Oracle NetSuite and Paylocity integration

What moves between them

The main flow runs from Paylocity into Oracle NetSuite. Employee records and deduction data from Paylocity are read on a schedule and written into NetSuite as employee records and expense allocations mapped to GL accounts. Work locations in Paylocity are aligned with departments and cost centers in NetSuite so that payroll expenses post to the correct GL account and dimension combination. Employee terminations in Paylocity cascade as status changes in NetSuite. Reference data such as pay grades, earning codes, and deduction types are fetched once during setup and kept in sync so that downstream flows reference valid NetSuite dimensions.

How ml-connector handles it

ml-connector stores both OAuth credential sets encrypted and manages the token lifecycles independently for each system. On the NetSuite side it uses OAuth 2.0 client credentials with the certificate and refreshes the token every hour, since the M2M flow does not return a refresh token. On the Paylocity side it requests a bearer token and caches it for the 3600-second lifetime. Because Paylocity webhook payloads carry identifiers only, ml-connector fetches the full employee and deduction records via API calls when events arrive. Employee changes may fire multiple times per minute on the Paylocity side, so ml-connector deduplicates based on the employee ID and the effective date of the change. Work location and department mapping is validated before every write so that GL account allocations never reference a cost center that does not exist in NetSuite. If a downstream NetSuite write fails, the record is queued for replay with exponential backoff until it succeeds or is marked as a permanent error.

A real-world example

A regional healthcare staffing company runs Oracle NetSuite for accounting and vendor management, and uses Paylocity for payroll, benefits, and time tracking across 15 locations. Before the integration, payroll reports were exported from Paylocity weekly, and the operations team had to manually map deductions and allocate hours to NetSuite departments and GL accounts for cost tracking and month-end reporting. Reconciling payroll accruals with the GL took three days, and reclassifying shifts between departments required re-entry into both systems. With Oracle NetSuite and Paylocity connected, employee assignments and deductions flow automatically, allocated to the correct location-based GL accounts in NetSuite, and month-end reporting is accurate by the first business day of close.

What you can do

• •Sync employee hire, termination, and rehire records from Paylocity to Oracle NetSuite with full name, ID, and status tracking.
• •Map Paylocity work locations to NetSuite departments and cost centers so payroll allocations land on the correct GL accounts.
• •Post deduction and earning records from Paylocity into NetSuite as expense allocations with GL account and department dimensions.
• •Authenticate Paylocity with OAuth 2.0 bearer tokens and NetSuite with OAuth 2.0 client credentials plus certificate.
• •Poll Paylocity on a scheduled cadence, replay failed records, and maintain a full audit trail on every employee and deduction change.

Questions

Which direction does data move between Oracle NetSuite and Paylocity?

The main flow is from Paylocity into Oracle NetSuite. Employee records, deductions, and earnings move from Paylocity into NetSuite as employee records and expense allocations. Work locations and departments are aligned in both directions so that payroll allocations reference valid NetSuite GL accounts. Neither system has vendor or invoice objects that would allow a reverse flow, so the integration is primarily read from Paylocity and write to NetSuite.

How does ml-connector handle the different authentication models on each side?

ml-connector manages two separate OAuth 2.0 flows. For NetSuite, it uses client credentials with a certificate and refreshes the token hourly since the M2M flow does not return a refresh token. For Paylocity, it requests a bearer token and caches it for the 3600-second lifetime. Both credential sets are stored encrypted, and token refresh happens automatically on every API call cycle.

What happens when Paylocity webhooks carry only identifiers and not full records?

ml-connector detects webhook events from Paylocity and uses the employee ID and change type to fetch the full record from the Paylocity API immediately. Since employee changes can fire multiple times per minute, ml-connector deduplicates based on the employee ID and effective date. If a fetch fails, the event is queued for retry.