ADP Workforce Now

Visualize ADP Workforce Now workers and departments in the JupiterOne graph, map the employee reporting hierarchy, correlate workers to their user accounts, and monitor changes through queries and alerts.

Installation

Installation

Prerequisites

• An ADP Workforce Now account with access to the ADP HR APIs.
• ADP-issued API credentials for a registered API application: an OAuth Client ID and Client Secret, plus a client SSL certificate and its private key (PEM).
• Access to JupiterOne with permission to configure integrations.

Obtain ADP API credentials

The integration authenticates to the ADP Workforce Now APIs using OAuth 2.0 (client credentials) together with mutual TLS — every request presents a client SSL certificate in addition to a bearer token. ADP issues the required credentials to a registered API application:

• a Client ID and Client Secret (the OAuth client credentials), and
• a client SSL certificate and its private key (PEM), registered with ADP for the mutual-TLS handshake.

These credentials are provisioned by ADP through the ADP developer program. Work with your ADP representative or ADP's developer documentation to register an API application, obtain the Client ID and Client Secret, and generate the client certificate and key. The application must be granted access to the worker and department data this integration reads — see the Authorization tab for the specific permissions and endpoints.

The integration issues read-only requests.

Configure the integration in JupiterOne

To install the ADP Workforce Now integration in JupiterOne, navigate to the Integrations tab and select ADP Workforce Now. Click New Instance to begin configuring your integration.

Creating an ADP Workforce Now instance requires the following:

• The Account Name used to identify the ADP Workforce Now account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.
• Description to assist in identifying the integration instance, if desired.
• Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

Authentication fields

Field	Required	Description
Client ID	Yes	The ADP OAuth client ID for your registered API application.
Client Secret	Yes	The ADP OAuth client secret for your registered API application.
Client Certificate (PEM)	Yes	The PEM-encoded client SSL certificate registered with ADP for mutual TLS. Paste the entire file contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
Client Key (PEM)	Yes	The PEM-encoded private key paired with the client certificate, for mutual TLS. Paste the entire file contents, including the -----BEGIN ... PRIVATE KEY----- header and footer lines.

Advanced

These fields are optional and only needed to override the default ADP endpoints.

Field	Default	Description
API Base URL	https://api.adp.com	Override the ADP API base URL. Leave blank to use the default.
OAuth Token URL	https://accounts.adp.com/auth/oauth/v2/token	Override the ADP OAuth token endpoint. Leave blank to use the default.

Click Create once all values are provided to finalize the integration.

Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Authorization

Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

• Organization/Department Read
• Worker Read

Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

• /hr/v1/validation-tables/departments
• /hr/v2/workers

Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

• https://developers.adp.com/apis/api-explorer/hcm-offrg-wfn

Data Model

Entities

The following entities are created:

Resources	Entity _type	Entity _class
Account	adp_wfn_account	Account
Department	adp_wfn_department	Group
Worker	adp_wfn_worker	User

Relationships

The following relationships are created:

Source Entity _type	Relationship _class	Target Entity _type
adp_wfn_department	HAS	adp_wfn_worker
adp_wfn_worker	MANAGES	adp_wfn_worker

Mapped Relationships

The following mapped relationships are created:

Source Entity _type	Relationship _class	Target Entity _type	Direction
adp_wfn_worker	IS	User	FORWARD

Types

Adp Wfn Account

adp_wfn_account inherits from Account

Property	Type	Description	Specifications
clientId *	string	The ADP OAuth client identifier used to authenticate this integration instance.

---

Adp Wfn Department

adp_wfn_department inherits from Group

Property	Type	Description	Specifications
accountId *	string	The ADP client (tenant) id this department belongs to (ADR-015 flat account reference).
code *	string	The ADP department code (unique within the client).

---

Adp Wfn Worker

adp_wfn_worker inherits from User

Property	Type	Description	Specifications
accountId *	string	The ADP client (tenant) id this worker belongs to (ADR-015 flat account reference).
associateOID *	string	The ADP Associate OID — globally unique worker identifier across all of ADP.
businessEmail *	string | null	The worker business (work) email address.
costCenterName *	string | null	The cost-center name of the primary work assignment.
departmentCode *	string | null	The home department code of the primary work assignment; the carrier the department→worker relationship builder resolves against (ADR-004/005).
departmentName *	string | null	The home department name of the primary work assignment (flat, for filtering).
hiredOn *	number | null	Epoch milliseconds of the original hire date.
isManager *	boolean | null	Whether the worker holds a management position (from the primary work assignment managementPositionIndicator).
jobCode *	string | null	The job code of the primary work assignment.
jobTitle *	string | null	The business/job title of the primary work assignment.
managerAssociateOID *	string | null	The ADP Associate OID of the worker's manager (from reportsTo). The manager hierarchy itself is expressed by the MANAGES relationship (ADR-005); this is the graph-key basis that relationship builder resolves against.
positionId *	string | null	The position id of the primary work assignment.
rehiredOn *	number | null	Epoch milliseconds of the most recent rehire date.
terminatedOn *	number | null	Epoch milliseconds of the termination date, if terminated.
wageLawCoverage *	string | null	The wage-law coverage code of the primary work assignment (e.g. exempt/non-exempt).

---

Release Notes