UKG Pro HCM Reports-as-a-Service (RaaS)

UKG Pro HCM Reports-as-a-Service is a SOAP-based web service that provides programmatic access to IBM Cognos reports for retrieving HRIS data such as employee, payroll, and benefits information.

Use Cases the Adapter Solves

• Employee Lifecycle Management: Track employee status changes, onboarding, and terminations across your organization by correlating HRIS data with device and application access records.
• Access Governance and Compliance: Identify users with access to systems who are no longer active employees, or verify that user accounts align with current employment status and department assignments.

Asset Types Fetched

• Users

Data Retrieved through the Adapter

Users

• Username, Email Address, Employee ID
• Display Name, First Name, Last Name
• Job Title, Department, Manager Email
• Employee Status

Before You Begin

Required Ports

• TCP port 443 (HTTPS)

Authentication Methods

Username and Password with API Keys

The adapter authenticates to the UKG Pro HCM BiDataService using a combination of username, password, and two API keys (Client Access Key and User Access Key). Authentication occurs via the SOAP LogOn method, which returns a session token (DataContext) used for subsequent API calls.

APIs

Axonius uses the UKG Pro HCM Reports-as-a-Service API. The following SOAP methods are called:

• LogOn - Authenticates and returns a session token (DataContext)
• ExecuteReport - Submits a report for asynchronous execution and returns a ReportKey
• RetrieveReport - Retrieves the report output (polls until report execution completes)

Required Permissions

The following permissions and configuration are required:

UKG Pro HCM Configuration Requirements:

• Service Account or Web User Account - A valid UKG Pro HCM account with API access enabled
• Client Access Key - Obtained from the UKG Pro HCM Service Account administrative page
• User Access Key - Obtained from the UKG Pro HCM Service Account administrative page
• Report Access - The account must have permissions to execute the specified report path in IBM Cognos

Note: The exact permission names should be confirmed with your UKG administrator or UKG support, as the publicly available API documentation does not include detailed permission information.

Supported From Version

Supported from Axonius version 8.0

Connecting the Adapter in Axonius

Navigate to the Adapters page, search for UKG Pro HCM Reports-as-a-Service (RaaS), and click on the adapter tile.

Click Add Connection.

To connect the adapter in Axonius, provide the following parameters:

Required Parameters

1. Host Name or IP Address - Base domain for the UKG Pro BiDataService. Should contain a prefix of http:// or https://. Do not add any specific endpoints after the domain. Example: https://service4.ultipro.com
2. User Name - The username for the UKG Pro HCM account with API access
3. Password - The password for the UKG Pro HCM account
4. Client Access Key - The Client Access Key provided by UKG. Required for BiDataService authentication
5. User Access Key - The User Access Key provided by UKG. Required for BiDataService authentication
6. Report Path - The full path of the RaaS report to execute. Example: /Company Resources/HR/Employees

[Needs a screenshot]

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.
2. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
3. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.
4. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.