Skip to main content
Connect Paycom to Oleria to use your HR and payroll system as the source of truth for who works for you. Oleria reads your Paycom employees, people, departments, and manager relationships, and imports Paycom’s employee change audit log and new-hire feed as activity, along with the Paycom users who made those changes. It then compares identity provider (IdP) and SaaS access against that worker record, so a leaver who still holds access somewhere else becomes visible. To set it up, you give a Paycom API user access to six read functions, plus three optional functions, and add Oleria’s egress IP addresses to its IP allow-list. You then enter the data center, your client code, and the API user’s SID and token in Oleria. One Oleria connection maps one Paycom client on one data center. This integration is read-only: Oleria doesn’t change anything in Paycom.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from Paycom:
  • Employees - every employee in the Paycom employee directory, of every status except Not hired, with their non-sensitive employee record. Oleria uses them as the worker record that accounts in your other systems are matched against. See Employee details.
    • Terminated, retired, and deceased employees stay in Oleria with their termination date as their end date and last day worked, so you can find access that outlived employment.
    • If an employee was rehired after their termination, Oleria treats them as current: the rehire date is their start date and they have no end date.
    • Pre-hires appear with their future start date, so you can see joiners before their first day.
  • People - the person behind each employee, with their name and personal email, linked to their employee record. Oleria uses it to tie the worker record to the individual.
  • Departments - each department code that appears on at least one employee, named after its Paycom department description. Each employee is linked to their department, which places them in your organization.
  • Manager relationships - each employee’s primary supervisor, used to build your reporting hierarchy.
  • Paycom users seen in the change log - each Paycom user who changed an employee record, identified by their Paycom login. Each change’s activity is linked to the user who made it. Paycom has no API for its users, so this is a partial list. See Known limitations.
  • Activity - Paycom’s audit log of changes to non-sensitive employee fields, such as status, department, position and title, supervisor, location, and hire, rehire, and termination dates. Oleria uses it to track joiner, mover, and leaver events.
    • Each change is linked to the employee it’s about.
    • For organization fields, such as status, department, title, supervisor, location, and employment dates, the activity shows the old and new values. For other fields, such as address, phone, and name changes, it shows only which field changed.
    • If you enable the optional REST-GET EMPLOYEE NEW HIRE function, Oleria also imports an event for each employee added to Paycom, with the date they were added.
    • If you enable the optional sensitive change function, Oleria also imports changes to sensitive fields, such as bank, tax, and Social Security number details. A change to that data is a useful security signal, but its values are personal data, so each activity shows only which field changed, who changed it, and when. Oleria never keeps the old or new values.
    • If you enable the optional custom field change function, Oleria also imports changes to your company’s employee custom fields. Custom fields can hold any data your company chooses, so each activity shows only which custom field changed, who changed it, and when. Oleria never keeps the old or new values.
Oleria refreshes this data on its regular sync schedule.
Paycom is the system of record for the worker, not for application access. Oleria doesn’t read the list of Paycom client users, their permission profiles, or sign-in settings. It knows a Paycom user only from the login recorded on the changes they made. It doesn’t read employees’ compensation, tax, bank, or other sensitive data. The optional sensitive and custom field change logs are the exception, and from them Oleria keeps only which field changed, who changed it, and when. See Known limitations.

​
Employee details

​
Prerequisites

  • Administrator permission on the Oleria workspace.
  • Paycom API access for your company. API access is part of your agreement with Paycom, and your Paycom representative creates the API user once it’s enabled. Ask your representative if you don’t have it yet.
  • A Paycom client admin, or a user whose permission profile includes User Options -> API -> API Setup, to manage the API user.
  • Your Paycom client code, as shown in the Paycom client portal, and the data center that hosts your Paycom data. Your Paycom representative can confirm which data center it is.
Use an API user dedicated to Oleria, not one shared with another integration. Rotating its token or changing its IP allow-list then affects only Oleria.

​
Paycom functions

Paycom has no scopes. Each API user has a list of enabled functions. Oleria uses only these nine, all read-only. The last three are optional: Without REST-GET COMPANY LOCATIONS or REST-GET COMPANY ESTABLISHMENTS, Oleria still connects, and employees sync without their location or company. Without REST-GET EMPLOYEE IDS CHANGES or REST-GET EMPLOYEE CHANGE, Oleria still connects and syncs employees, people, departments, and managers. It doesn’t collect activity or Paycom users, and each sync records which function is missing instead of failing. Without REST-GET EMPLOYEE NEW HIRE, activity has no separate event for each employee added. Without REST-GET EMPLOYEE CHANGE SENSITIVE, activity covers only non-sensitive changes. Without REST-GET EMPLOYEE CUSTOM FIELDS CHANGE, activity has no custom field changes.
Apart from the optional REST-GET EMPLOYEE CHANGE SENSITIVE, don’t enable Paycom’s sensitive functions, such as Employee Sensitive, Rates by Allocation, Effective Rates by Allocation, or Taxes, or any function that creates, changes, or deletes data. Oleria doesn’t use them.

