Patent Publication Number: US-10762559-B2

Title: Management of payroll lending within an enterprise system

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application is related to the following patent applications: entitled “Dynamic Proxy Server”, Ser. No. 14/882,775, filed Oct. 14, 2015, and entitled “Customized Web Services Gateway”, Ser. No. 14/882,819, filed Oct. 14, 2015, both of which are incorporated herein by reference in their entirety. 
     BACKGROUND INFORMATION 
     1. Field 
     The present disclosure relates generally to payroll systems and, in particular, managing the payroll systems of business entities within an enterprise system. Still more particularly, the present disclosure relates to a method and apparatus for improving the efficiency of facilitating payroll through an enterprise system. 
     2. Background 
     Human capital management and human resources management involves managing payroll services. Payroll services may include managing, for example, without limitation, a company&#39;s list of its employees, the total amount of money that the company pays to its employees, and the company&#39;s records of its employees&#39; salaries and wages, bonuses, and withheld taxes. 
     In some cases, a business entity may have insufficient funds to complete an upcoming payroll payment for a given pay period. The business entity may then attempt to obtain a loan from a financial institution, such as, but not limited to, a bank, to complete the payroll. However, in certain cases, obtaining a loan for payroll may take more time than desired, may be more difficult than desired, or both. In particular, facilitating communications between the business entity and the provider of the payroll services and between the business entity and the financial institution to help the business entity complete an upcoming payroll payment may be more difficult and time-consuming than desired. Further, payroll systems are typically closed systems due to the highly sensitive data managed by these types of systems. 
     Time delays in establishing a loan or other type of line of credit for a business entity may lead to undesired time delays in payroll processing. These time delays may affect overall performance and operational efficiency of the business entities. Therefore, it would be desirable to have a method and apparatus that take into account at least some of the issues discussed above, as well as other possible issues. 
     SUMMARY 
     In one illustrative embodiment, a method is provided for facilitating access to credit scores in an enterprise system. A request that includes a context resource identifier may be received at a proxy server from a client. The proxy server controls access to a resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server. The proxy server sends a response generated by the resource to the client. The response includes a credit score for an entity that is based on a current financial state of the entity. Controlling access to the resource based on the context resource identifier and the profile for the user increases a speed of access to the resource in the enterprise system. 
     In another illustrative embodiment, an apparatus comprises a resource and a proxy server in communication with the resource. The proxy server receives a request that includes a context resource identifier from a client. The proxy server controls access to the resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server. The proxy server sends a response generated by the resource to the client in which the response includes a credit score for an entity that is based on a current financial state of the entity. Controlling access to the resource based on the context resource identifier and the profile for the user increases a speed of access to the resource in an enterprise system. 
     In another illustrative example, a method for improving an efficiency of facilitating payroll through an enterprise system is provided. A request to perform a payroll operation through a payroll engine may be received from a first client used by a business entity. A proxy server then established communications between a payroll engine and a second client used by a financial institution. The payroll engine determines whether sufficient funds are available at the financial institution to perform the payroll operation. The payroll engine then performs the payroll operation in response to a determination that the sufficient funds are available. However, the payroll engine performs a credit line operation in response to a determination that the sufficient funds are not available. Information generated by the payroll engine is sent during at least one of the payroll operation and the credit line operation to the first client. Establishing the communications between the payroll engine and the second client increases the efficiency and speed of performing the payroll operation. 
     The features and functions can be achieved independently in various embodiments of the present disclosure or may be combined in yet other embodiments in which further details can be seen with reference to the following description and drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The novel features believed characteristic of the illustrative embodiments are set forth in the appended claims. The illustrative embodiments, however, as well as a preferred mode of use, further objectives and features thereof, will best be understood by reference to the following detailed description of an illustrative embodiment of the present disclosure when read in conjunction with the accompanying drawings, wherein: 
         FIG. 1  is an illustration of an enterprise system in the form of a block diagram in accordance with an illustrative embodiment; 
         FIG. 2  is an illustration of a gateway in the form of a block diagram in accordance with an illustrative embodiment; 
         FIG. 3  is an illustration of a proxy server in the form of a block diagram in accordance with an illustrative embodiment; 
         FIG. 4  is an illustration of a process for facilitating access to credit scores in an enterprise system in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 5  is an illustration of a process for facilitating communication between a client and a proxy server in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 6  is an illustration of a process for performing an initial authorization check in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 7  is an illustration of a process for facilitating communication between a proxy server and a client in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 8  is an illustration of a process for authorizing a user for access to a resource in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 9  is an illustration of a process for dynamically building a new profile for a financial institution in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 10  is an illustration of a process for sending a response with a credit score to a client in the form of a flowchart in accordance with an illustrative embodiment; 
         FIG. 11  is an illustration of a process for improving an efficiency of facilitating payroll through an enterprise system in the form of a flowchart in accordance with an illustrative embodiment; and 
         FIG. 12  is an illustration of a data processing system in the form of a block diagram in accordance with an illustrative embodiment. 
     
    
    
     DETAILED DESCRIPTION 
     The illustrative embodiments recognize and take into account different considerations. For example, the illustrative embodiments recognize and take into account that it may be desirable to improve the efficiency of managing and performing payroll services by improving communications between a business entity, a financial institution, and a provider of the payroll services within an enterprise system. In particular, it may be desirable to facilitate interaction between a financial institution and a provider of payroll services to reduce the overall amount of time involved in performing payroll services. 
     In one illustrative example, the illustrative embodiments provide a method for facilitating access to credit scores in an enterprise system. For example, a request that includes a context resource identifier may be received at a proxy server from a client. The proxy server may be a dynamic proxy server. Depending on the implementation, the user of the client may be a financial institution, a business entity, a governmental agency, or some other type of entity. The proxy server controls access to a resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server. The proxy server sends a response generated by the resource to the client. The response includes a credit score for an entity that is based on a current financial state of the entity. This credit score may be referred to as a payroll credit score. Controlling access to the resource based on the context resource identifier and the profile for the user increases a speed of access to the resource in the enterprise system. 
     When the user of the client is a financial institution, the financial institution may be able to use the payroll credit score in conjunction with currently available credit scores available from credit reporting agencies to more accurately determine loan eligibility. For example, without limitation, a bank or a lending company may use the payroll credit score either alone or in conjunction with a credit score generated based on a currently available credit score model that looks only at past credit history and not payroll information to more accurately determine loan or line of credit eligibility. 
     In another illustrative example, a method for improving an efficiency of facilitating payroll through an enterprise system is provided. A request to perform a payroll operation through a payroll engine may be received from a first client. The request includes a context resource identifier. A determination is made as to whether a user of the first client is authorized to access the payroll engine. A proxy server then establishes communications between the payroll engine and a second client used by a financial institution in response to a determination that the first client is authorized to access the payroll engine. The payroll engine determines whether sufficient funds are available at the financial institution to perform the payroll operation. The payroll engine then performs the payroll operation in response to a determination that the sufficient funds are available. However, the payroll engine performs a credit line operation in response to a determination that the sufficient funds are not available. Information generated by the payroll engine is sent during at least one of the payroll operation and the credit line operation to the first client. Establishing the communications between the payroll engine and the second client increases the efficiency and speed of performing the payroll operation. 
