> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Paycom connector

> C1 provides identity governance for Paycom. Integrate your Paycom instance with C1 for unified visibility and governance over user access.

C1 provides identity governance for Paycom. Integrate your Paycom
instance with C1 for unified visibility and governance over employee access.

The Paycom connector is read-only: it syncs employees as identities and the
organizational structures they belong to. Paycom's API exposes no write
endpoints for employee accounts or assignments, so the connector does not
provision access.

## Capabilities

| Resource       | Sync                                                          | Provision |
| -------------- | ------------------------------------------------------------- | --------- |
| Employees      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Positions      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Locations      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Establishments | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Departments    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

Employees are synced from the Paycom Employee Directory and enriched with each
employee's master record (work email, manager, position, location, lifecycle
dates, and normalized account status). Positions, Locations, Establishments, and
Departments are synced as groups, and each employee is granted membership in the
position, location, establishment, and department they are assigned to.

## Gather Paycom credentials

<Warning>
  Paycom's API is gated. You must register your connector's egress IP addresses
  with Paycom **before** credentials are issued, and the endpoints this connector
  uses must be enabled. Contact your Paycom Specialist or
  `automation@paycomonline.com` to begin. Sandbox credentials are available from
  the automation team.
</Warning>

<Steps>
  <Step>
    Provide the connector's WAN egress IP address(es) to your Paycom
    representative for **IP allow-listing**. Requests from non-listed IPs are
    rejected with `401 Unauthorized`.
  </Step>

  <Step>
    In Paycom, go to **User Options > User Access and Security > API Setup**,
    edit the API user, and under **Function Enablement** enable the read
    endpoints the connector uses: Employee Directory, Employee, Positions,
    Company Locations, and Company Establishments. (Sensitive endpoints are not
    required and remain disabled.)
  </Step>

  <Step>
    From the API Setup page, copy the **SID** (Client ID / username) and
    generate or copy the **Token** (Client Secret / password). Note which
    regional data center (**OKC**, **PHX**, or **DFW**) hosts your tenant.
  </Step>
</Steps>

## Configure the Paycom connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Paycom** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Paycom connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Paycom credentials:

        * **Region**: your tenant's data center — `OKC`, `PHX`, or `DFW`.
        * **SID (Client ID)**: the API SID from Paycom's API Setup page.
        * **Token (Client Secret)**: the API Token from Paycom's API Setup page.
        * **Base URL override (advanced)**: leave blank for standard tenants;
          set it only for sandbox or non-standard endpoints.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Paycom connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Paycom connector in your own
    environment.

    <Steps>
      <Step>
        Create secrets for the Paycom **Token**.
      </Step>

      <Step>
        Configure the connector settings:

        * **Region**: `OKC`, `PHX`, or `DFW`.
        * **SID (Client ID)**: the API SID.
        * **Token (Client Secret)**: the API Token (store as a secret).
      </Step>

      <Step>
        Ensure the host's outbound IP addresses are allow-listed with Paycom.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Paycom connector is now pulling access data into C1.
  </Tab>
</Tabs>