QuickBooks Online and Workday HCM integration

What moves between them

The main flow runs from Workday HCM into QuickBooks Online. After each pay cycle, ml-connector reads Workday GL posting documents and journal entries via SOAP and REST, maps them to QuickBooks Online GL accounts and departments by matching cost center and account codes, and posts the labor cost journals into QuickBooks Online. Employee records sync the same direction so QuickBooks Online headcount reflects Workday hires, terminations, and rehires. The integration polls Workday on a schedule tied to your payroll calendar, and does not write financial entries back to Workday since GL postings are financial records that should not be modified by external systems.

How ml-connector handles it

ml-connector stores both OAuth credential sets and SOAP integration credentials encrypted. On the QuickBooks Online side, it refreshes the OAuth token before expiry and handles refresh token rotation every 24 to 26 hours. On the Workday side, it uses SOAP for full financial and procurement data access, polling on your schedule since Workday has no webhooks. Because QuickBooks Online webhooks only carry entity IDs, ml-connector must fetch full records via GET after each webhook or poll the change data capture endpoint for bulk changes. GL posting documents are mapped to QuickBooks Online accounts and departments first, so every journal line references an account and department that already exists. Employee-to-department associations are validated before posting, and the integration tracks both tokens expiry and refresh windows so neither rotates into an outage. Every record carries a full audit trail with operation type, timestamp, and error detail, and financial journal entries can be replayed if a downstream validation fails.

A real-world example

A mid-sized distribution company runs Workday HCM for payroll and staffing across three regional plants, and uses QuickBooks Online for all GL and AP management. Before the integration, payroll runs every two weeks and the accounting team exported Workday GL documents, remapped them to QuickBooks Online account and cost center codes, and manually posted them as journal entries during their GL close process. With the integration in place, payroll GL postings flow directly into QuickBooks Online GL on the day of payroll, allocated to the correct cost center and plant department. Employee changes sync automatically, so headcount reports in both systems match without reconciliation. The month-end GL close process now starts with labor costs already posted and verified.

What you can do

• •Post Workday payroll GL journals into QuickBooks Online general ledger on a schedule tied to your pay cycle, allocated to the correct GL accounts and departments.
• •Keep QuickBooks Online employee records aligned with Workday hires, terminations, and rehires.
• •Map Workday cost centers to QuickBooks Online GL accounts and departments so payroll allocations land on the correct accounts.
• •Authenticate QuickBooks Online via OAuth 2.0 with automatic refresh token rotation, and Workday via SOAP and REST with ISU credentials.
• •Poll Workday on your payroll schedule with retries, full audit trail, and error replay for every journal entry.

Questions

Which direction does data move between QuickBooks Online and Workday HCM?

The main flow is Workday HCM into QuickBooks Online. Payroll GL journals and employee records move from Workday into QuickBooks Online, while GL accounts and departments are aligned so payroll cost allocations match. QuickBooks Online GL entries are read-only from Workday, so ml-connector does not write financial entries back into payroll.

Why does ml-connector need to fetch full records from QuickBooks Online even though webhooks are enabled?

QuickBooks Online webhook payloads contain only the entity ID and operation type, not the full record. ml-connector must fetch the full record via GET to access the account code, department, and other fields needed to map the entry into Workday GL accounts. Alternatively, ml-connector can poll the 30-day change data capture endpoint to retrieve full record details without individual fetches.

How does the integration handle the different API surfaces in Workday?

ml-connector uses SOAP Web Services for GL accounts, journals, and financial data since REST covers HCM and staffing only. SOAP requires Integration System User credentials and covers full CRUD operations. Both SOAP and REST use long-lived refresh tokens, and ml-connector tracks token expiry and reissues before the token rotates to prevent outages.