Set up a Paycom connector

C1 provides identity governance for Paycom. Integrate your Paycom instance with C1 for unified visibility and governance over user access.

C1 provides identity governance for Paycom. Integrate your Paycom instance with C1 for unified visibility and governance over employee access.

The Paycom connector is read-only: it syncs employees as identities. Paycom’s API exposes no write endpoints for employee accounts or assignments, so the connector does not provision access.

Capabilities

Resource	Sync	Provision
Employees

Employees are synced from the Paycom Employee Directory and enriched with each employee’s master record (work email, manager, position, location, lifecycle dates, and normalized account status).

Gather Paycom credentials

Paycom’s API is gated. You must register your connector’s egress IP addresses with Paycom before credentials are issued, and the endpoints this connector uses must be enabled. Contact your Paycom Specialist or [e-mail] to begin. Sandbox credentials are available from the automation team.

1. Provide the connector’s WAN egress IP address(es) to your Paycom representative for IP allow-listing. Requests from non-listed IPs are rejected with 401 Unauthorized.

2. In Paycom, go to User Options > User Access and Security > API Setup, edit the API user, and under Function Enablement enable the read endpoints the connector uses: Employee Directory and Employee. (Sensitive endpoints are not required and remain disabled.)

3. From the API Setup page, copy the SID (Client ID / username) and generate or copy the Token (Client Secret / password). Note which regional data center (OKC, PHX, or DFW) hosts your tenant.

Configure the Paycom connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Paycom and click Add.

3. Choose how to set up the new Paycom connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the Paycom credentials:

   • Region: your tenant’s data center — OKC, PHX, or DFW.
   • SID (Client ID): the API SID from Paycom’s API Setup page.
   • Token (Client Secret): the API Token from Paycom’s API Setup page.
   • Base URL override (advanced): leave blank for standard tenants; set it only for sandbox or non-standard endpoints.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Paycom connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Paycom connector in your own environment.

1. Create secrets for the Paycom Token.

2. Configure the connector settings:

   • Region: OKC, PHX, or DFW.
   • SID (Client ID): the API SID.
   • Token (Client Secret): the API Token (store as a secret).
3. Ensure the host’s outbound IP addresses are allow-listed with Paycom.

4. Deploy the connector using your standard self-hosted connector process.

Done. Your Paycom connector is now pulling access data into C1.