Oracle NetSuite and ADP integration

What moves between them

The main flow runs from ADP into Oracle NetSuite. After each payroll run, ml-connector reads ADP's general ledger documents and posts the labor cost journals into NetSuite's general ledger, mapped to the matching NetSuite GL accounts and the Department, Class, and Location dimensions. Employee records flow the same direction so NetSuite reflects ADP hires, terminations, and rehires. Reference data such as cost centers, departments, and job codes is aligned so payroll allocations land on valid NetSuite dimensions. GL documents are read-only in ADP, so ml-connector never writes financial entries back to payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, refreshing the ADP bearer token when a call returns 401. On the NetSuite side it signs a JWT with the customer's private key to obtain a 60-minute token, re-running the full flow when the token expires since there is no refresh token, and it accepts the account-specific URL per customer because NetSuite has no shared API host. Posts to NetSuite carry an externalId so a retried delivery upserts rather than duplicates, the standard NetSuite idempotency pattern. ADP cost centers and departments are mapped first, so every payroll journal line references a NetSuite GL account and dimension that already exists. Both sides return HTTP 429 under load with a Retry-After hint, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized professional services firm of about 400 staff runs Oracle NetSuite for finance across three subsidiaries and uses ADP Workforce Now for payroll. Before the integration, accounting exported the payroll register from ADP every pay period and re-entered labor totals into NetSuite as a manual journal, then spent the first days of month-end close reconciling headcount in HR against the labor accounts in the ledger. With Oracle NetSuite and ADP connected, each payroll run's GL document flows into NetSuite automatically, allocated to the correct subsidiary, department, and class, and worker changes keep the two systems aligned. Month-end close starts with the labor accounts already reconciled and the manual re-keying step gone.

What you can do

• •Post ADP payroll GL documents into Oracle NetSuite's general ledger after every pay run, allocated to the correct accounts and dimensions.
• •Keep NetSuite employee records aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes to NetSuite Department, Class, and Location so payroll lands on valid accounts.
• •Authenticate ADP with OAuth2 and the required mutual TLS certificate, and NetSuite with its certificate-based JWT token flow.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between Oracle NetSuite and ADP?

The main flow is ADP into Oracle NetSuite. Payroll general ledger documents and worker records move from ADP into NetSuite, while cost centers and departments are aligned so allocations match. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

How does the integration handle the two different authentication schemes?

ADP requires OAuth2 client credentials plus a mutual TLS certificate presented on every call, and NetSuite uses a certificate-based JWT that the connector signs to obtain a 60-minute token. ml-connector stores both credential sets encrypted, presents the ADP certificate at the TLS layer, signs the NetSuite JWT, and refreshes each token when a call returns 401. It also tracks the ADP certificate expiry so a renewal is handled before it can cause an outage.

Does NetSuite need webhooks, or does the connector poll?

The connector polls. NetSuite has native Event Subscriptions, but they carry no HMAC signature and SuiteQL is the efficient path for bulk finance reads, so ml-connector reads NetSuite and ADP on a schedule tied to your payroll calendar. ADP can push worker and payroll events to a registered endpoint where that is enabled, but the GL posting flow runs after each payroll run.