     By establishing communications directly between the payroll engine and the financial institution, the payroll engine may help provide overdraft protection for payroll, taxes, and invoices. By allowing the payroll engine to interact with the financial institution through the proxy server in a secure manner, the processing of payroll may be made more streamlined and more efficient to help prevent disruptions in employee payments, tax payments, invoice payments, recurring payments, and other types of payments. 
     Referring now to the figures and, in particular, with reference to  FIG. 1 , an illustration of enterprise system is depicted in the form of a block diagram in accordance with an illustrative embodiment. In this illustrative example, enterprise system  100  is an example of a system that enables communications between various software systems through one or more computer networks. 
     The one or more computer networks may include at least one of the Internet, a private network, a public network, or some other type of network. As used herein, the phrase “at least one of,” when used with a list of items, means different combinations of one or more of the listed items may be used, and only one of the items in the list may be needed. The item may be a particular object, thing, step, operation, process, or category. In other words, “at least one of” means any combination of items or number of items may be used from the list, but not all of the items in the list may be required. 
     For example, without limitation, “at least one of item A, item B, or item C” or “at least one of item A, item B, and item C” may mean item A; item A and item B; item B; item A, item B, and item C; item B and item C; or item A and C. In some cases, “at least one of item A, item B, or item C” or “at least one of item A, item B, and item C” may mean, but is not limited to, two of item A, one of item B, and ten of item C; four of item B and seven of item C; or some other suitable combination. 
     In this illustrative example, enterprise system  100  enables communications between plurality of clients  102  and plurality of resources  104 . Each client of plurality of clients  102  may also be referred to as a service requestor. Each resource of plurality of resources  104  may also be referred to as a service provider that provides one or more services. In this manner, plurality of clients  102  and plurality of resources  104  may also be referred to as a plurality of service requestors and a plurality of service providers, respectively. 
     Each client of plurality of clients  102  and each resource of plurality of resources  104  may take the form of software. Further, each client of plurality of clients  102  and each resource of plurality of resources  104  may be run on one or more computer devices. For example, a client of plurality of clients  102  may be implemented on hardware that includes at least one of a computer system, a processor unit, a microprocessor, a tablet, a laptop, a smart television, a smartphone, or some other type of data processing system or electronic device. Similarly, a resource of plurality of resources  104  may be implemented on hardware that includes at least one of a computer system, a processor unit, a microprocessor, a tablet, a laptop, a smart television, a smartphone, a server, or some other type of data processing system or electronic device. 
     In this illustrative example, plurality of resources  104  are affiliated with entity  106 . Entity  106  may take the form of, for example, without limitation, a business entity, an organization, a corporation, or some other type of entity. 
     As depicted, plurality of resources  104  may be connected to internal network  107 . In this illustrative example, internal network  107  may be in communication with Internet  108 . Internet  108  may refer to the common use of the term “Internet.” In some cases, Internet  108  may refer to a group of networked computers or a group of interconnected computer networks. Plurality of clients  102  may attempt to access plurality of resources  104  through Internet  108 . 
     As depicted, plurality of clients  102  includes client  110 , client  112 , client  114 , and client  116 . Client  110 , client  112 , client  114 , and client  116  may be affiliated with the same entity or different entities. In other illustrative examples, one or more of client  110 , client  112 , client  114 , and client  116  may be affiliated with entity  106 . In one illustrative example, each of these clients may take the form of a consumer application, an email client, a web browser, a login application, or some other type of software component. 
     Enterprise system  100  includes plurality of resources  104 , plurality of interfaces  118  associated with plurality of resources  104 , gateway  120 , proxy server  122 , and cache system  124 . Each resource of plurality of resources  104 , each interface of plurality of interfaces  118 , gateway  120 , proxy server  122 , and cache system  124  may be connected to internal network  107 . A resource of plurality of resources  104  may take the form of, for example, without limitation, a human resources service, a payroll service, an employee benefits service, a search engine, a research service provider, a governmental service provider, or some other type of service provider. 
     Each interface of plurality of interfaces  118  is associated with a corresponding resource of plurality of resources  104 . In this illustrative example, each interface of plurality of interfaces  118  may also be referred to as an application programming interface (API). In this manner, plurality of resources  104  may also be referred to as a plurality of application programming interfaces (APIs). 
     Gateway  120  and proxy server  122  may be used to facilitate communications between plurality of clients  102  and plurality of resources  104 . Gateway  120  and proxy server  122  may each be implemented using software, hardware, firmware, or a combination thereof. Depending on the implementation, gateway  120  and proxy server  122  may be implemented on the same computer device or on different computer devices that are in communication with each other. In this illustrative example, gateway  120  and proxy server  122  may communicate over internal network  107 . However, in other illustrative examples, gateway  120  may communicate with proxy server  122  over Internet  108 . 
     In one illustrative example, client  112  may send a request for access to data provided by resource  130  over Internet  108  to gateway  120 . Gateway  120  uses the request to identify interface  132  associated with resource  130 . Gateway  120  then performs an initial authorization check of both client  112  and the user of client  112  with respect to interface  132 . If gateway  120  determines that client  112  and the user of client  112  are authorized to access interface  132 , gateway  120  passes along the request to proxy server  122 . 
     Proxy server  122  performs another level of authorization and ultimately controls access to resource  130 . In particular, proxy server  122  performs a profile-based authorization for the user of client  112 . Once the user of client  112  has been authorized, proxy server  122  routes the request received from client  112  to resource  130 . Proxy server  122  may then receive a response that includes the requested data from resource  130 . Proxy server  122  then sends this response to gateway  120 , which then sends the response to client  112  over Internet  108 . 
     Proxy server  122  may be configured to dynamically discover new resources over time that are added to plurality of resources  104 . Further, proxy server  122  may be configured to discover new services that are offered by resources over time. 
     The addition of new resources to plurality of resources  104  that are in communication with and recognized by proxy server  122  may be handled by proxy server  122  in different ways. In one illustrative example, a centralized service directory may be used to manage plurality of resources  104 . In another illustrative example, a broadcast and discovery method may be used to manage plurality of resources  104 . 
     With a centralized service directory, new resources may be registered using a uniform interface that enables proxy server  122  to discover these resources. In some cases, new services that are provided by a previously registered resource may be registered using this uniform interface. A resource that provides a service may be responsible for maintaining the registration of that service in the centralized service directory. In this manner, a resource that provides a service may be ultimately responsible for maintaining the freshness of data stored in the centralized service directory for that service. 
     With the broadcast and discovery method, a resource may broadcast the presence of a service when the resource is connected to internal network  107 , Internet  108 , or both. This type of broadcasting allows discovery of the resource and the services provided by that resource by proxy server  122 . In one illustrative example, a uniform interface may be used to discover resources for which broadcasts have been detected, the services for which broadcasts have been detected, or both. 
