How does ml-connector handle OAuth token expiry in both systems?

Dayforce OAuth tokens expire after 3600 seconds (1 hour) and Oracle NetSuite M2M tokens expire after 60 minutes. Both systems do not provide refresh tokens in the M2M or ROPC flows, so ml-connector pre-emptively refreshes each token before expiry and caches it for the next request. If a call returns 401, ml-connector immediately refreshes the token and retries the request.

What happens if an employee record exists in Dayforce but not yet in Oracle NetSuite?

ml-connector checks each Dayforce employee against existing NetSuite employees before writing. If the employee does not exist, ml-connector creates a new employee record in NetSuite with the name, job code, organizational unit, and other key attributes mapped from Dayforce. If the employee already exists, ml-connector updates the fields that changed since the last sync.

How often does the integration sync, and what data does it read from Dayforce?

ml-connector polls Dayforce once per day using filterUpdateDateRangeMin and filterUpdateDateRangeMax query parameters to retrieve only employee, organizational unit, and position records modified since the previous sync. This reduces API volume and keeps the sync window focused on active changes. No data flows back from NetSuite to Dayforce.

Oracle NetSuiteDayforce

Oracle NetSuite and Dayforce integration

Oracle NetSuite manages your general ledger and financial consolidations. Dayforce runs your payroll and workforce planning. Connecting them keeps your employee roster and organizational structure in sync between systems, so every payroll period's labor cost allocations in NetSuite land on valid employees and departments. ml-connector polls Dayforce daily for employee and position changes, maps them to NetSuite dimensions, and ensures that headcount and cost center assignments stay aligned throughout the payroll cycle.

How Oracle NetSuite works

Oracle NetSuite exposes vendors, invoices, purchase orders, GL accounts, cost centers, employees, departments, locations, and items through the SuiteTalk REST API with a base URL per account. Authentication uses OAuth 2.0 Client Credentials (M2M with certificate, recommended) or Token-Based Authentication with static credentials. SuiteTalk supports both Event Subscriptions (push webhooks for certain record types like sales orders and invoices) and SuiteQL (a SQL-like query language for bulk and historical reads). OAuth tokens are valid for 60 minutes and OAuth M2M flows do not provide refresh tokens, requiring a fresh token request on each expiry.

How Dayforce works

Dayforce exposes employees, organizational units, jobs, positions, pay summaries, and employee balance periods through a client-specific REST API endpoint that must be refreshed at least once per day. Authentication uses OAuth 2.0 Resource Owner Password Credentials (ROPC) with a username, password, company ID, and client ID, returning a Bearer JWT valid for 3600 seconds (1 hour). Dayforce supports no native outbound webhooks; all data reads are polls using filterUpdateDateRangeMin and filterUpdateDateRangeMax query parameters to fetch records changed within a sync window. Scopes are role-based and governed by the integration user's permissions in Dayforce admin, not by OAuth scope parameters.

What moves between them

The main data flow runs from Dayforce into Oracle NetSuite. ml-connector polls Dayforce daily for employee, job, and organizational unit records, using date-range filters to fetch only records created or updated since the last sync. Each employee record is mapped to a NetSuite employee dimension, and organizational units are mapped to NetSuite departments or locations. Position and job-code changes in Dayforce are reflected in the corresponding NetSuite employee or cost center records. No data flows back from NetSuite to Dayforce; Dayforce remains the source of truth for workforce and payroll attributes.

How ml-connector handles it

ml-connector stores Dayforce and Oracle NetSuite credentials encrypted and handles OAuth token refresh for both systems. Dayforce OAuth tokens expire hourly and must be re-requested before expiry; ml-connector tracks token expiry and refreshes proactively. On the NetSuite side, M2M OAuth tokens are also valid for 60 minutes and do not provide a refresh token, so ml-connector requests a new token each time one expires. Because Dayforce supports only polling (not webhooks), ml-connector runs on a daily schedule and retrieves employee and organizational unit records modified since the previous sync using Dayforce's date-range filters. Each employee record is validated against existing NetSuite employees and dimensions, and new employees or departments are created or updated in NetSuite as needed. If a Dayforce API call returns a 401, ml-connector refreshes the OAuth token and retries. Rate limits and transient errors trigger exponential backoff with jitter. Every record is logged with full audit trail, so failed syncs can be replayed once the underlying issue is resolved.

A real-world example

A professional services firm uses Oracle NetSuite for finance and resource management and Dayforce for payroll, time tracking, and benefits. Before the integration, the operations team manually updated employee records and cost center assignments in NetSuite each quarter when the org structure changed or new hires onboarded, and discrepancies between Dayforce headcount and NetSuite employee counts created confusion during month-end close and budgeting cycles. With Dayforce and NetSuite connected, employee and organizational changes flow into NetSuite automatically every day, so the finance team sees current headcount and valid cost center assignments immediately. Payroll GL postings in NetSuite now always reference valid employee records, and staffing changes no longer require separate manual updates.

What you can do

Sync employee records from Dayforce into Oracle NetSuite daily, keeping headcount and personnel data in sync.
Map Dayforce organizational units, departments, and jobs to NetSuite cost centers and employee dimensions so payroll allocations land on valid accounts.
Refresh OAuth tokens for both systems before expiry, handling Dayforce 1-hour token refresh and Oracle NetSuite 60-minute M2M token expiry.
Poll Dayforce using date-range filters to fetch only changed records, reducing API calls and keeping sync windows focused.
Maintain a full audit trail on every employee and organizational unit sync, with replay capability if a downstream NetSuite write fails.

Questions

How does ml-connector handle OAuth token expiry in both systems?: Dayforce OAuth tokens expire after 3600 seconds (1 hour) and Oracle NetSuite M2M tokens expire after 60 minutes. Both systems do not provide refresh tokens in the M2M or ROPC flows, so ml-connector pre-emptively refreshes each token before expiry and caches it for the next request. If a call returns 401, ml-connector immediately refreshes the token and retries the request.
What happens if an employee record exists in Dayforce but not yet in Oracle NetSuite?: ml-connector checks each Dayforce employee against existing NetSuite employees before writing. If the employee does not exist, ml-connector creates a new employee record in NetSuite with the name, job code, organizational unit, and other key attributes mapped from Dayforce. If the employee already exists, ml-connector updates the fields that changed since the last sync.
How often does the integration sync, and what data does it read from Dayforce?: ml-connector polls Dayforce once per day using filterUpdateDateRangeMin and filterUpdateDateRangeMax query parameters to retrieve only employee, organizational unit, and position records modified since the previous sync. This reduces API volume and keeps the sync window focused on active changes. No data flows back from NetSuite to Dayforce.

Connect Oracle NetSuite and Dayforce

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started