IFS Cloud and UKG integration

What moves between them

The integration flows payroll GL journals from UKG into IFS Cloud. After each payroll cycle, ml-connector reads UKG payroll GL export records via the thirdpartypay endpoint or webhook events and posts them into IFS Cloud as financial vouchers in the general ledger, mapped to the correct IFS Cloud GL accounts and cost centers. Employee master records from UKG are read via the /personnel/v1/employees endpoint (or via employee. webhook events when configured) and synced to IFS Cloud HR dimensions such that UKG headcount changes flow into IFS Cloud. The sync runs on a payroll calendar schedule and can use either UKG webhooks (near real-time) or the delta polling endpoint (secondary verification).

How ml-connector handles it

ml-connector stores both credential sets encrypted and manages the OAuth 2.0 token refresh cycles for IFS Cloud (60-minute expiry) and UKG (60-minute expiry with secondary polling). On the IFS Cloud side, it accepts the tenant-specific base URL per customer and validates entity paths against that instance. For payroll GL posting, ml-connector reads UKG's thirdpartypay export or webhook events, which include GL account segments and debit/credit amounts, and maps them to IFS Cloud VoucherSet entries with the corresponding GL accounts and cost centers. Because IFS Cloud is pull-only, the integration polls on a payroll schedule rather than waiting for a push from IFS, though it can also listen for UKG webhook events where enabled. IFS Cloud enforces OData ETag headers on mutations, so ml-connector captures the @odata.etag value when reading a voucher record and includes it as the If-Match header when updating to prevent lost updates. UKG's employee endpoint returns internal UUIDs and requires a second call per employee to fetch full profiles, which ml-connector batches efficiently. Cost centers and GL accounts are validated and mapped first, so every payroll entry references dimensions that already exist in IFS Cloud. The integration handles IFS Cloud rate limits (approximately 1000 requests per minute per tenant) and UKG OAuth token expiry with exponential backoff and retry logic, and maintains a full audit trail of every record processed.

A real-world example

A mid-sized manufacturing company runs IFS Cloud for production, inventory, and finance, and uses UKG for payroll and HR across multiple plants and a central office. Before the integration, the accounting team manually exported payroll GL data from UKG each pay period and re-entered the labor cost totals into IFS Cloud by hand, then spent the first week of month-end close reconciling differences between UKG headcount and the labor cost accounts in the IFS Cloud ledger. With UKG and IFS Cloud connected, each payroll cycle's GL data flows automatically into IFS Cloud vouchers, pre-allocated to the correct plant cost centers, and employee changes in UKG are reflected in IFS Cloud HR dimensions. Month-end close now starts with the labor accounts already validated, the manual re-keying step is eliminated, and headcount differences are caught immediately rather than discovered days later.

What you can do

• •Post UKG payroll GL journals into IFS Cloud financial vouchers after each payroll run, allocated to the correct GL accounts and cost centers.
• •Keep IFS Cloud HR employee records aligned with UKG hires, terminations, and compensation changes.
• •Map UKG cost centers and GL account segments to IFS Cloud financial dimensions so payroll entries land on valid accounts.
• •Refresh OAuth 2.0 tokens for both IFS Cloud and UKG automatically, handling 60-minute token expiry on both sides.
• •Read UKG payroll data via webhook events or delta polling, with retries and a full audit trail on every voucher posted to IFS Cloud.

Questions

Which direction does data move between IFS Cloud and UKG?

The main flow is UKG into IFS Cloud. Payroll GL journals and employee master records move from UKG into IFS Cloud, while cost centers and GL accounts are validated in IFS Cloud before payroll entries are posted. IFS Cloud financial vouchers are read-only for this integration, so ml-connector does not write financial entries back into UKG.

How does ml-connector handle IFS Cloud OData ETag requirements for mutations?

IFS Cloud enforces OData ETag headers on PATCH and POST operations for optimistic concurrency control. When ml-connector reads a voucher record from IFS Cloud, it captures the @odata.etag value and includes it as the If-Match header in the subsequent mutation request. This prevents lost updates if the record changes between the read and write steps.

Does the integration rely on IFS Cloud webhooks or polling?

IFS Cloud does not offer a standard public webhook system. The integration uses pull-based polling of the OData API on a schedule tied to your payroll calendar. On the UKG side, ml-connector can accept webhook events (HMAC SHA-256 signed) for near real-time employee and payroll changes, or use UKG's delta endpoint as a secondary verification mechanism.