     Proxy server  122  may be in communication with cache system  124 . Cache system  124  may include any number of caches. Proxy server  122  may use cache system  124  to store profiles for users and other types of information. 
     In these illustrative examples, enterprise system  100  formed by proxy server  122  and gateway  120  takes the form of a dynamic and distributed enterprise system. This dynamic and distributed enterprise system facilitates communications between plurality of clients  102  and plurality of resources  104 , while allowing clients and resources to join and leave the dynamic and distributed enterprise system over time. In other words, the functions performed by proxy server  122  and gateway  120  enable clients to connect to or disconnect from gateway  120  and resources to connect to or disconnect from proxy server  122  in an organic and fluid manner over time. This type of dynamic and distributed enterprise system may reduce the overall time and processing resources needed to facilitate communications between clients and resources. 
     In one illustrative example, client  114  may be used by financial institution  126 . Further, resource  130  may take the form of payroll engine  128  and entity  106  may be a company that employees tens, hundreds, or thousands of employees. Depending on the implementation, proxy server  122 , gateway  120 , or both may be used to facilitate communications between client  114  and payroll engine  128 . 
     As one illustrative example, proxy server  122  controls access to credit scores. For example, proxy server  122  may control access by financial institution  126  to credit score  134  of entity  106 . Credit score  134  is based on a current financial state of entity  106 . The current financial state of entity  106  may be based on different types of information. When entity  106  is a business entity, such as a company or corporation, this information may include at least one of a number of employees, a general ledger, an average size of payroll, a number of years in business, a financial standing of the business entity, a current tax state for the business entity, a business start date, an industry type, a status of funds, a start date for joining enterprise system  100 , or some other type of information. 
     Credit score  134  is different from other types of currently available credit scores that are based on past financial data and past business data because credit score  134  is based on a current financial state of entity  106 . Because credit score  134  is based on a current financial state of entity  106 , which is related to payroll, credit score  134  may also be referred to as payroll credit score  136 . This type of credit score  134  may help financial institution  126  better assess entity  106  in determining whether entity  106  qualifies for a loan or some other type of line of credit. For example, without limitation, financial institution  126  may be able to use payroll credit score  136  provided by payroll engine  128  in conjunction with other credit scores available from credit reporting agencies to more accurately determine loan eligibility. 
     Further, payroll engine  128  may interact with client  114  being used by financial institution  126  through proxy server  122  for other purposes while processing payroll of payroll services. As one illustrative example, while processing payroll, a request may be received to perform payroll operation  138 . Depending on the implementation, payroll operation  138  may be making of payments to a group of employees, a tax payment, an invoice payment, a purchase, or some other type of payment. 
     In some illustrative examples, this request may be received directly by and authorized by payroll engine  128 . In other illustrative examples, this request may be received by and authorized by proxy server  122  and then sent to payroll engine  128 . 
     Upon payroll engine  128  receiving the request, payroll engine  128  then sends a message to proxy server  122  requesting that proxy server  122  establish communications between payroll engine  128  and client  114  of financial institution  126 . Once communications have been established between payroll engine  128  and client  114  of financial institution  126 , payroll engine  128  determines whether sufficient funds are available at financial institution  126  to perform payroll operation  138 . 
     If sufficient funds are available at financial institution  126 , payroll engine  128  performs payroll operation  138 . If sufficient funds are not available, payroll engine  128  performs credit line operation  140 . Credit line operation  140  may include, for example, without limitation, establishing a line of credit for entity  106 . This line of credit may be established by, for example, interacting with financial institution  126  to qualify entity  106  for a loan. In some cases, this qualification may be performed by providing payroll credit score  136  to financial institution  126 . 
     If credit line operation  140  is successful in establishing a line of credit for entity  106 , then payroll engine  128  may proceed with performing payroll operation  138 . If, however, credit line operation  140  is unsuccessful, then payroll engine  128  is unable to perform payroll operation  138  and generates an alert or report. In some cases, the generation of the alert or report may cause payroll engine  128  to adjust payroll credit score  136 . For example, payroll engine  128  may decrease payroll credit score  136  to reflect that entity  106  was unable to obtain sufficient funds to complete payroll operation  138 . 
     Establishing communications between payroll engine  128  and client  114  of financial institution  126  as described above through proxy server  122  increases the efficiency and speed of performing payroll operation  138 . In this manner, the overall efficiency and speed of processing payroll for entity  106  may be improved. 
     The functions performed by gateway  120  are described in greater detail below in  FIG. 2 . Further, the functions performed by proxy server  122  are described in greater detail below in  FIG. 3 . 
     With reference now to  FIG. 2 , an illustration of gateway  120  from  FIG. 1  is depicted in the form of a block diagram in accordance with an illustrative embodiment. As depicted, gateway  120  is in communication with Internet  108  and proxy server  122 . Gateway  120  is implemented such that gateway  120  is customized. In some cases, gateway  120  may be referred to as a customized web services gateway. 
     Gateway  120  includes message manager  201 , context mapper  203 , and authenticator  205 . Each of message manager  201 , context mapper  203 , and authenticator  205  may be implemented using software, hardware, firmware, or a combination thereof. 
     Message manager  201  of gateway  120  receives message  200  from client  112  from  FIG. 1 . In one illustrative example, message  200  may include a request for access to data that is provided by at least one resource of plurality of resources  104  in  FIG. 1 . 
     As depicted, message  200  also includes uniform resource identifier (URI)  202  that references the particular resource of plurality of resources  104  in  FIG. 1  from which the data is being requested. In this illustrative example, uniform resource identifier  202  references, or represents, interface  132  associated with resource  130  from  FIG. 1 . Thus, uniform resource identifier  202  also references resource  130  associated with interface  132 . 
     Context mapper  203  of gateway  120  transforms uniform resource identifier  202  into context resource identifier  204  that also references interface  132 , and thereby, resource  130 . For example, without limitation, context mapper  203  of gateway  120  may have access to identifier data structure  206  that stores plurality of uniform resource identifiers  208  and plurality of context resource identifiers  210 . Identifier data structure  206  may take the form of a table, a spreadsheet, a database, a word document, a cache, a data store, or some other type of data structure. 
     Each uniform resource identifier of plurality of uniform resource identifiers  208  may match to a corresponding context resource identifier of plurality of context resource identifiers  210  in identifier data structure  206 . Each corresponding pair of uniform resource identifier and context resource identifier may reference a same interface and thereby, a same resource. 
     The uniform resource identifier that references a particular interface, and thereby, a particular resource, may change over time. However, the corresponding context resource identifier that references that particular interface, and thereby, that particular resource, may remain static and fixed over time. 
     Context mapper  203  uses uniform resource identifier  202  in message  200  to look up the corresponding context resource identifier  204  in identifier data structure  206 . In one illustrative example, context resource identifier  204  may include elements that more descriptively reference interface  132  and thereby resource  130 , as compared to uniform resource identifier  202 . 
