Sage Intacct and Gusto integration

What moves between them

The main flow is from Gusto into Sage Intacct. Payroll and employee events flow via webhook from Gusto, triggering ml-connector to read full payroll details, then post labor cost journals into Sage Intacct's GL, mapped to GL accounts and cost centers. Employee records from Gusto keep Sage Intacct headcount aligned with hires, terminations, and rehires. Reference data such as pay schedules and earning types are read from Gusto and mapped to Sage Intacct cost centers and GL dimensions. GL postings are write-only into Sage Intacct; ml-connector does not write back into Gusto payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and maintains a Sage Intacct session, refreshing it every 50 minutes before expiry, since session IDs cached in-process are keyed on companyId and userId. On the Gusto side, it refreshes the OAuth2 token on 401 responses and verifies webhook signatures using HMAC-SHA256 and the X-Gusto-Signature header. Because Sage Intacct requires all requests to route through a single XML gateway, ml-connector queues operations and processes them serially, handling XML control character stripping (forbidden characters C0 controls except tab, newline, carriage return) before entity escaping. Gusto webhooks carry payroll event payloads, but ml-connector also polls Gusto payroll and employee records on a schedule aligned with your pay cycle, since GL documents are not pushed in real time. Every Gusto request uses the idempotent object versioning pattern: ml-connector reads the current version field, includes it in any PUT request, and retries if a 409 Conflict indicates a version mismatch. Cost centers and GL accounts are mapped first, so every labor posting references valid Sage Intacct dimensions. Gusto rate limits are tracked to prevent HTTP 429 errors, and all records carry a full audit trail.

A real-world example

A growing consulting firm runs Sage Intacct for accounting and finance, and uses Gusto for payroll and benefits across four regional offices. Before the integration, the accounting team received payroll registers from Gusto and manually re-entered labor totals into Sage Intacct each pay period, allocating costs to regional cost centers by hand. Month-end close required reconciliation of headcount between Gusto and Sage Intacct, often uncovering mismatches when new hires had been added to Gusto but not yet to the accounting system. With Sage Intacct and Gusto connected, payroll GL journals post automatically to the correct regional cost centers after each pay run, and employee records stay in sync the moment a hire or termination occurs. Month-end close now starts with labor accounts and headcount already aligned.

What you can do

• •Post Gusto payroll GL journals into Sage Intacct general ledger after every pay run, allocated to the correct cost centers and GL accounts.
• •Keep Sage Intacct employee records aligned with Gusto hires, terminations, and rehires in real time.
• •Map Gusto pay schedules, earning types, and benefit categories to Sage Intacct cost centers and GL dimensions.
• •Authenticate Sage Intacct with session-based XML credentials and Gusto with OAuth2, refreshing both as they expire.
• •Receive Gusto payroll and employee webhooks with HMAC signature verification, and poll Sage Intacct on a schedule tied to your payroll calendar.

Questions

Which direction does data move between Sage Intacct and Gusto?

The main flow is from Gusto into Sage Intacct. Payroll GL journals, employee records, and reference data flow from Gusto into Sage Intacct, where they are mapped to cost centers and GL accounts. Sage Intacct general ledger is read-only to the integration, so ml-connector does not write financial entries back into Gusto.

How does ml-connector handle Sage Intacct's single XML gateway endpoint?

All Sage Intacct requests route through one POST connection to https://api.intacct.com/ia/xml/xmlgw.phtml, requiring strict serialization. ml-connector queues operations and processes them serially, maintains a cached session ID for 50 minutes, refreshes it before expiry, and parses application-level errors from the XML response body, since HTTP 200 may contain error details.

Does the integration work with Gusto webhooks, or does it poll?

ml-connector subscribes to Gusto webhooks for payroll, employee, and company events to detect changes in real time, verifying each webhook signature via HMAC-SHA256. It also polls Gusto on a schedule tied to your payroll calendar to catch any events that occurred outside the webhook window and to ensure no data is missed.