Visma and UKG integration

What moves between them

Payroll GL documents and employee records flow from UKG into Visma. After each UKG pay run, ml-connector reads the GL payroll export via the thirdpartypay endpoint and posts labor cost journal transactions into Visma's general ledger, mapped to the correct cost centers and Visma dimensions. Employee additions, terminations, and rehires from UKG are synchronized as dimension updates in Visma so that headcount counts match between the two systems. Cost centers are aligned in both directions during initial sync. GL postings are read-only in UKG, so ml-connector never writes financial entries back to the payroll system.

How ml-connector handles it

ml-connector stores both OAuth credential sets encrypted and refreshes tokens automatically on expiry, since UKG tokens expire in 1 hour and Visma does not issue refresh tokens to service accounts. It listens to UKG webhook events for employee and payroll document changes, then pulls the full record details via the respective UKG REST endpoints. Employee dimension records are batched and upserted into Visma with ETag/If-Match optimistic locking to handle concurrent updates. GL payroll journals are mapped to Visma cost centers and GL accounts during transform, validated against Visma's chart of accounts in advance, and posted as journal transactions. Because UKG webhook retention is 14 days and payroll cycles are monthly, ml-connector also polls the /personnel/v1/employees/changed endpoint on schedule as a backup to ensure zero missed records. On HTTP 429 rate-limit responses, ml-connector backs off and retries. Every record carries a full audit trail and can be replayed if a downstream Visma call fails.

A real-world example

A mid-sized manufacturing company with operations in Norway uses Visma.net ERP for accounting and project costing, and UKG for payroll across multiple plants. Before the integration, the finance team received a payroll register from UKG each month, manually entered the labor totals into Visma as journal entries allocated to project and cost center, then spent days reconciling headcount between HR and the labor accounts in the general ledger. With Visma and UKG connected, the payroll GL export flows automatically into Visma each pay period, pre-allocated to the correct cost centers and projects, and employee changes keep the two systems synchronized. Month-end close starts with the labor accounts pre-reconciled and the manual re-keying step completely eliminated.

What you can do

• •Post UKG payroll GL exports into Visma as journal transactions, automatically allocated to cost centers and project dimensions.
• •Keep Visma headcount and organizational dimensions in sync with UKG employee changes, hires, and terminations.
• •Validate GL accounts and cost centers in Visma before posting payroll journals so invalid allocations are caught in advance.
• •Authenticate both systems with OAuth 2.0, handle token expiry automatically, and respect Visma's ETag locking and UKG's rate limits.
• •Monitor UKG webhooks with a secondary polling fallback, so payroll changes are captured even when webhook events are missed or delayed.

Questions

Which direction does data move between Visma and UKG?

The primary flow is UKG into Visma. Payroll GL exports and employee records move from UKG into Visma as journal transactions and dimension updates. Cost centers are synchronized bidirectionally during initial setup so payroll allocations land on valid Visma cost centers. GL postings are read-only in UKG, so ml-connector does not write financial entries back to payroll.

How does ml-connector handle UKG's 1-hour OAuth token expiry?

UKG tokens expire in 1 hour and Visma does not issue refresh tokens to service applications. ml-connector caches the current token and automatically refreshes it when a call returns an auth error or as it approaches expiry. This ensures continuous operation without requiring new login credentials.

Why does ml-connector poll UKG if webhooks are available?

UKG webhook events have a 14-day retention window, but payroll cycles are monthly. ml-connector listens to webhooks for near-real-time updates but also polls the /personnel/v1/employees/changed endpoint on a regular schedule as a backup. This dual approach ensures zero missed records even if a webhook is dropped or delayed.