​
Set up the API user in Paycom

1

Open API Setup

In Paycom, go to User Options -> User Access and Security -> API Setup. API Setup lists your company’s API users. Find the API user your Paycom representative created for Oleria, and select Edit User.
2

Add Oleria's egress IP addresses

Under IP Address, add Oleria’s egress IP addresses to the API user’s IP allow-list. Contact support@oleria.com for the current list.Paycom refuses every call from an address that isn’t on the list, so the connection fails until you add them.
3

Enable the functions

Select Manage Enablement and enable the six required functions listed in Paycom functions. To record when employees are added, also enable REST-GET EMPLOYEE NEW HIRE. To collect sensitive field changes, also enable REST-GET EMPLOYEE CHANGE SENSITIVE. To collect custom field changes, also enable REST-GET EMPLOYEE CUSTOM FIELDS CHANGE. Save the API user.
4

Copy the SID and token

Copy the API user’s SID and token. You’ll enter both in Oleria.If you don’t have the current token, select Generate New Token. This replaces the token for everything that uses this API user. The SID stays the same.

​
Connect Paycom to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Paycom.
2

Complete the connection form

Fill in the connection form. All four fields are required:
3

Authenticate

Select Authenticate. Before it saves the integration, Oleria signs in as the API user and checks that it can:
  • read the employee directory, and the directory isn’t empty;
  • read an employee’s record;
  • read company locations and company establishments;
  • read the employee change audit log and the new-hire feed for the last 24 hours. Only when the change audit log can be read does it also check the sensitive and custom field change audit logs.
If Oleria can’t sign in, read the employee directory, or read an employee’s record, it refuses the connection and says why. If only the location, establishment, change, new hire, sensitive change, or custom field functions aren’t enabled, Oleria connects without them. Oleria also connects if Paycom doesn’t answer the custom field change log at all.Find the newly connected Paycom client on the Connected tab of your Oleria Integrations page.
The data center and client code identify the integration. If you later connect the same Paycom client with a different API user, edit the existing integration instead of creating a new one. To connect another Paycom client, or a client on another data center, create a new Paycom integration.

​
Verify the integration

Confirm the Paycom instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. To see more detail about its health, select View Details on the Paycom instance to open the side pane. After the first sync completes, go to Posture -> Access Inventory -> Employees to review the Paycom employees. Oleria shows HR employee records there when Paycom is your employee source of truth. To select it, go to Settings -> Employee Information. In the integration’s Capabilities and operation readiness section, Read users shows Available when the API user has these functions: If one of them isn’t enabled, the row shows Needs permission. The two change functions are on the row because Oleria finds Paycom users in the change audit log. Paycom has no groups or roles to read, so Read groups and Read roles aren’t supported. The optional new hire, sensitive change, and custom field change functions aren’t on a row. They only feed activity.
If you generate a new token in Paycom, edit the integration in Oleria, paste the new Token, and select Update. To keep the stored token, leave Token blank. If you change the SID, you must also enter that API user’s token. The next sync runs with the new credentials.

