Payroll API Capability Matrix · Deduction detail
Deduction write detail
What actually happens when your product pushes a deduction into payroll — for benefits, HSA/FSA and 401(k) builders who need an election to land correctly, not just to land.
The capability matrix answers “can you write a deduction at all?”. This page answers the ten questions that decide whether the write is right: whether it is taxed correctly, whether the number means dollars or a percent, which pay period it hits. Of 220 answers across 22 payroll systems and unified APIs, 100 (45.5%) are unverified because no vendor documents the behaviour.
The ten questions
| Column | The question | Why it matters |
|---|---|---|
| Read | Can you read existing deductions back? | Without it you cannot reconcile what payroll actually holds against what you sent. |
| Write | How does a deduction get in — API, file, portal or a person? | An "assisted" write is a human with admin access on a service level, not an integration. |
| Tax at write | Can the write say pre-tax or post-tax? | If not, treatment is inherited from a code someone configured, and you cannot guarantee it. |
| Amt/pct | Does the payload say whether the number is dollars or a percent? | Some systems decide from the code number; a wrong assumption is off by a factor of 100. |
| Dating | Which date decides the pay period it lands in? | Pay date versus period start date is a silent off-by-one-period bug. |
| Retro | Can you correct a period that already ran? | Almost nobody documents it, and mid-year corrections are routine. |
| Employer | Is the employer contribution its own object? | If it is modelled as an earning, it can be taxed and needs a workaround. |
| Codes | Who defines the deduction codes? | Company-defined codes mean a mapping per employer, not per payroll system. |
| Auth | How does the integration authenticate? | Decides whether you can connect without the employer sharing credentials. |
| Freshness | How quickly does a change show up? | Decides whether an election lands before the next payroll closes. |
The answers
Documented by the vendor · unverified — nobody publishes it. Method grade: A API read and write, B API read only, C file drop, D a human or scraper with admin access, ? could not be established. Click a system for the note and source behind every answer.
| System | Method | Read | Write | Tax at write | Amt/pct | Dating | Retro | Employer | Codes | Auth | Freshness |
|---|---|---|---|---|---|---|---|---|---|---|---|
| ADP Workforce Now | A | Yes — API | API | Not assertable on write | Both — resolved by code number | Yes — effectiveDateTime | Not supported via API | No contribution object | Company-defined | Unverified | Post-run, no stated SLA |
| Paylocity Web Pay | A | Yes — API | API | Inherited, not assertable | Both — explicit | Yes — three distinct dates | Unverified | Modelled as memo earnings | Company-defined | Unverified | Unverified |
| Gusto Embedded Payroll | A | Yes — API | API | Explicit | Both — explicit, both sides | Yes — effective_date / expiration_date | Unverified | First-class object | Vendor-fixed taxonomy | Unverified | Unverified |
| Rippling docs not public | ? | Unverified | Legacy 401(k) only | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
| isolved People Cloud docs not public | ? | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
| Paycor docs not public | ? | Claimed — API | API — add / update | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
| UKG Pro | B | Yes — API | Import only — does not drive payroll | Unverified | Both — amount and rate-or-percent | Yes — richest model assessed | Unverified | Amount only, import path | Configuration-driven | Basic auth + two API keys | Unverified |
| Paychex docs not public | ? | Unverified | API — recurring deductions | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
| Paycom docs not public | ? | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
| Workday HCM | A | Yes — API | API (SOAP Submit_Payroll_Input) | Not represented on input | Amount only | Start_Date / End_Date / Ongoing | Partly documented | Unverified | Hybrid | ISU / OAuth / WS-Security | Unverified |
| Dayforce docs not public | ? | Unverified | API + CSV import | Inherited from code | Code-dependent | Effective Start / End | Unverified | Mapped to a code | Company-defined | Token for a web-services user | Unverified |
| ADP RUN docs not public | A | Yes — API | API (event POSTs) | Inherited from code | Both; code-dependent | No date; next payroll | Unverified | Modelled as a deduction code | Hybrid | OAuth 2.0 + mutual TLS | Near real time; cache lag |
| QuickBooks Payroll | A | Yes — API | API (GraphQL) | Inherited from code | Both — FIXED or PERCENT | Unverified | Unverified | First-class object | Hybrid | OAuth 2.0 | Webhook on payslip |
| Justworks | A | Yes — GET /v1/deductions | API (REST, batch) | Not represented at write | Both — fixed or percent | start_date / end_date | Unverified | Not supported in write | Unverified | OAuth 2.0 | Unverified |
| TriNet docs not public | ? | Unverified | Unverified | Unverified | Unverified | Effective-dated (general) | Unverified | Unverified | Unverified | OAuth 2.0 client credentials | Unverified |
| Toast Payroll docs not public | ? | No API; portal only | Portal, Toast-assisted | Set on the code | Amount or percent, not both | End dates on recurring | Unverified | Unverified | Company-specific, built by Toast | Portal login (no API) | Unverified |
