How does ml-connector handle Dayforce's one-hour token expiry?

Dayforce OAuth tokens expire in one hour and refresh tokens are not issued to service applications. ml-connector requests a new bearer token before each sync cycle using the stored username and password, so a sync running on a 6-hour schedule will always have a fresh token. If a token expires mid-sync, ml-connector detects the 401 response, requests a new token, and retries the call.

Can payroll GL postings flow from Dayforce into Visma journal entries?

Dayforce does not expose a standalone GL account endpoint or native finance module. However, pay summaries and cost allocations configured in Dayforce can be read during sync and used to populate Visma journal entries mapped to your chart of accounts, bridging payroll and finance.

VismaDayforce

Visma and Dayforce integration

Visma.net ERP handles your financial records, GL accounts, and cost dimensions. Dayforce manages your payroll, employees, and benefits. Connecting the two keeps your workforce and your ledger in sync. Employee hires and terminations in Dayforce flow into Visma's employee dimension and organizational structure, so your headcount is always current in the ERP, and payroll cost allocations land on the correct GL accounts without manual re-keying. ml-connector bridges the gap between Dayforce's password-based OAuth and Visma's client-credentials model, manages the short token lifecycles on both sides, and moves the data on a schedule you control.

How Visma works

Visma.net ERP exposes suppliers, purchase orders, invoices, GL accounts, dimensions, employee records, and journal transactions through REST APIs over HTTPS. Authentication uses OAuth 2.0 with client_credentials grant flow, requiring client_id, client_secret, and tenant_id sent to Visma Connect's token endpoint. All subsequent API calls must include the ipp-company-id header to anchor requests to the correct company. Visma supports webhooks for near-real-time notifications, but webhooks are sent once only with no automatic retry, and webhook enablement must be explicitly configured at the company level. For reliable data sync, polling via delta queries on the lastModifiedDateTime field is the recommended approach.

How Dayforce works

Dayforce is a cloud HR and payroll platform that exposes employees, organizational units, jobs, positions, and pay summaries through REST APIs over HTTPS. Authentication uses OAuth 2.0 with the Resource Owner Password Credentials grant, where the integration user's Dayforce username and password are exchanged for a bearer JWT token that expires in exactly one hour. Dayforce requires the integration user to have explicit HCM Anywhere API permissions granted in the Dayforce admin console. Dayforce offers no native vendor, invoice, or AP modules, and no outbound webhooks. Instead, polling is the only supported sync method, using filterUpdateDateRangeMin and filterUpdateDateRangeMax query parameters to fetch only records changed since the last sync cycle. The Dayforce API client URL is client-specific and must be refreshed at least once per day to avoid redirect overhead.

What moves between them

Employee records and organizational unit hierarchies flow from Dayforce into Visma. On each sync cycle, ml-connector queries Dayforce for employees and org units changed since the last poll using date-range filters, then upserts those records into Visma's employee dimension and organizational structure. Pay summary data remains in Dayforce but can be read and used to populate cost center assignments in Visma GL postings. The direction is one-way, from Dayforce (HR source) into Visma (ERP sink), running on a cadence you define.

How ml-connector handles it

ml-connector stores Dayforce credentials (username and password) encrypted and requests a fresh bearer token before each sync, since Dayforce tokens expire in one hour and refresh tokens are not issued. For Visma, it stores the client_id, client_secret, and tenant_id encrypted, requests a bearer token at startup and on 401 responses, and prepends the ipp-company-id header to every Visma call to keep the company context correct. On the Dayforce side, it uses filterUpdateDateRangeMin and filterUpdateDateRangeMax query parameters to perform a delta pull, fetching only employees and org units modified since the prior sync. Each record is mapped to the Visma employee and dimension APIs, with org unit hierarchies flattened or nested according to how your Visma cost center hierarchy is structured. If a Dayforce user lacks the required HCM Anywhere API permission in the Dayforce admin console, the token request will succeed but the API call will fail; ml-connector logs this clearly so you can grant permission and retry. Every record carries a full audit trail, and failed syncs can be replayed without duplication.

A real-world example

A Nordic manufacturing company runs Visma.net ERP for accounting and project costing and uses Dayforce for payroll across multiple locations. In the prior state, the finance team manually exported the weekly employee list and org structure from Dayforce and re-entered changes into Visma's employee and dimension tables, a repetitive task that introduced typos and delays during hiring peaks. With Dayforce and Visma connected, each time an employee is hired, terminated, or transferred in Dayforce, the change flows into Visma automatically on the next sync cycle, so the ERP always reflects current org structure. Cost allocations configured in Dayforce are then matched to Visma GL accounts during journal posting, eliminating the manual rekey.

What you can do

Automatically sync Dayforce employees and organizational unit hierarchies into Visma's employee dimension and cost center structure.
Handle Dayforce's one-hour OAuth token expiry by refreshing the bearer token before each sync cycle.
Apply delta queries on Dayforce to fetch only changed records since the last sync, reducing API calls and sync time.
Map Dayforce job titles, org units, and cost allocations to Visma GL accounts and dimensions for accurate payroll expense posting.
Maintain a complete audit trail of every employee record synced, with support for replay on failure.

Questions

How does ml-connector handle Dayforce's one-hour token expiry?: Dayforce OAuth tokens expire in one hour and refresh tokens are not issued to service applications. ml-connector requests a new bearer token before each sync cycle using the stored username and password, so a sync running on a 6-hour schedule will always have a fresh token. If a token expires mid-sync, ml-connector detects the 401 response, requests a new token, and retries the call.
What happens if a Dayforce user lacks the required HCM Anywhere API permissions?: The OAuth token request will still succeed, but API calls will fail with a 403 Forbidden response. ml-connector logs the permission error clearly, allowing you to grant HCM Anywhere API access to the integration user in the Dayforce admin console and retry the sync without code changes.
Can payroll GL postings flow from Dayforce into Visma journal entries?: Dayforce does not expose a standalone GL account endpoint or native finance module. However, pay summaries and cost allocations configured in Dayforce can be read during sync and used to populate Visma journal entries mapped to your chart of accounts, bridging payroll and finance.

Connect Visma and Dayforce

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started