Connect SAP SuccessFactors

SAP SuccessFactors is an HRIS integration that syncs employee, job, and compensation data to Pave. SAP SuccessFactors supports two connection methods: API and SFTP.

Which method should I use?

• API: Use this method if your SAP SuccessFactors admin can create an API user and register an OAuth2 client application. This provides direct data sync through the SAP SuccessFactors OData API.
• SFTP: Use this method if your organization requires file-based data transfer. SFTP setup requires assistance from Pave's team.

Before you connect

The API method requires several configuration steps in SAP SuccessFactors. Complete all of the following steps before connecting in Pave. If you are using the SFTP method, skip to "Connect SAP SuccessFactors to Pave" below.

Request a public key certificate from Pave

Contact your Pave team to request a public key certificate. You will need this certificate when registering the OAuth2 client application in a later step.

Create a Pave API user

1. In SAP SuccessFactors, go to Admin Center and search for Employee Import.
2. Select Download Template and choose Basic User Data as the object.
3. Open the template and fill in the following columns for the Pave API user:
   • USERID: a user ID for the Pave integration (for example, "pavesfadmin")
   • USERNAME: a username for the user
   • STATUS: set to "active"
   • FIRSTNAME, LASTNAME, EMAIL: the user's details
   • HIRE_DATE: any valid date
   • TIMEZONE, DEFAULT_LOCALE: your organization's timezone and locale
4. Save the file as CSV with UTF-8 encoding.
5. Return to Employee Import in Admin Center. Select Basic User Data as the object and upload your CSV file.
6. Click Validate to check for errors, then click Import to create the user.

Allowlist Pave IP addresses

1. In SAP SuccessFactors, go to API Center and select OData IP Allowlisting.
2. Add the IP addresses provided by your Pave team. Your Pave contact will provide the specific addresses during setup.

Set the API user password to never expire

1. In SAP SuccessFactors, search for Password & Login Policy Settings.
2. Create a new entry for the Pave API user you created.
3. Set the Username to the Pave API user's user ID.
4. Set Maximum password age to -1 (never expires).

Register an OAuth2 client application

1. In SAP SuccessFactors, go to Admin Tools and search for Manage OAuth2 Client Applications.
2. Click Register Client Application.
3. Enter an Application Name (for example, "Pave Connection"), a Description, and an Application URL.
4. In the Bind to Users field, enter the user ID of the Pave API user you created earlier.
5. Upload the certificate body from the public key certificate you received from Pave. Copy only the certificate content between the "BEGIN CERTIFICATE" and "END CERTIFICATE" lines (do not include those lines themselves).
6. Click Save to register the application.
7. Click View on the application you just registered. Copy the API Key shown on this page. You will need it when connecting in Pave.

Connect SAP SuccessFactors to Pave

API method

1. In Pave, go to Connections and find SAP SuccessFactors.
2. Enter your API Key from the OAuth2 client application you registered.
3. Enter your Name ID (the user ID of the Pave API user you created, for example "pavesfadmin").
4. Enter your SAP Company ID. To find this in SAP SuccessFactors, click your profile image in the upper right and select Show Version Information. Your Company ID is listed in the dialog that appears.
5. Click Submit.
6. Go to Connections and verify the SAP SuccessFactors integration shows as connected.

SFTP method

Contact your Pave Customer Success Engineer or contact support at support.pave.com to set up an SFTP-based SAP SuccessFactors connection. Your CSE will configure the file delivery and field mapping.

Troubleshooting

Connection shows in error state The access token may have expired or the OAuth2 client application may no longer be active. Verify that the API user's password is set to never expire and that the OAuth2 client application is still registered in SAP SuccessFactors. Also confirm that Pave's IP addresses are still allowlisted in the API Center. Note: the API user's password should not contain special characters, as SAP SuccessFactors may reject them.

No data appears after connecting Verify that the API user has the correct security permissions to access employee data through the OData API. Check that the user is active and properly bound to the OAuth2 client application.

Data is missing or incomplete The API method syncs data from several SAP SuccessFactors OData endpoints. If specific fields are missing, check that the employee records have the expected data populated in SAP SuccessFactors. For the SFTP method, verify that your report file includes all expected fields and was delivered to the correct location.

Fields that sync

Custom mappings may apply to your account.

API method

• First name, last name, preferred name
• Email
• Employee ID
• Gender
• Job title, department, job code
• City, state, country, zip code
• Manager
• Start date
• Base salary, recurring pay components, non-recurring pay components

SFTP method

Fields depend on your report configuration. Your Pave team will work with you to map the fields in your report to the corresponding Pave fields. Common fields include employee ID, email, name, job title, department, level, location, start date, salary, bonus, and commission.

Additional data

• Compensation history: Supported via the API method. Pave syncs current and historical compensation records from SAP SuccessFactors.
• Custom fields: Supported. For the SFTP method, add custom fields to your report and they will sync automatically. For the API method, contact your Pave team to configure custom field mappings.
• Benefits: Not supported.