| Square Payroll docs not public | ? | No API; Dashboard only | Portal (Dashboard) | Set by benefit type | Amount or percent | Unverified | Unverified | Employer contribution, amount or % | Hybrid | Dashboard login (no API) | Unverified |
| BambooHR Payroll | B | Yes — benefit deductions | Portal only (no API) | Unverified | Amount or percent | Start and end dates | Unverified | Separate company fields | Hybrid | API key or OAuth | Unverified |
| Finch | A | Yes — API | API — full CRUD plus enrolment | Enforced by benefit type | Both — different units | Yes — with defaulting | Unverified | First-class, tiered | Vendor-fixed taxonomy | Bearer token | Method-dependent, SLA-bound |
| Merge | B | Yes — API | None for benefits | Unverified | Unverified | Read-side only | Unverified | Read-only amount | Coarse vendor taxonomy | Bearer key + account token | Unverified |
| Bindbee | A | Yes — API | API — but provider-shaped | Not represented | Not represented | Unverified | Unverified | Provider-dependent | Normalised read, passthrough write | Bearer key + connector token | 24h default, adjustable |
| Kombo docs not public | ? | Yes — payslip line items | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified | Unverified |
What the answers show
Almost nobody can assert tax treatment on the write
Of the systems where we could read a write contract at all, only Gusto exposes tax
treatment as readable state — pretax, posttax and
imputed booleans per benefit type. Paylocity has no pre-tax field on
DeductionCodeDto at all; treatment is a property of the company-level
detType, so the write selects a code someone already classified. ADP
restricts the API to two categories and requires a paper authorization form
before a pre-tax code exists. Finch carries the distinction in the type name
(custom_pre_tax versus custom_post_tax) rather than as a flag.
The practical consequence: for most of these systems, a benefits platform cannot guarantee through the API that a deduction it just wrote will be treated pre-tax. It can only pick a code and trust the configuration behind it.
The unit is not always in the payload
ADP Workforce Now carries amount and percent in one field,
deductionRate/rateValue, and resolves which is meant from whether the
deduction code number falls between 81 and 96. The field that would disambiguate it,
unitCode, is marked Not Displayed. Finch is explicit but changes
unit with type: cents when fixed, basis points when percent —
correct, documented, and a factor-of-100 error if you assume one.
“Unified” is not always unified
Bindbee writes deductions through its employee-payroll-run endpoint, but the documented
shape differs per provider: ADP takes {code, amount}, UKG Ready takes
{name, employee_deduction, company_deduction}, SAP SuccessFactors takes
{name, employee_deduction}. The caller still has to know which payroll
system is behind the abstraction. Merge, meanwhile, documents no benefit or deduction
write at all in its benefits reference, and compresses every deduction type a payroll
system distinguishes into a five-value benefit_plan_type enum.
Where the unglamorous method wins
Grade C — SFTP and file drops — genuinely beats an API for correcting deductions across hundreds of employees at once, where per-employee API calls mean hundreds of requests, partial-failure handling and no atomicity. We grade it below API access for security and latency, and we say plainly that it is the better tool for bulk correction. What is not defensible is grade D: an “assisted” write, where a human with administrator credentials performs the change against a two-business-day SLA, sold in the same column as a real API write.
2 of these systems publish nothing at field level
2 of the 22 entries assessed have an entirely unverified record: isolved People Cloud, Paycom. In each case the specification is behind a login, a partnership, or an NDA, or does not exist publicly at all. A buyer cannot read the data contract before signing — which is the structural condition this publication exists because of.
Method
- Scoring
- Every system is scored on the identical 12-field record defined on the methodology page. Each cell carries an independent confidence mark. Cells are never averaged into a composite score, because a composite hides exactly the detail the reader came for.
- Sample
- 22 systems on the 12-field record, of which 10 fields carry confidence marks — the documentation URL and the last-verified date are metadata rather than scored claims. That gives 220 marked cells. Every count on this page is computed from the underlying records at build time, never typed by hand, so the header cannot drift from the table.
- What is excluded
- Systems not yet assessed are named in each index's coverage roadmap and kept out of this matrix and out of the denominator. 7 such groups are outstanding.
- Source limits
- Zero cells are verified hands-on. Every affirmative cell is a vendor describing its own product, and vendor documentation of write behaviour is frequently wrong or stale — ADP's guide, the most detailed source here, was last modified 2022-09-22 and contradicts itself on whether one limitation still applies. Treat every vendor-documented cell as a claim to be tested, not a fact.
- Cadence
- Rolling. Republished with a fresh modification date whenever a batch of cells changes confidence, with a note recording what moved and why.
If your cells are wrong, tell us and they change. Corrections are free and unconditional — payrolldataspecs@gmail.com. If your record here is unverified and you would rather it were not, the fastest route is sandbox or developer access; we will disclose that you provided it, and publish whatever we observe.