Oracle Fusion Cloud ERP and UKG integration

What moves between them

Payroll GL journals flow from UKG into Oracle Fusion Cloud ERP after each pay run. Employee records, cost centers, and departments are synced in both directions so that compensation allocations land on valid Fusion GL accounts and cost centers. Because Oracle Fusion Cloud ERP has no direct webhooks without middleware, ml-connector polls UKG for new payroll GL documents and employee changes on a schedule tied to your payroll calendar, typically every 5 to 15 minutes, then posts the journals into Fusion. Reference data such as cost centers and departments are aligned first, ensuring every payroll line references a valid Fusion GL account and cost center.

How ml-connector handles it

ml-connector stores both credential sets encrypted and handles the two different OAuth implementations: Oracle Fusion Cloud ERP's Client Credentials flow against OCI Identity Domain, and UKG's Client Credentials flow against the UKG identity endpoint (US or Canada region). ml-connector polls UKG's thirdpartypay endpoint for GL posting data and the changed-employees delta endpoint for headcount changes, then filters by date to find records newer than the last sync. Fusion requires the full pod URL and tenant ID for API calls; ml-connector accepts both at setup time. Cost centers from UKG are mapped to Fusion's GL account combinations, which typically require account number, department code, and location code. Each payroll journal line is validated against Fusion's chart of accounts before posting. Because UKG webhook events have 14-day retention, ml-connector also supports secondary polling to ensure no payroll GL documents are missed, and it tracks sync timestamps to avoid duplicate posts. Fusion's PATCH operations on journal lines update header attributes only, so journal creation happens via POST with the full set of GL account combinations, cost centers, and amounts.

A real-world example

A mid-sized services firm runs Oracle Fusion Cloud ERP for general ledger, accounts payable, and financial reporting, and uses UKG for payroll processing and employee records across four offices. Before integration, the accounting team exported payroll GL journals from UKG after each pay period and re-entered the labor totals into Fusion by hand, allocating them to the correct cost centers for each office, then compared Fusion headcount totals to UKG to catch mismatches during month-end close. With Oracle Fusion Cloud ERP and UKG connected, each payroll run's GL journal flows directly into Fusion and allocates automatically to the correct cost centers, and employee additions and separations in UKG immediately update Fusion so the two systems stay aligned. Month-end close begins with labor accounts already reconciled and headcount matching.

What you can do

• •Post UKG payroll GL journals into Oracle Fusion Cloud ERP's general ledger after every pay cycle, allocated to the correct cost centers and GL account combinations.
• •Keep Oracle Fusion Cloud ERP employee records and headcount in sync with UKG hires, terminations, rehires, and status changes.
• •Map UKG cost centers, departments, and pay groups to Oracle Fusion Cloud ERP GL dimensions and account combinations so payroll allocations land on valid accounts.
• •Authenticate to both systems using OAuth 2.0 with one-hour token refresh, and poll UKG's delta endpoints and GL posting services on a payroll-aligned schedule.
• •Maintain a full audit trail on every payroll journal posted, with support for secondary polling to ensure zero payroll records are missed.

Questions

How do you bridge OAuth 2.0 between Oracle Fusion Cloud ERP and UKG when they use different identity endpoints?

ml-connector maintains separate OAuth flows for each system: Oracle Fusion Cloud ERP uses Client Credentials against your OCI Identity Domain, and UKG uses Client Credentials against the UKG signin endpoint in your region (US or Canada). Both tokens expire in one hour, so ml-connector refreshes them on every request and caches the current bearer token to avoid redundant auth calls.

Does ml-connector handle the two-pass employee fetch that UKG requires?

Yes. UKG's /personnel/v1/employee-ids endpoint returns only internal UUIDs, so ml-connector makes a second call per employee to /personnel/v1/employees/{id} to fetch the full employee profile, compensation, and cost center. This is batched and cached so the cost of the extra round-trip is absorbed.

What happens if Oracle Fusion Cloud ERP and UKG are out of sync, and how do you handle GL account mismatches?

ml-connector validates every cost center and GL account combination from UKG against Fusion's chart of accounts before posting any journal. If a cost center or account does not exist in Fusion, ml-connector stops and surfaces the error with full context so you can update Fusion setup and replay the batch. Reference data alignment (cost centers, departments, job codes) runs first and is logged, so you know which mappings are active before any payroll GL posts.