See what the UKG Ready integration can do →

This article lists every UKG Ready endpoint the iPaaS.com integration calls. Use it to check whether a UKG Ready deprecation notice affects the integration, to configure firewall allow-lists, to confirm the permissions a service account needs, and to interpret entries in the error log.

UKG Ready is hosted per environment, so the address is specific to each customer and each environment rather than a single shared host.

The {Instance Identifier} is the environment-specific part of the address — for example service5. A test environment and a production environment have different instance identifiers, so they have different addresses.

The integration calls the UKG Ready REST API over HTTPS, exchanging JSON.

Every request carries a bearer token obtained from the authorization endpoint below.

Base URL. [Base URL] throughout this article means the API Url value configured on the iPaaS.com subscription — the environment address from Portal Info above.

Standard resource path. Most calls are addressed relative to a specific UKG Ready company, and the integration composes that path automatically from the Company ID configured on the subscription:

The pipe character before the company identifier is part of the UKG Ready path convention and is not a typographical error.

Two calls sit outside that pattern and are addressed directly under the base URL — the authorization endpoint, and the employee lookup by external identifier. Both are noted where they appear below.

Retrieves the full employee list. Used by the first run of the employee polling event, which loads every employee before later runs switch to changed-only retrieval. The {filter} segment is optional and is supplied as a query string when the caller narrows the result.

Retrieves employees changed since a given date. Used by every polling run after the first.

Retrieves a single employee by their UKG Ready identifier. This is the call behind every employee transfer, whether triggered by a poll or run from the Manual Sync page. The employee's primary address is part of the response, so no separate address call is made.

Resolves a UKG Ready employee account identifier from the beginning of an external identifier. Available to subscribers as a conversion function when building a Dynamic Formula mapping.

This call is addressed directly under the base URL and uses the v1 path — it does not carry the company segment used by the endpoints above.

Retrieves the time entries already recorded for one employee across a date range. The integration calls this before writing a timesheet, so that incoming entries can be merged with what UKG Ready already holds, and again afterwards to confirm what was recorded.

Writes a set of time entries for one employee and period. This single call covers both new and updated entries — the integration sends the merged set rather than issuing one request per entry.

This endpoint returns HTTP 200 whether or not the entries were accepted, reporting the outcome for each entry inside the response body. The integration reads that body and raises any problems it reports.

Removes a single time entry. Used when a timesheet deletion is propagated from iPaaS.com.

Exchanges the subscription's credentials for a bearer token, which is then sent on every other call. This endpoint is addressed directly under the base URL and does not carry the company segment.

The request sends the API User, API Password, and Company ID together, with the API Key supplied as a request header. The response returns a token and its lifetime — one hour by default. The integration signs in as needed rather than holding a session open, so a credential change takes effect on the next transfer.

The authorization address does not vary by region beyond the instance identifier already described in Portal Info.