     For example, without limitation, context resource identifier  204  may be represented or defined within the scope of a larger domain for entity  106 . In one illustrative example, when entity  106  is a business entity involved with human capital management, context resource identifier  204  may be represented or defined within the scope of the human capital management domain. Context resource identifier  204  may take the form of a functional decomposition of the human capital management domain to provide clarity and uniqueness with respect to this domain. In some illustrative examples, context resource identifier  204  may have a format similar to uniform resource identifier  202  for ease and understanding. 
     As one illustrative example, context resource identifier  204  may be comprised of segments including, but not limited to, a domain segment, a service segment, a feature segment, a function segment, and an operation segment. One illustrative example for context resource identifier  204  may be as follows:
         “/hr/workerInformationManagement/workerManagement/addressManagement/worker.legalAddress.change.”       

     In this manner, context resource identifier  204  may describe the overall intent of uniform resource identifier  202 . In some cases, context resource identifier  204  may also be referred to as a canonical identifier for interface  132 . 
     In other illustrative examples, plurality of uniform resource identifiers  208  may not be stored in identifier data structure  206 . Instead, context mapper  203  may use one or more algorithms to transform a particular uniform resource identifier into one of plurality of context resource identifiers  210 . 
     Authenticator  205  of gateway  120  performs initial authorization check  211  for client  112  and user  212  of client  112  with respect to interface  132  referenced by context resource identifier  204 . User  212  may be an employer, an employee, a member of an organization, a member of a corporation, a team member, a consumer, a supplier, or some other type of user. 
     For example, authenticator  205  determines whether client  112  is authorized to access interface  132  referenced by context resource identifier  204 . This determination may be based on a number of different factors, which may include, for example, at least one of the particular device on which client  112  is being run, the type of client  112 , a current time of day, a current date, or some other type of factor. 
     Further, authenticator  205  determines whether user  212  of client  112  is authorized to access interface  132  referenced by context resource identifier  204 . Various factors may be used to determine whether user  212  is authorized to access interface  132 . As one illustrative example, authenticator  205  may confirm whether user  212  has a subscription to resource  130  associated with interface  132  that is in good order. 
     In some illustrative examples, authenticator  105  may validate a subscription corresponding to client  112  with respect to context resource identifier  204 , and thereby, with respect to resource  130 . The subscription may be, for example, held by an organization that uses or manages client  112 . The subscription may grant client  112  access to one or more resources for a specified period of time. In one illustrative example, authenticator  205  determines whether a subscription corresponding to client  112  is valid or invalid based on at least one of whether the subscription has expired, whether the subscription restricts access to certain resources, or some other factor. 
     If both client  112  and user  212  are authorized to access interface  132 , authenticator  205  sends access token  214  to client  112  over Internet  108 . Client  112  receives access token  214 . Client  112  may then send access token  214  back to gateway  120  through Internet  108  so that authenticator  205  can authenticate both client  112  and user  212 . In some cases, client  112  may resend message  200  with access token  214 . This authentication completes initial authorization check  211 . 
     In response to a successful initial authorization check  211 , message manager  201  inserts context resource identifier  204  into message  200  to form modified message  216 . Message manager  201  then sends modified message  216  to proxy server  122  for processing. Proxy server  122  may only use context resource identifier  204  in modified message  216  to call interface  132  and may not need to look at or use uniform resource identifier  202 . Changes to uniform resource identifiers over time may not affect the manner in which proxy server  122  interacts with plurality of interfaces  118  from  FIG. 1 . 
     In some illustrative examples, message manager  201  may further modify message  200  before sending modified message  216  to proxy server  122 . For example, message manager  201  may check plurality of headers  218  in modified message  216  based on preapproved list of headers  220  stored in header data structure  222 . Message manager  201  may then filter out any header of plurality of headers  218  that is not on preapproved list of headers  220 . In other illustrative examples, message manager  201  may perform this filtering of plurality of headers  218  in message  200  prior to context resource identifier  204  being inserted into message  200  to form modified message  216 . 
     Proxy server  122  processes modified message  216 . Proxy server  122  performs another level of authorization checking. If this authorization check is successful, proxy server  122  routes modified message  216  to resource  130 . 
     Resource  130  may then send response message  224  to proxy server  122 . Response message  224  contains information  226  provided by resource  130  in response to the request contained in modified message  216 . Proxy server  122  sends response message  224  to gateway  120 . 
     Message manager  201  of gateway  120  receives response message  224  and sends response message  224  to client  112 . In some cases, message manager  201  may filter plurality of headers  228  in response message  224  before sending response message  224  to client  112 . For example, message manager  201  may filter out any header of plurality of headers  228  in response message  224  that is not on preapproved list of headers  220  stored in header data structure  222 . 
     In this manner, gateway  120  facilitates communication between client  112  and proxy server  122 . Gateway  120  provides one level of authorization prior to request messages from client  112  being sent to proxy server  122 . Further, gateway  120  may decouple proxy server  122  from plurality of clients  102  that are external to internal network  107  in  FIG. 1 . Further, gateway  120  may shield proxy server  122  from changes to the uniform resource identifiers that reference various interfaces over time. 
     With reference now to  FIG. 3 , an illustration of proxy server  122  from  FIGS. 1-2  is depicted in the form of a block diagram in accordance with an illustrative embodiment. As depicted, proxy server  122  may also be referred to as dynamic proxy server  300 . 
     Proxy server  122  includes message manager  302 , authorization manager  304 , and router  306 . Each of message manager  302 , authorization manager  304 , and router  306  may be implemented using software, hardware, firmware, or a combination thereof. 
     Proxy server  122  may receive message  308  containing a context resource identifier from gateway  120 . In particular, message manager  302  may receive message  308  from a client of plurality of clients  102  in  FIG. 1  through gateway  120 . 
     In one illustrative example, message  308  is modified message  216  formed by gateway  120  as described in  FIG. 2 . In this manner, message  308  may include the request for access to data received from client  112  on behalf of user  212 . Message  308  may also include context resource identifier  204 . 
     User  212  of client  112  may be using client  112  in a particular capacity that is defined as role  311  of user  212 . Role  311  may take a number of different forms. For example, without limitation, role  311  may take the form of an employee role, a supervisor role, a project manager role, an observer role, or some other type of role. In one illustrative example, role  311  may be defined in message  308  received from client  112  through gateway  120 . 
     After message manager  302  receives message  308 , authorization manager  304  of proxy server  122  may then perform authorization of user  212  of client  112 . This authorization is performed in addition to the authorization of user  212  performed by gateway  120  as described in  FIG. 1 . 
     Authorization manager  304  uses context resource identifier  204  in message  308  to identify interface  132 . Authorization manager  304  then determines whether authorization is required for accessing resource  130  associated with interface  132 . 
     As one illustrative example, authorization manager  304  contacts, or calls, interface  132 . Interface  132  sends response  310  that includes authorization indicator  313  and set of endpoint references  315  to authorization manager  304 . Authorization indicator  313  may indicate whether or not user authorization is required. 
     Set of endpoint references  315  may include one or more endpoint references. As used herein, an endpoint reference may identify the endpoint for a resource. The endpoint is the port or electronic device to which messages can be addressed. In other words, an endpoint reference conveys information for addressing an endpoint for a resource. 
