Register your application in the ADP Marketplace developer portal; ADP uses client certificate-based mutual TLS (mTLS) in addition to OAuth 2.0 — you must generate a CSR, submit it to ADP, and receive a signed certificate to use in API calls.
Obtain an access token by POSTing to https://accounts.adp.com/auth/oauth/v2/token with grant_type=client_credentials, using your client ID, client secret, and the mutual TLS certificate in the TLS handshake.
Base URL for the Workers API is https://api.adp.com/hr/v2/workers; include 'Authorization: Bearer {access_token}' in all requests.
GET /hr/v2/workers returns a paginated list of workers; use '$top' and '$skip' OData-style query parameters for pagination, and '$filter' for filtering by status or other fields.
Access token lifetime is limited — typically one hour; implement token refresh logic using client credentials grant before the token expires.
ADP's API responses use a deep nested JSON structure following their own data model (HCM-related standards); extract values from paths like 'workers[].person.legalName.formattedName' rather than expecting flat schemas.
Known gotchas
The mutual TLS certificate requirement is the most common integration blocker — ADP requires a valid signed certificate in every API call, not just at registration; libraries that don't support client certificates require special configuration or won't work at all.
ADP sandbox and production environments have different certificate authorities and endpoints; a certificate issued for sandbox will not work in production, requiring a separate certificate request and approval process.
ADP's API access model is employer-specific; the same credentials issued for one ADP client company cannot access another company's data — multi-tenant integrations require separate credential sets per employer.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp