QAD and SAP SuccessFactors integration

What moves between them

The main flow runs from SAP SuccessFactors into QAD. ml-connector reads employee, job assignment, and org records from Employee Central so QAD reflects current headcount, departments, and the cost center on each role. Reference data such as cost centers and departments is aligned so labor allocations in QAD land on dimensions that match the SuccessFactors foundation objects. SuccessFactors carries no finance documents, so no invoices, purchase orders, or GL entries move on this connection. QAD remains the system of record for finance, and SuccessFactors remains the system of record for HR.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the SAP SuccessFactors side it signs a SAML assertion with your RSA private key, posts it to the token endpoint with the company ID and OAuth client key, and caches the resulting Bearer token, refreshing before the 24-hour expiry rather than per call. It targets the datacenter-specific API host you provide, since SuccessFactors publishes no universal base URL, and a missing Role-Based Permission grant returns 403 rather than 401, which it surfaces clearly. On the QAD side it accepts the full tenant URL per customer and validates entity paths against that instance. Because SuccessFactors event push through Intelligent Services is UI-configured and best-effort, the connector polls on a schedule using a lastModifiedDateTime delta filter, advancing a high-water mark after each batch, and sets $top to 1000 so paged reads do not silently miss records. Concurrency is kept low because the SuccessFactors throttle returns 429 or 503 with no rate-limit headers, so ml-connector backs off with jitter and retries. Cost centers and departments are matched first so every employee and job record maps to a QAD dimension that already exists. Employees are deactivated rather than deleted in SuccessFactors, so the sync follows status changes instead of deletion events. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized contract manufacturer of industrial equipment, roughly 600 employees across three plants, runs QAD Adaptive ERP for production, procurement, and finance, and SAP SuccessFactors Employee Central for HR and org structure. Before the integration, HR maintained departments and cost center assignments in SuccessFactors, while a clerk re-keyed the same structure into QAD whenever a plant reorganized or someone changed roles, and the two drifted apart between updates. With QAD and SAP SuccessFactors connected, employee and job changes flow into QAD on a schedule, and cost centers and departments stay aligned, so labor reporting in QAD reflects the current org without manual re-entry and month-end allocations hit valid dimensions.

What you can do

• •Read employees, job assignments, and org records from SAP SuccessFactors Employee Central into QAD on a schedule.
• •Keep QAD cost centers and departments aligned with the SAP SuccessFactors foundation objects.
• •Authenticate SAP SuccessFactors with OAuth 2.0 SAML Bearer Assertion and QAD with its tenant-specific token.
• •Pull changes with a lastModifiedDateTime delta filter and paged reads sized to avoid missing records.
• •Track employee status changes instead of deletions, with retries and a full audit trail on every record.

Questions

Which direction does data move between QAD and SAP SuccessFactors?

The main flow is SAP SuccessFactors into QAD. Employee, job, and org records move from SuccessFactors Employee Central into QAD, while cost centers and departments are aligned so QAD dimensions match the HR system of record. SuccessFactors holds no invoices, purchase orders, or GL accounts, so no finance documents move on this connection.

How does ml-connector authenticate to SAP SuccessFactors?

SuccessFactors uses OAuth 2.0 SAML Bearer Assertion rather than a plain client ID and secret. ml-connector signs a SAML assertion with your RSA private key, exchanges it at the token endpoint for a Bearer token that lasts up to 24 hours, and refreshes before expiry. Access also depends on Role-Based Permissions for the API user, so a missing grant returns 403 and is surfaced rather than retried blindly.

Does the integration use SuccessFactors webhooks or polling?

It uses polling. SuccessFactors event push through Intelligent Services is configured in the Admin Center UI, has no programmatic subscription API, and offers no delivery guarantees, so it is not reliable as the sole feed. ml-connector pulls on a schedule using a lastModifiedDateTime delta filter and advances a high-water mark after each batch, keeping concurrency low because SuccessFactors throttles with 429 or 503 and provides no rate-limit headers.