Why is an on-premises agent required to connect SAP ECC?

SAP ECC is on-premises and does not expose a cloud REST API. RFC/BAPI calls must originate from within the customer network and require SAP .NET Connector or Java Connector to be installed on a server with network access to the SAP application server. ml-connector manages the agent configuration and pools RFC connections to avoid exceeding SAP's soft limits on concurrent calls.

What happens if a cost center or GL account does not exist in SAP ECC when a payroll posting arrives?

ml-connector validates all dimensions against SAP ECC before posting. If a cost center is deleted or an account is not active, the record is held in a queue with the reason. Once the missing dimension is recreated in SAP ECC, ml-connector can replay the posting without data loss or manual re-keying. A full audit trail tracks the wait time and the posting timestamp.

How does the integration handle Paychex webhook limitations?

Paychex webhooks are notification-only and provide no delivery guarantees, so ml-connector fetches the full worker or payroll record via REST on every webhook arrival. It does not rely on webhook ordering or deduplication; instead it compares timestamps and GL posting dates to detect and skip duplicates. Paychex access tokens lack a refresh token, so ml-connector refreshes the token proactively before expiry to prevent failed calls.

SAP ECCPaychex

SAP ECC and Paychex integration

SAP ECC runs the general ledger and employee master for most discrete and process manufacturers. Paychex Flex runs payroll and HR. Connecting them keeps payroll GL entries and workforce data in agreement. After each payroll cycle, Paychex GL documents post directly into SAP ECC's general ledger by cost center and account, without re-keying. Worker hires, terminations, and compensation changes in Paychex flow back to SAP ECC employee records, so payroll allocations land on valid cost centers and GL accounts that already exist in the ledger.

How SAP ECC works

SAP ECC exposes general ledger accounts, cost centers, employees, and purchase orders through RFC/BAPI function modules and OData v2 REST APIs. An on-premises agent running SAP .NET Connector or Java Connector originates RFC calls into the SAP application server, while OData calls go over HTTP Basic Auth to the SAP Gateway service at the customer's host address. Write operations require an explicit BAPI_TRANSACTION_COMMIT call, and RFC calls are subject to soft limits around 10-50 concurrent calls before the system raises SYSTEM_FAILURE exceptions. OData services must be activated by the SAP Basis team via transaction SICF before they are available. SAP ECC has no native webhook system, so data is read by polling or by receiving IDocs pushed from the customer's configured outbound port.

How Paychex works

Paychex Flex exposes companies, workers, payroll components, pay periods, and GL postings through REST APIs authenticated with OAuth2 client credentials. Paychex also publishes worker and compensation events through a webhook system with event domains such as WRKR_EMPL and WRKR_DEM; webhook payloads are notification-only, so the full record must be fetched via a separate GET call. Webhooks do not guarantee delivery ordering or deduplication, and Paychex retries every five minutes on a non-2XX response. Access tokens are issued without a refresh token, so they must be proactively refreshed before expiry. Finance and ERP entities such as vendors, invoices, and accounting dimensions are not available in Paychex.

What moves between them

The main flow is Paychex into SAP ECC. After each payroll run, ml-connector reads Paychex GL documents showing labor costs by payroll component and cost center, then posts those totals into SAP ECC's general ledger as journal entries mapped to matching GL accounts. Worker data moves the same direction: hires, terminations, and job changes in Paychex update SAP ECC employee records so payroll allocations land on valid cost centers. Cost centers and GL account mappings are maintained in both systems before payroll GL posting begins, and are synced bidirectionally to prevent posting to invalid or deleted accounts.

How ml-connector handles it

ml-connector runs with two sets of credentials: an on-premises agent configured with SAP NCo or JCo for RFC calls to SAP ECC, and OAuth2 client credentials for Paychex REST calls. On the Paychex side, it obtains an access token via OAuth2 client credentials, then listens to worker and payroll events via webhook. When a webhook arrives, ml-connector fetches the full record from Paychex REST, calculates payroll GL totals, and posts them into SAP ECC using BAPI_ACC_DOCUMENT_POST with an explicit BAPI_TRANSACTION_COMMIT to ensure the journal entry is locked. Cost centers and GL accounts are validated against SAP ECC before posting; if an account is missing or a cost center is inactive, the record is queued for replay after the missing dimension is created. Worker records are posted via RFC_READ_TABLE followed by BAPI_EMPLOYEE_ BAPIs, and the on-premises agent handles character encoding and RFC session management. ml-connector tracks Paychex token expiry and refreshes proactively, retries SAP RFC calls on SYSTEM_FAILURE up to three times with exponential backoff, and maintains a full audit trail so any GL posting can be traced back to the Paychex check it came from.

A real-world example

A mid-sized automotive supply manufacturer runs SAP ECC on-premises for the general ledger and cost accounting, and uses Paychex Flex for payroll across five plants and a shared services center. Before the integration, the cost accounting team ran a weekly manual process: export the payroll register from Paychex, calculate labor cost totals by plant and cost center, and post them into SAP ECC by hand. Month-end close spent three days reconciling labor accounts against the Paychex payroll runs, tracking down missed postings and rounding differences. With SAP ECC and Paychex connected, each payroll cycle's GL documents post into the ledger automatically, allocated to the correct plant cost center. Worker changes in Paychex flow back to SAP ECC so employee rosters stay in sync across both systems. The manual weekly post is eliminated, and month-end close starts with the payroll accounts fully reconciled.

What you can do

Post Paychex payroll GL documents into SAP ECC's general ledger after every pay run, mapped to matching cost centers and GL accounts.
Keep SAP ECC employee master records aligned with Paychex worker hires, terminations, job changes, and compensation updates.
Validate cost centers and GL accounts in SAP ECC before posting, and queue records for replay if a dimension is missing.
Authenticate to Paychex via OAuth2 and to SAP ECC via an on-premises RFC agent, with proactive token refresh and RFC session management.
Listen to Paychex worker and payroll webhooks, fetch full records on demand, and maintain a full audit trail for every GL posting.

Questions

Why is an on-premises agent required to connect SAP ECC?: SAP ECC is on-premises and does not expose a cloud REST API. RFC/BAPI calls must originate from within the customer network and require SAP .NET Connector or Java Connector to be installed on a server with network access to the SAP application server. ml-connector manages the agent configuration and pools RFC connections to avoid exceeding SAP's soft limits on concurrent calls.
What happens if a cost center or GL account does not exist in SAP ECC when a payroll posting arrives?: ml-connector validates all dimensions against SAP ECC before posting. If a cost center is deleted or an account is not active, the record is held in a queue with the reason. Once the missing dimension is recreated in SAP ECC, ml-connector can replay the posting without data loss or manual re-keying. A full audit trail tracks the wait time and the posting timestamp.
How does the integration handle Paychex webhook limitations?: Paychex webhooks are notification-only and provide no delivery guarantees, so ml-connector fetches the full worker or payroll record via REST on every webhook arrival. It does not rely on webhook ordering or deduplication; instead it compares timestamps and GL posting dates to detect and skip duplicates. Paychex access tokens lack a refresh token, so ml-connector refreshes the token proactively before expiry to prevent failed calls.

Connect SAP ECC and Paychex

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started