     If authorization is not required based on authorization indicator  313  in response  310 , user  212  is considered authorized to access to resource  130 . Router  306  of proxy server  122  then routes message  308  to resource  130  using at least one endpoint reference of set of endpoint references  315 . 
     If authorization manager  304  determines that authorization is required for accessing resource  130  associated with interface  132 , authorization manager  304  then determines whether a profile for user  212  of client  112  is present in cache  312  of cache system  124 . If existing profile  314  is present for user  212  in cache  312 , authorization manager  304  uses existing profile  314  to determine whether user  212  is authorized to access interface  132  referenced by context resource identifier  204 . 
     If user  212  is not authorized to access interface  132 , authorization manager  304  sends error code  316  to message manager  302 . Based on error code  316 , message manager  302  of proxy server  122  may then return error response  318  to gateway  120 . Error response  318  may be, for example, a response message indicating that user  212  is not authorized to access resource  130  associated with interface  132 . Gateway  120  may then send error response  318  to client  112  over Internet  108 . In one illustrative example, receiving error response  318  at client  112  may cause a graphical representation or graphical indication of error code  316  to be displayed to user  212 . 
     However, if existing profile  314  indicates that user  212  is authorized to access interface  132 , router  306  then routes message  308  to resource  130  using at least one endpoint reference of set of endpoint references  315 . Proxy server  122  then waits to receive response message  224  from resource  130 . 
     If a profile is not present for user  212  in cache  312 , authorization manager  304  dynamically builds new profile  320  for user  212 . As one illustrative example, authorization manager  304  requests plurality of resource profiles  322  from plurality of interfaces  118  that are in communication with proxy server  122 . In particular, a resource profile is requested from each of plurality of interfaces  118 . 
     Resource profile  324  is an example of one of plurality of resource profiles  322 . Resource profile  324  may be received from interface  132  associated with resource  130 . Authorization manager  304  may use the freshest version of resource profile  324  that is available to authorization manager  304 . 
     In some illustrative examples, when a new resource is discovered by proxy server  122 , proxy server  122  may be configured to automatically request a resource profile for the new resource and store that resource profile in cache system  124 . Authorization manager  304  may use the stored resource profile if authorization manager  304  determines that the stored resource profile may still be considered up-to-date. Otherwise, authorization manager  304  may send a request for any updates to the stored resource profile or a request for an updated resource profile from the new resource. This updated resource profile may then be used to dynamically build new profile  320  for user  212 . 
     As depicted, resource profile  324  includes authorization information  326 . In some illustrative examples, resource profile  324  may include other information such as, for example, without limitation, an identification of the one or more services provided by resource  130 , an endpoint for each service offered, or some other type of information. Any of the information in resource profile  324  may change over time. 
     In one illustrative example, authorization information  326  in resource profile  324  may identify, for example, without limitation, any and all users who are authorized to access resource  130 . For example, authorization information  326  may include the user identifier for each user authorized to access resource  130 . In some cases, authorization information  326  may identify a user type and indicate that all users of that user type are authorized to access resource  130 . 
     Authorization information  326  may also indicate whether different users or user types are to be allowed different levels of access to resource  130 . For example, one user may be authorized to access all data provided by resource  130 , while another user may only be authorized to access a portion of the data provided by resource  130 . 
     In another illustrative example, authorization information  326  may include different permissions for access to resource  130  based on the roles of users. For example, authorization information  326  may indicate that all users having a particular type of role may have access to resource  130 . 
     In other illustrative examples, authorization manager  304  may request resource profile  324  that is specific to user  212  such that authorization information  326  is specific to user  212 . For example, authorization information  326  may indicate whether user  212  is authorized or not authorized to access resource  130 . Further, authorization information  326  may include different permissions for access to resource  130  based on role  311  of user  212 . 
     In some illustrative examples, authorization information  326  may indicate that user  212  is to be allowed different levels of access to the data provided by resource  130  based on role  311  of user  212 . For example, user  212  may be allowed to access a greater amount of data when role  311  of user  212  is a project manager role, as compared to when role  311  of user  212  is an observer role. 
     Each resource profile of plurality of resource profiles  322  may include authorization information similar to authorization information  326  described above. Once authorization manager  304  receives plurality of resource profiles  322  from plurality of interfaces  118  in communication with proxy server  122 , authorization manager  304  extracts an information section from each resource profile of plurality of resource profiles  322  that corresponds to user  212  to form plurality of information sections  328 . 
     Depending on the implementation, this information section may be the entirety of the authorization information in a resource profile or only a portion of the authorization information in the resource profile. Plurality of information sections  328  may then be aggregated to build new profile  320  for user  212 . 
     New profile  320  may include a plurality of context resource identifiers that reference plurality of interfaces  118 . Further, new profile  320  may include a set of permissions for user  212  that corresponds to each context resource identifier in the plurality of context resource identifiers. In one illustrative example, each permission in the set of permissions may correspond to a different possible role for user  212 . 
     Authorization manager  304  stores new profile  320  for user  212  in cache  312  for future use. New profile  320  may be stored in cache  312  along with logical expiration time  330 , physical expiration time  332 , or both. As used herein, an expiration time may include a calendar date, a time, or both. In one illustrative example, logical expiration time  330  and physical expiration time  332  are included in the header or metadata associated with new profile  320 . 
     Logical expiration time  330  may be the time at which new profile  320  may be considered no longer usable or reliable, even if new profile  320  is present in cache  312 . Physical expiration time  332  may be the time at which new profile  320  is to be deleted from cache  312 . In one illustrative example, logical expiration time  330  and physical expiration time  332  are the same. In another illustrative example, logical expiration time  330  and physical expiration time  332  are different. 
     Once new profile  320  has been created for user  212 , authorization manager  304  uses new profile  320  to determine whether user  212  is authorized to access resource  130 . In one illustrative example, authorization manager  304  uses new profile  320  to determine whether user  212  having role  311  is authorized to access resource  130 . Further, authorization manager  304  may also use new profile  320  to determine the level of access to resource  130  that user  212  having role  311  is to be allowed. 
     If user  212  having role  311  is not authorized to access resource  130 , authorization manager  304  sends error code  316  to message manager  302 . Message manager  302  may then send error response  318  to gateway  120  based on error code  316 . 
     However, if user  212  having role  311  is authorized to access resource  130 , router  306  routes message  308  to resource  130  using at least one endpoint reference of set of endpoint references  315 . Proxy server  122  then waits for a response from resource  130  that includes information requested by client  112  on behalf of user  212 . 
     In one illustrative example, proxy server  122  receives response message  224  from resource  130  containing information  226 . In some illustrative examples, authorization manager  304  filters out a portion of information  226  in response message  224 , transforms at least a portion of information  226  in response message  224 , or both to form modified information  334 . 
     Set of policies  335  may be used to filter information  226 , transform information  226 , or both. Set of policies  335  may include at least one of a request schema validation policy, a response schema validation policy, a configurable validation policy, a data privacy filter, a payload transformation policy, or some other type of policy or filter. 
