Sage 300 and UKG integration

What moves between them

The main data flow is from UKG into Sage 300. After each payroll run, ml-connector reads the GL payroll journal export from UKG, maps each pay class and cost center to the matching Sage 300 GL account and segment, and posts the payroll GL batch into Sage 300's general ledger. Employee master data and cost centers can be synced in both directions to keep Sage 300 organizational records aligned with UKG. Because Sage 300 is pull-only and has no webhooks, ml-connector polls on a schedule tied to your payroll calendar rather than reacting to real-time UKG events.

How ml-connector handles it

ml-connector stores both credential sets encrypted and handles the credential negotiation for each system. For UKG, it supports both HTTP Basic Auth with API keys and OAuth 2.0; if OAuth is configured, it refreshes the token before expiry on each call. For Sage 300, it constructs the Basic Auth header with uppercase credentials and assembles the full instance URL per customer since Sage 300 publishes no shared cloud hostname. It polls UKG's GL payroll journal export and employee endpoints on a schedule tied to your payroll dates, using date filters and delta endpoints to minimize payload size. Each GL line is mapped first to UKG cost centers, then to Sage 300 GL segments and accounts, so the batch posts to valid dimensions. If Sage 300 returns a rejection due to a segment mismatch, ml-connector surfaces the error in the audit trail so you can correct the mapping. UKG OAuth tokens expire in one hour, so ml-connector refreshes proactively before they timeout. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized staffing and professional services firm runs Sage 300 on-premise for accounting and project accounting, and uses UKG for payroll and time tracking across four regional offices. Before the integration, the accounting team pulled UKG payroll registers and GL exports every pay period, manually mapped cost centers and project codes to Sage 300's chart of accounts, and posted labor journals by hand. This delayed month-end close by several days and introduced transcription errors. With Sage 300 and UKG connected, each payroll run's GL journal flows into Sage 300 automatically, allocated to the correct cost center for each region and project code, and the team starts close with payroll already reconciled.

What you can do

• •Post UKG payroll GL journals into Sage 300 automatically after each pay run, mapped to the matching GL accounts and cost centers.
• •Keep Sage 300 headcount and organizational records synchronized with UKG employee hires, terminations, and transfers.
• •Map UKG cost centers and pay classes to Sage 300 GL segments and accounts so payroll posts to the correct dimensions.
• •Authenticate UKG with HTTP Basic Auth plus API keys, or with OAuth 2.0 client credentials with automatic token refresh.
• •Poll on a schedule tied to your payroll calendar, with retries, error tracking, and a full audit trail on every record.

Questions

Which direction does data move between Sage 300 and UKG?

The main flow is UKG into Sage 300. Payroll GL journals and employee records move from UKG into Sage 300, while cost centers can be aligned in both directions. Sage 300 GL accounts and segments are read-only, so ml-connector does not write account master data back to UKG.

How does the integration handle Sage 300's lack of webhooks and cloud hosting?

Sage 300 is deployed on customer infrastructure with no webhooks or change-data-capture capability. ml-connector polls Sage 300 and UKG on a schedule tied to your payroll calendar, using date and timestamp filters to detect new and changed records. This approach avoids placing a dependency on Sage 300's IIS server availability for event delivery.

What credential methods does the integration support for each system?

For Sage 300, ml-connector uses HTTP Basic Auth with uppercase username and password. For UKG, it supports either HTTP Basic Auth with US-CUSTOMER-API-KEY and US-USER-API-KEY headers, or OAuth 2.0 client credentials with automatic one-hour token refresh. You can choose based on your UKG licensing and security policy.