ADP Workforce Now (via Apideck)

Access ADP Workforce Now through Apideck's HRIS unified API — one of 58 HRIS connectors that share the same method surface. Code you write here ports to BambooHR, Workday, Deel and 54 other HRIS connectors by changing a single serviceId string. Apideck handles auth, pagination, rate limiting, and retries so you don't write per-tenant ADP Workforce Now plumbing.

Beta connector. ADP Workforce Now is currently in beta on Apideck. Expect partial resource coverage and occasional mapping gaps. Always verify coverage (see below) and fall back to the Proxy API for unsupported operations.

Quick facts

• Apideck serviceId: adp-workforce-now
• Unified API: HRIS
• Auth type: oauth2
• Status: beta
• Apideck setup guide: Connection guide
• Gotchas: page
• ADP Workforce Now docs: https://developers.adp.com
• Homepage: https://www.adp.com/what-we-offer/products/adp-workforce-now.aspx

At a glance

• Implementation difficulty: highly complex — Custom Auth + Multi-Step Per-Consumer Setup
• Vendor partnership required: no — The ADP Marketplace Partner Program is a separate route that adds a sandbox and partner API access under a partner agreement; API Central needs no partnership.
• Apideck-managed credentials: not available — Each consumer provisions their own ADP credentials and certificate.
• Account type required: ADP Workforce Now or Workforce Now Next Generation, ADP's US and Canada product, with ADP API Central purchased.
• Consumer access level: An ADP administrator who can purchase the add-on, create a project, set Workforce Now permissions and generate a certificate.
• Sandbox: not available — A test instance exists only inside ADP's Marketplace Partner enrollment, which this connection model does not use.
• Costs: Paid by the consumer: ADP bills API Central monthly by employee count on their own ADP invoice; prices are shown after signing in. No free trial.
• Rate limits: 120 requests/minute per API Central project and a maximum of 10 concurrent requests; ADP returns HTTP 429 beyond either limit.
• Authentication: Client credentials over mutual TLS, not a user-consent flow. ADP requires an X.509 client certificate on every call, plus Client ID and Secret.
• Webhooks: Virtual webhooks (Apideck polls for employee created, updated and terminated events)

Important to know:

• Credentials only exist once the consumer buys ADP API Central, which ADP publishes on its US storefront only. Workforce Now is ADP's US and Canada product; elsewhere use the ADP iHCM connector instead. Every consumer meets a purchase decision inside your onboarding flow.
• The API Central project must explicitly include the Workers API. A project created with only the intuitive Employee Demographic Data use case returns 403 Invalid Scope on the worker list, so confirm the project covers it before treating the connection as broken.
• The client certificate expires two years after issuance, and the connection stops working the moment it lapses. That is a dated, per-connection failure that lands long after the build is finished.
• You cannot de-risk this build before a consumer commits: your first end-to-end test necessarily runs against that consumer's live Workforce Now tenant.

Facts synced from Apideck's connector metadata API — GET /connector/connectors/adp-workforce-now (overview field) is the live, authoritative version.

When to use this skill

Activate this skill when the user explicitly wants to work with ADP Workforce Now — for example, "sync employees in ADP Workforce Now" or "list time-off requests in ADP Workforce Now". This skill teaches the agent:

1. Which Apideck unified API covers ADP Workforce Now (HRIS)
2. The correct serviceId to pass on every call (adp-workforce-now)
3. ADP Workforce Now-specific auth and coverage caveats

For the full method surface (parameters, pagination, filtering), use your language SDK skill:

• apideck-node, apideck-python, apideck-dotnet, apideck-java, apideck-go, apideck-php, or apideck-rest

For the raw OpenAPI spec:

• HRIS: https://specs.apideck.com/hris.yml · API Explorer

Minimal example (TypeScript)

import { Apideck } from "@apideck/unify";

const apideck = new Apideck({
  apiKey: process.env.APIDECK_API_KEY,
  appId: process.env.APIDECK_APP_ID,
  consumerId: "your-consumer-id",
});

// List employees in ADP Workforce Now
const { data } = await apideck.hris.employees.list({
  serviceId: "adp-workforce-now",
});

Portable across 58 HRIS connectors

The Apideck HRIS unified API exposes the same methods for every connector in its catalog. Switching from ADP Workforce Now to another HRIS connector is a one-string change — no rewrite, no new SDK.

// Today — ADP Workforce Now
await apideck.hris.employees.list({ serviceId: "adp-workforce-now" });

// Tomorrow — same code, different connector
await apideck.hris.employees.list({ serviceId: "bamboohr" });
await apideck.hris.employees.list({ serviceId: "workday" });

This is the compounding advantage of using Apideck over integrating ADP Workforce Now directly: code against the unified HRIS API once, gain access to every connector in it. New connectors Apideck adds become available to your app without code changes.

Authentication

• Type: OAuth 2.0
• Managed by: Apideck Vault — Apideck handles the full OAuth dance (authorization code flow, token exchange, refresh). Never ask the user for API keys or tokens directly.
• User setup: Users authorize via the Vault modal. Connection state progresses available → added → authorized → callable.
• Token refresh: automatic. Expired tokens are refreshed transparently on the next API call.

Setup guide: Apideck publishes a step-by-step guide for registering an OAuth app / configuring credentials for ADP Workforce Now — see https://developers.apideck.com/connectors/adp-workforce-now/docs/consumer+connection. Use that as the authoritative source when walking users through connection setup.

See apideck-best-practices for Vault setup, connection lifecycle, and handling re-auth flows.

Verifying coverage

Not every HRIS operation is supported by every connector. Always verify before assuming a method works:

curl 'https://unify.apideck.com/connector/connectors/adp-workforce-now' \
  -H "Authorization: Bearer ${APIDECK_API_KEY}" \
  -H "x-apideck-app-id: ${APIDECK_APP_ID}"

See apideck-connector-coverage for patterns around UnsupportedOperationError and connector-specific fallbacks.

Escape hatch: Proxy API

When an endpoint isn't covered by the HRIS unified API, use Apideck's Proxy to call ADP Workforce Now directly — Apideck injects auth headers and handles token refresh. Set x-apideck-downstream-url to the target endpoint on ADP Workforce Now's own API:

curl 'https://unify.apideck.com/proxy' \
  -H "Authorization: Bearer ${APIDECK_API_KEY}" \
  -H "x-apideck-app-id: ${APIDECK_APP_ID}" \
  -H "x-apideck-consumer-id: ${CONSUMER_ID}" \
  -H "x-apideck-service-id: adp-workforce-now" \
  -H "x-apideck-downstream-url: <target endpoint on ADP Workforce Now>" \
  -H "x-apideck-downstream-method: GET"

See ADP Workforce Now's API docs for available endpoints.

Sibling connectors

Other HRIS connectors that share this unified API surface (same method signatures, just change serviceId):

bamboohr, workday, deel (beta), hibob, personio, adp-ihcm (beta), paychex (beta), paylocity, and 49 more.

See also

• Apideck connection guide for ADP Workforce Now
• HRIS OpenAPI spec · API Explorer
• apideck-connector-coverage — programmatic coverage checks
• apideck-best-practices — architecture, Vault, pagination, error handling
• apideck-node — TypeScript / Node SDK patterns
• ADP Workforce Now official docs