SAP ECC and UKG integration

What moves between them

The main flow runs from UKG into SAP ECC. After each payroll run, ml-connector reads UKG's payroll GL export via the /thirdpartypay endpoint and posts the labor cost journals into SAP ECC's general ledger through BAPI_ACC_DOCUMENT_POST, mapped to the matching SAP ECC GL accounts and cost centers. Employee records flow the same direction so SAP ECC employee master reflects UKG hires, terminations, and rehires, pushed through BAPI_EMPLOYEE_GETDATA and BAPI_EMPLOYEE_CHANGE. Cost center alignment runs bidirectional so payroll allocations land on valid SAP ECC dimensions. UKG webhooks can drive near real-time syncs, but ml-connector also supports polling via the delta endpoint for zero-tolerance integrations where webhook 14-day retention is a risk.

How ml-connector handles it

ml-connector stores both credential sets encrypted and manages two separate auth mechanisms: UKG Basic Auth headers + API keys for REST calls, and RFC Basic Auth on the SAP side for BAPI execution through the on-premises agent. On the UKG side, webhooks with HMAC SHA-256 verification trigger immediate syncs, while the delta endpoint /personnel/v1/employees/changed provides a secondary polling layer to catch any missed events within the 14-day webhook retention window. SAP ECC BAPI writes are wrapped in explicit BAPI_TRANSACTION_COMMIT calls so documents leave the locked state, and the REF_DOC_NO field deduplicates GL postings on retry. Cost centers and employee cost allocations are mapped first so every payroll journal line references a GL account and cost center that already exists in SAP ECC. RFC payloads handle character encoding via the on-premises agent, and wide table queries use BBP_RFC_READ_TABLE for SAP ECC systems with classic row-width limits. Every record carries a full audit trail and can be replayed if a downstream BAPI call fails.

A real-world example

A mid-sized manufacturing company runs SAP ECC for production, procurement, and finance across two plants, and uses UKG for payroll and HR across both locations. Before the integration, the finance and HR teams manually reconciled employee records and payroll journals at month-end close: HR would export from UKG, finance would re-enter labor totals into SAP ECC by hand, and differences between the two systems would delay close by two to three days. With SAP ECC and UKG connected, each payroll run's GL export flows into SAP ECC automatically allocated to the correct cost center per plant, employee hires and terminations sync immediately, and the labor accounts in SAP ECC stay synchronized with UKG payroll. Month-end close starts with employee data and payroll balances already aligned, and the manual re-keying and reconciliation step is gone.

What you can do

• •Post UKG payroll GL journals into SAP ECC's general ledger after every pay run, allocated to the correct cost centers and GL accounts.
• •Keep SAP ECC employee master aligned with UKG hires, terminations, and rehires through BAPI calls.
• •Map UKG cost centers and compensation to SAP ECC cost centers and GL dimensions so payroll lands on valid accounts.
• •Support both UKG webhooks for near real-time syncs and polling via the delta endpoint for secondary catch-up where webhook retention is a risk.
• •Handle RFC/BAPI auth via on-premises agents, manage explicit transaction commits and deduplication on payroll GL posts, and track audit logs on every record.

Questions

Which direction does data move between SAP ECC and UKG?

The main flow is UKG into SAP ECC. Payroll GL documents and employee records move from UKG into SAP ECC through BAPI calls, while cost centers and GL account mappings are aligned so payroll allocations land on valid SAP ECC dimensions. SAP ECC employee and ledger writes are committed through explicit BAPI_TRANSACTION_COMMIT calls to prevent locked documents.

Does the integration support both webhooks and polling?

Yes. UKG webhooks with HMAC SHA-256 signatures can drive near real-time syncs, but since webhook retention is 14 days, ml-connector also polls the /personnel/v1/employees/changed delta endpoint as a secondary layer for zero-tolerance integrations. Both mechanisms work together to ensure no employee or payroll GL record is missed.

How does ml-connector handle the on-premises RFC/BAPI layer in SAP ECC?

ml-connector stores RFC Basic Auth credentials encrypted and routes BAPI calls through the customer's on-premises agent running SAP .NET Connector or Java Connector on the SAP ECC network. Character encoding and wide table queries are handled via agent features like BBP_RFC_READ_TABLE, and GL postings include explicit BAPI_TRANSACTION_COMMIT calls and REF_DOC_NO deduplication keys to prevent locked or duplicate documents.