     Message manager  302  then sends response message  224  containing modified information  334  to gateway  120 . Gateway  120  may then process response message  224  and send response message  224  to client  112 . 
     In some illustrative examples, information  226  contained in response message  224  is stored in data cache  336  of cache system  124 . In these examples, when a profile for user  212  is not present in cache  312 , new profile  320  is then dynamically built. However, the process of dynamically building new profile  320  may take a certain amount of time. Thus, it may be desirable to serve older information to client  112  until new profile  320  can be built and updated information can be obtained. 
     For example, without limitation, if a request for the information  226  that is already stored in data cache  336  is received from client  112  and a profile is not already present in cache  312 , information  226  stored in data cache  336  may be served to client  112  while new profile  320  is being built. Once new profile  320  has been built, user  212  is authorized and updated information is received at proxy server  122 . The updated information may then be sent to client  112  through gateway  120 . In this manner, the older information may be displayed to user  212  through client  112  until the updated information is served to client  112 . This type of process may enable user  212  to perform certain tasks more quickly. Further, this type of process may improve the overall performance of and efficiency of the tasks to be performed by user  212 . 
     The illustrations of enterprise system  100  in  FIG. 1 , gateway  120  in  FIGS. 1-3 , and proxy server  122  in  FIGS. 1-3  are not meant to imply physical or architectural limitations to the manner in which an illustrative embodiment may be implemented. Other components in addition to, or in place of, the ones illustrated may be used. Some components may be optional. Also, the blocks are presented to illustrate some functional components. One or more of these blocks may be combined, divided, or combined and divided into different blocks when implemented in an illustrative embodiment. 
     With reference now to  FIG. 4 , an illustration of a process for facilitating access to credit scores in an enterprise system is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 4  may be implemented using proxy server  122  described in  FIGS. 1-3 . 
     The process may begin by receiving, at a proxy server in an enterprise system, a request that includes a context resource identifier from a client (operation  400 ). In some cases, the request is received from the client through a gateway in communication with both the client and the proxy server. In other cases, the request is received at the proxy server directly from the client. 
     The proxy server then contacts an interface associated with a resource based on the context resource identifier (operation  402 ). In operation  402 , the interface is an application programming interface. 
     The proxy server receives a response from the interface in which the response includes an authorization indicator and a set of endpoint references for the resource (operation  404 ). Thereafter, the proxy server controls access to the resource associated with the interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server (operation  406 ). The user may be a financial institution, such as a bank, a lending company, or some other type of financial institution. 
     The proxy server then sends a response generated by the resource to the client in which the response includes a credit score for an entity that is based on a current financial state of the entity and in which controlling access to the resource based on the context resource identifier and the profile for the user increases a speed of access to the resource within the enterprise system (operation  408 ), with the process terminating thereafter. In operation  408 , the entity may be a business entity and the credit score may be based on at least one of a number of employees, a general ledger, an average size of payroll, a number of years in business, a financial standing of the business entity, a current tax state for the business entity, a business start date, an industry type, a status of funds, and a start date for joining the enterprise system. 
     With reference now to  FIG. 5 , an illustration of a process for facilitating communication between a client and a proxy server is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 5  may be implemented using gateway  120  described in  FIGS. 1-3 . 
     The process may begin by receiving, at a gateway, a message from a client in which the message includes a uniform resource identifier that references an interface associated with a resource (operation  500 ). In operation  500 , the message received may be a request that is requesting access to data, which is provided by the resource, on behalf of a user of the client. 
     The gateway transforms the uniform resource identifier into a context resource identifier that also references the interface (operation  502 ). The gateway performs an initial authorization check for the client and a user of the client with respect to the interface referenced by the context resource identifier (operation  504 ). 
     Thereafter, the gateway inserts the context resource identifier into the message to form a modified message in response to a successful initial authorization check (operation  506 ). The gateway checks a plurality of headers in the modified message based on a preapproved list of headers stored in a header data structure (operation  508 ). The gateway then filters out any header in the plurality of headers that is not on the preapproved list of headers from the modified message (operation  510 ). Thereafter, the gateway sends the modified message to the proxy server (operation  512 ), with the process terminating thereafter. 
     With reference now to  FIG. 6 , an illustration of a process for performing an initial authorization check is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process described in  FIG. 6  may be implemented using gateway  120  described in  FIGS. 1-3 . Further, the process described in  FIG. 6  may be used to implement operation  504  described in  FIG. 5 . 
     The process begins by determining whether a client is authorized to access an interface referenced by a context resource identifier that has been identified based on a message received from the client (operation  600 ). This context resource identifier may be, for example, the context resource identifier formed in operation  502  in  FIG. 5 . 
     If the client is not authorized to access the interface, an error code is generated (operation  602 ), with the process terminating thereafter. This error code may then be sent in a response message back to the client. 
     With reference again to operation  600 , if the client is authorized to access the interface, a determination is made as to whether the user is authorized to access the interface (operation  604 ). In one illustrative example, operation  604  may be performed by determining whether the user has a current and valid subscription to the resource associated with the interface. 
     If the user is not authorized to access the interface, the process proceeds to operation  602  described above. Otherwise, an access token is sent to the client (operation  606 ). 
     The process then waits to receive the access token back from the client (operation  608 ). The client and the user of the client are then both authenticated using the access token (operation  610 ), with the process terminating thereafter. 
     With reference now to  FIG. 7 , an illustration of a process for facilitating communication between a proxy server and a client is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process described in  FIG. 7  may be implemented using gateway  120  described in  FIGS. 1-3 . 
     The process begins by receiving a response message containing information provided by a resource from a proxy server (operation  700 ). A plurality of headers in the response message are checked based on a preapproved list of headers stored in a header data structure (operation  702 ). 
     Any header in the plurality of headers that is not on the preapproved list of headers is filtered out from the response message (operation  704 ). The response message is then sent to the client (operation  706 ), with the process terminating thereafter. 
     With reference now to  FIG. 8 , an illustration of a process for authorizing a user for access to a resource is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 8  may be implemented using proxy server  122  described in  FIGS. 1-3 . 
     The process begins by receiving a message that includes a context resource identifier from a client on behalf of a financial institution (operation  800 ). In operation  800 , the message may originate from the client and be directly sent from the client to the proxy server. However, in other illustrative examples, the message may be received through a gateway that is in communication with both the client and the proxy server. Further, the message may have been modified by the gateway to include the context resource identifier. 
     Next, a determination is made as to whether an interface that is referenced by the context resource identifier requires an authorization for the financial institution (operation  802 ). If authorization is not required, the message is routed to a resource that is associated with the interface based on a set of endpoint references for the resource (operation  804 ), with the process terminating thereafter. 
     The routing performed in operation  804  to the particular resource may be performed based on various routing parameters. These routing parameters may include, for example, without limitation, the type of the resource, a product subscription or service authorization associated with the resource, a service instance, one or more context parameters, or some other type of routing parameter. 
