429, ml-connector backs off with exponential jitter and retries. Because Gusto webhooks may fire multiple times for the same payroll, ml-connector deduplicates by checking for existing vouchers before creating new ones, and it logs the full audit trail of each attempt.

A real-world example

A mid-market product company operates IFS Cloud for manufacturing, procurement, and finance across three locations, and uses Gusto for payroll and benefits administration. Before the integration, the accounting team received a payroll summary from Gusto each pay period and manually entered the gross wages, employer taxes, and benefits expense into IFS, breaking out the amounts by cost center for each location. Month-end financial close required chasing differences between Gusto headcount and the wages expense account in the ledger, and the manual entry step introduced delays and errors. With Gusto and IFS Cloud connected, each payroll posting flows into IFS automatically on the day Gusto processes it, allocated to the correct GL accounts and company codes, and the accounting team starts month-end close with payroll expenses and employee counts already reconciled.

What you can do

• •Receive Gusto payroll events via webhook and fetch complete payroll and employee details for posting.
• •Post Gusto payroll accrual and expense journals to IFS GL accounts, allocated by cost center and company code.
• •Map Gusto employees to IFS customers or project resources so headcount stays synchronized.
• •Validate and refresh OAuth tokens for both Gusto and IFS, handling token expiry and 401 responses.
• •Deduplicate GL vouchers by payroll ID and retry failed postings to IFS with exponential backoff when rate limits are hit.

Questions

How does ml-connector handle Gusto payroll events arriving at irregular times or duplicated?

ml-connector registers an HTTPS webhook endpoint and validates payroll event signatures using HMAC-SHA256. When an event arrives, it fetches the payroll details from Gusto and checks IFS for an existing GL voucher with the same payroll ID before posting. If a voucher exists, the event is skipped; if not, a new voucher is created. This deduplication pattern handles Gusto retries and ensures each payroll posts exactly once.

Which GL accounts and company codes do payroll amounts map to?

The mapping is configured per customer and can vary by location and payroll type. ml-connector allocates Gusto gross wages, employer taxes, and benefits expense to customer-specified IFS GL accounts, breaking down amounts by job code and company code. The customer provides the mapping during configuration, and ml-connector validates that target GL accounts and company codes exist in IFS before posting.

What happens if an IFS GL posting fails or Gusto rate limits the API?

If IFS returns HTTP 429 (rate limit), ml-connector backs off with exponential backoff and jitter, then retries the voucher post. If IFS returns an error (e.g., invalid company code, account not found, ETag mismatch), ml-connector logs the failure with full details and can replay the payroll event once the issue is fixed. The full audit trail is preserved so no payroll is lost.