​
Troubleshooting

  • Paycom rejected the SID/Token, or Oleria’s IP addresses are not on this API user’s allow-list - Paycom answers both problems the same way. Check that Oleria’s egress IP addresses are on the API user’s IP allow-list, then re-enter the SID and token. If you generated a new token, the old one no longer works.
  • The function is not enabled for this API user - the error names the function. Enable it under API Setup -> Edit User -> Manage Enablement, then select Authenticate again, or wait for the next sync.
  • The employee directory returned no employees - the API user can’t see any employees. Ask your Paycom representative to check the API user’s access. Oleria refuses an empty directory, so that a sync never removes your synced workforce.
  • Could not reach the Paycom API for this data center - check that you selected the data center that hosts your Paycom data. If it’s correct, contact support@oleria.com.
  • The data center or client code cannot be changed - these fields identify the integration. Create a new Paycom integration for the other client or data center.
  • Terminated employees don’t appear - Oleria shows leavers only if the API user can see them in the employee directory. If the API user’s view leaves out terminated employees, they disappear from Oleria instead of showing an end date. Ask your Paycom representative to include them.
  • Employees have no location or company - enable REST-GET COMPANY LOCATIONS and REST-GET COMPANY ESTABLISHMENTS. If both are enabled and an employee still has no location, check that their company location has a country in Paycom. Oleria doesn’t sync a location with no country.
  • No activity appears - enable REST-GET EMPLOYEE IDS CHANGES and REST-GET EMPLOYEE CHANGE. Until both are enabled, syncs complete without activity.
  • No employee-added events appear - enable REST-GET EMPLOYEE NEW HIRE under Manage Enablement.
  • No sensitive field changes appear - enable REST-GET EMPLOYEE CHANGE SENSITIVE. If you can’t see it under Manage Enablement, your permission profile needs Access to Sensitive Functions.
  • No custom field changes appear - enable REST-GET EMPLOYEE CUSTOM FIELDS CHANGE. If it’s enabled and custom field changes still don’t appear, Paycom may not answer at the address Oleria reads the log from. See Known limitations, and contact support@oleria.com.
  • A Paycom user doesn’t appear - Oleria finds Paycom users only in the change audit log. A user who hasn’t changed an employee record in the activity Oleria has read doesn’t appear.
  • The sync fails because employees have no employee record - Oleria tolerates a few employees that are removed from Paycom during a sync, up to 1% of your employees (at least five, at most 50). Beyond that, the sync fails instead of syncing a partial workforce. The next sync usually succeeds. If it keeps failing, contact support@oleria.com.
  • The activity sync fails because change rows have no readable time - Oleria skips a change row with no readable change time, up to 1% of the rows it reads at once (at least five, at most 50), and logs it. Beyond that, the activity sync fails instead of syncing partial activity. Contact support@oleria.com.
  • The sync fails with HTTP 429 - the API user reached a Paycom request limit. Oleria retries with a delay, but if Paycom’s daily allowance is used up, ask your Paycom representative to raise the API user’s limit.
After you fix a setting in Paycom, the next sync picks up the missing data.

​
Known limitations

  • Read-only - this integration is read-only. Oleria has no remediation actions for Paycom and never changes employee records.
  • Partial Paycom user list, no groups or roles - Paycom has no API for its client users, permission profiles, MFA, or single sign-on (SSO) settings. Oleria discovers a Paycom user only from the login recorded on a change they made, so the list includes only users who changed an employee record in the activity Oleria has read, from 30 days before you connect onward. A user who only views records doesn’t appear. Paycom doesn’t say whether a user is still active, or give their email, MFA, or SSO settings, so each user has only their login. Oleria doesn’t discover Paycom groups or roles. Your IdP and SaaS integrations supply them.
  • No non-human identities (NHIs) or AI agents - Paycom API users and webhooks are visible only in API Setup, with no API to list them. Paycom has no AI agent API. Oleria doesn’t discover any of them.
  • Flat departments - Paycom department codes have no parent department, so department hierarchy isn’t discovered. Paycom has no department list, so a department with no employees doesn’t appear.
  • Primary supervisor only - Oleria uses each employee’s primary supervisor. Secondary, tertiary, and approval supervisors aren’t used. A supervisor who isn’t among the synced employees isn’t shown as a manager.
  • Activity covers employee record changes and additions - Paycom’s audit logs record changes to employee records, and its new-hire feed records employees added. Paycom has no sign-in, administrator, or security audit log, so none of that appears.
  • Sensitive changes without values - Paycom’s sensitive change log can include the old and new values of fields such as bank, tax, and Social Security number details. Oleria reads it only when you enable the optional function, and keeps only which field changed, who changed it, and when, because the values are personal data.
  • Custom field changes without values - custom fields can hold any data, so from the optional custom field change log Oleria keeps only which custom field changed, who changed it, and when.
  • Custom field change log address - Paycom documents the custom field change log’s endpoint only in the Endpoint Guide inside your Paycom client portal, not in any public Paycom documentation. Oleria reads it at the address that follows Paycom’s other employee change logs. If Paycom answers three employees with not found before it has answered for any, Oleria stops reading custom field changes for the rest of that sync and logs a warning. The rest of the sync isn’t affected.
  • Activity actor - Paycom records the login of the user who made each change, and Oleria links the change to that Paycom user. A change with no login recorded has no actor. The new-hire feed doesn’t say who added the employee, so employee-added events have no actor.
  • Activity history - Oleria reads the change log in 24-hour windows. When you connect, it reads the last 30 days of changes. It never reads changes older than 90 days.
  • API access is a Paycom add-on - Paycom API access must be on your agreement with Paycom before your representative can create the API user.
  • Rate limits - Oleria paces its requests to Paycom at five per second, and retries requests Paycom limits. Paycom documents an allowance of 30,000 calls per day for each endpoint. Oleria reads each employee’s record separately, so a first sync of 10,000 employees takes about 35 minutes. A company with more than 30,000 employees needs a higher limit from Paycom.

​
Contact us

For questions about this integration, contact us at support@oleria.com.