     With reference again to operation  802 , if authorization is required, a determination is made as to whether a profile exists for the financial institution in a cache that is in communication with the proxy server (operation  806 ). If a profile does exist for the financial institution in the cache, a determination is made as to whether the profile for the financial institution in the cache has expired (operation  808 ). In operation  808 , this determination may be made based on a logical expiration time associated with the profile for the financial institution. In some cases, this determination may be made based on a physical expiration by, for example, a deletion of the profile or a marker for the profile in the cache. 
     If the profile for the financial institution in the cache has not expired, a determination is made as to whether the financial institution is authorized to access the resource based on the profile in the cache and a role of the financial institution (operation  810 ). If the financial institution is authorized to access the resource, the process proceeds to operation  804  as described above. 
     Otherwise, if the financial institution is not authorized to access the resource, an error code is generated (operation  812 ), with the process terminating thereafter. In one illustrative example, this error code may then be sent to the client through the gateway in the form of an error response message. 
     With reference again to operation  806  and operation  808 , if either the profile for the financial institution does not exist in the cache or a profile for the financial institution in the cache has expired, the process dynamically builds a new profile for the financial institution (operation  814 ). The new profile for the financial institution is stored in the cache (operation  816 ). The process then proceeds to operation  810  described above. 
     With reference now to  FIG. 9 , an illustration of a process for dynamically building a new profile for a financial institution is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 9  may be implemented using proxy server  122  in  FIGS. 1-3 . Further, this process may be used to implement operation  814  described in  FIG. 8 . 
     The process begins by dynamically discovering a plurality of interfaces in communication with a proxy server (operation  900 ). A plurality of resource profiles are requested from the plurality of interfaces discovered (operation  902 ). 
     The process then waits to receive the plurality of resource profiles from the plurality of interfaces (operation  904 ). An information section corresponding to a financial institution is then extracted from the authorization information in each resource profile in the plurality of resource profiles to form a plurality of information sections (operation  906 ). Thereafter, the plurality of information sections are aggregated to form a new profile for the financial institution (operation  908 ), with the process then terminating thereafter. 
     With reference now to  FIG. 10 , an illustration of a process for sending a response with a credit score to a client is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 10  may be implemented by, for example, proxy server  122  described in  FIGS. 1-3 . 
     The process begins by the proxy server receiving a response that includes a credit score from a payroll engine through an application programming interface after a financial institution has been authorized for access to the payroll engine (operation  1000 ). Next, the response is filtered based on a data privacy filter to form a modified response (operation  1002 ). The modified response is then sent to the client for use by the financial institution (operation  1004 ), with the process terminating thereafter. 
     With reference now to  FIG. 11 , an illustration of a process for improving an efficiency of facilitating payroll through an enterprise system is depicted in the form of a flowchart in accordance with an illustrative embodiment. The process illustrated in  FIG. 11  may be implemented within enterprise system  100  described in  FIG. 1 . 
     The process begins by receiving a request to perform a payroll operation through a payroll engine from a first client used by a business entity (operation  1100 ). In one illustrative example, the request is received at the payroll engine directly from a first client being used by a business entity, such as a company or corporation. In other illustrative examples, the request may be received from the first client through a proxy server or through both a gateway and a proxy server. When the request is received through the proxy server, the request may include a context resource identifier. 
     Next, a proxy server establishes communications between the payroll engine and a second client being used by a financial institution (operation  1102 ). Operation  1102  may be performed in a number of ways. In one illustrative example, the payroll engine may send a request for access to the financial institution through the proxy server. The proxy server may control access to the financial institution. In some cases, the proxy server may request a message from the financial institution that includes a context resource identifier. The proxy server may then authorize communications between the payroll engine and the second client being used by the financial institution based on the context resource identifier and at least one of a profile for the business entity or a profile for the financial institution. 
     Thereafter, the payroll engine determines whether sufficient funds are available at the financial institution to perform the payroll operation (operation  1104 ). If sufficient funds are available, the payroll engine performs the payroll operation (operation  1106 ). The payroll engine may then generate and send a report that includes information generated during the payroll operation to the first client for use by the business entity (operation  1108 ), with the process terminating thereafter. This information may include, for example, without limitation, a balance of funds remaining after the completion of the payroll operation, a summary of the payroll operation performed, or some other type of information. 
     With reference again to operation  1104 , if sufficient funds are not available, the payroll engine performs a credit line operation (operation  1110 ). The payroll engine then generates and sends a report that includes information generated during the credit line operation to the first client for use by the business entity (operation  1112 ), with the process terminating thereafter. 
     Performing the credit line operation in operation  1110  may include establishing a line of credit or obtaining a loan for the business entity. In some cases, the credit line operation may also include making one or more payroll payments after the line of credit has been established or the loan has been obtained. 
     In some illustrative examples, performing the credit line operation in operation  1110  may include establishing communications between the payroll engine and multiple financial institutions in order to establish a single line of credit or multiple lines of credit. For example, a profile for the business entity may list a number of financial institutions with which the business entity has accounts or that the business entity has worked with in the past. If a first financial institution on the list denies a loan to the business entity, the payroll engine may then establish communications with a second financial institution on the list through the proxy server. 
     In other illustrative examples, performing the credit line operation in operation  1110  may include generating a payroll credit score for the business entity, determining whether the payroll credit score meets a threshold, and then establishing a line of credit through the financial institution if the payroll credit score meets the threshold. For example, the financial institution may have instructions from previous dealings to automatically provide a loan or line of credit to the business entity if the payroll credit score is at or above a selected threshold. 
     With reference to the process described in  FIG. 11 , establishing the communications between the payroll engine and the financial institution through the proxy server increases the efficiency and speed of performing the payroll operation. In particular, by providing a secure method for establishing communications between the payroll engine and the financial institution, payroll operations and credit line operations may be performed without requiring that the business entity and the financial institution establish direct communications between each other. 
     The flowcharts and block diagrams in the different depicted embodiments illustrate the architecture, functionality, and operation of some possible implementations of apparatuses and methods in an illustrative embodiment. In this regard, each block in the flowcharts or block diagrams may represent a module, a segment, a function, and/or a portion of an operation or step. 
     In some alternative implementations of an illustrative embodiment, the function or functions noted in the blocks may occur out of the order noted in the figures. For example, in some cases, two blocks shown in succession may be executed substantially concurrently, or the blocks may sometimes be performed in the reverse order, depending upon the functionality involved. Also, other blocks may be added in addition to the illustrated blocks in a flowchart or block diagram. 
     Turning now to  FIG. 12 , an illustration of a data processing system in the form of a block diagram is depicted in accordance with an illustrative embodiment. Data processing system  1200  may be used to implement proxy server  122 , gateway  120 , or both from  FIGS. 1-3 . As depicted, data processing system  1200  includes communications framework  1202 , which provides communications between processor unit  1204 , storage devices  1206 , communications unit  1208 , input/output unit  1210 , and display  1212 . In some cases, communications framework  1202  may be implemented as a bus system. 
     Processor unit  1204  is configured to execute instructions for software to perform a number of operations. Processor unit  1204  may comprise a number of processors, a multi-processor core, and/or some other type of processor, depending on the implementation. In some cases, processor unit  1204  may take the form of a hardware unit, such as a circuit system, an application specific integrated circuit (ASIC), a programmable logic device, or some other suitable type of hardware unit. 
     Instructions for the operating system, applications, and/or programs run by processor unit  1204  may be located in storage devices  1206 . Storage devices  1206  may be in communication with processor unit  1204  through communications framework  1202 . As used herein, a storage device, also referred to as a computer readable storage device, is any piece of hardware capable of storing information on a temporary and/or permanent basis. This information may include, but is not limited to, data, program code, and/or other information. 
     Memory  1214  and persistent storage  1216  are examples of storage devices  1206 . Memory  1214  may take the form of, for example, a random access memory or some type of volatile or non-volatile storage device. Persistent storage  1216  may comprise any number of components or devices. For example, persistent storage  1216  may comprise a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage  1216  may or may not be removable. 
     Communications unit  1208  allows data processing system  1200  to communicate with other data processing systems and/or devices. Communications unit  1208  may provide communications using physical and/or wireless communications links. 
     Input/output unit  1210  allows input to be received from and output to be sent to other devices connected to data processing system  1200 . For example, input/output unit  1210  may allow user input to be received through a keyboard, a mouse, and/or some other type of input device. As another example, input/output unit  1210  may allow output to be sent to a printer connected to data processing system  1200 . 
     Display  1212  is configured to display information to a user. Display  1212  may comprise, for example, without limitation, a monitor, a touch screen, a laser display, a holographic display, a virtual display device, and/or some other type of display device. 
     In this illustrative example, the processes of the different illustrative embodiments may be performed by processor unit  1204  using computer-implemented instructions. These instructions may be referred to as program code, computer usable program code, or computer readable program code and may be read and executed by one or more processors in processor unit  1204 . 
     In these examples, program code  1218  is located in a functional form on computer readable media  1220 , which is selectively removable, and may be loaded onto or transferred to data processing system  1200  for execution by processor unit  1204 . Program code  1218  and computer readable media  1220  together form computer program product  1222 . In this illustrative example, computer readable media  1220  may be computer readable storage media  1224  or computer readable signal media  1226 . 
     Computer readable storage media  1224  is a physical or tangible storage device used to store program code  1218 , rather than a medium that propagates or transmits program code  1218 . Computer readable storage media  1224  may be, for example, without limitation, an optical or magnetic disk or a persistent storage device that is connected to data processing system  1200 . 
     Alternatively, program code  1218  may be transferred to data processing system  1200  using computer readable signal media  1226 . Computer readable signal media  1226  may be, for example, a propagated data signal containing program code  1218 . This data signal may be an electromagnetic signal, an optical signal, and/or some other type of signal that can be transmitted over physical and/or wireless communications links. 
     The illustration of data processing system  1200  in  FIG. 12  is not meant to provide architectural limitations to the manner in which the illustrative embodiments may be implemented. The different illustrative embodiments may be implemented in a data processing system that includes components in addition to or in place of those illustrated for data processing system  1200 . Further, components shown in  FIG. 12  may be varied from the illustrative examples shown. 
     Thus, the illustrative embodiments provide a method and apparatus for facilitating payroll processing by making communications and access to information between payroll engines and financial institutions easier, faster, and more efficient. The illustrative embodiments recognize and take into account that a proxy server may be used to facilitate access to resources, such as payroll engines. The proxy server may be a multi-purpose, dynamic proxy server. In some cases, the proxy server may be referred to as a web proxy server, an application programming interface (API) proxy server, or an intelligent application programming interface (API) proxy server. 
     The proxy server may decouple communication between application programming interfaces (APIs) and the clients. In computer programming, an API is a set of routines, protocols, or tools used for building software applications. An API may express a software component in terms of its operations, inputs, outputs, and underlying types. An API may define functionalities that are independent of their respective implementations, which allows definitions and implementations to vary without compromising an interface. An API may make developing a software program easier by providing the building blocks for the software program. A programmer, or another software program, can then put the blocks together. 
     The proxy server may dynamically discover application programming interfaces associated with resources that are connected to the proxy server and build authorization profiles for users as desired based on requests for access to the resources that are received from clients. In this manner, the proxy server may provide a way for dynamically authorizing access to resources that reduces time delays typically associated with authorization processes. 
     The proxy server may improve the efficiency of and reduce the time involved in managing authorizations of clients and authorizations of the users of the clients. In this manner, the overall time taken by a user to perform a task using a particular resource may be reduced. Thus, overall performance and operational efficiency of the user and an entity, such as a business entity to which the user belongs, may be improved. 
     As one illustrative example, managing the accessing of a group of human resource services by client applications being used by multiple employees and employers may be more time-consuming than desired, may require more processing resources than desired, and may slow down or impede communications network traffic more than desired. The illustrative embodiments recognize and take into account that a proxy server that is capable of building profiles for users of the client applications and dynamically updating those profiles over time in response to changes in the application programming interfaces associated with the human resource services may be desirable. 
     In one illustrative example, the proxy server provided by the illustrative embodiments may process requests for access to the human resource services based on dynamic discovery of application programming interfaces connected to the proxy server at the time the request is processed. In this manner, these profiles may be updated over time to keep up with changes or modifications to these application programming interfaces. The profiles may be used to generate responses to requests for access to the human resource services that may be sent to the client applications. These responses contain the data requested by the client applications. 
     The illustrative embodiments also provide a gateway for facilitating communication between clients and the proxy server. The gateway may be used to provide an initial level of authorization for a client and a user of the client prior to any request being sent from a client to the proxy server. Further, the gateway may also be used to transform the uniform resource identifier (URI) in a message requesting access to a resource referenced by the uniform resource identifier into a context resource identifier. 
     A uniform resource identifier may take the form of a web address, a universal resource identifier, a uniform resource locator, or some other type of identifier. The illustrative embodiments recognize that uniform resource identifiers that reference application programming interfaces, and thereby, the resources associated with these application programming interfaces, may change over time. Consequently, it may be desirable to have a fixed way of referencing these resources. 
     The gateway may transform each uniform resource identifier into a context resource identifier. The context resource identifier provides consistent naming for the resource. The context resource identifier may be represented or defined within the scope of a larger domain for an entity. For example, when the entity is a business entity involved with human capital management (HCM), the context resource identifier may be represented or defined within the scope of the human capital management. 
     The uniform resource identifier and the context resource identifier may both reference the same resource, but only the context resource identifier may remain unchanged over time. In this manner, the proxy server may not need to track changes to the uniform resource identifiers over time. The proxy server may use the context resource identifier to call an application programming interface. 
     In this manner, the illustrative embodiments provide a method and apparatus for facilitating communications between clients and resources. The illustrative embodiments provide an intelligent application programming interface proxy server that automatically discovers authorization application programming interfaces for connected resources, builds a profile for a user for the connected resources, and authorizes the user for access on behalf of connected resources accordingly. The authorization provided by the intelligent, dynamic proxy server described above may dynamically discover authorization needs or desires for connected resources and build a profile for a user for authorization with all connected resources, greatly reducing time of development. 
     Further, the illustrative embodiments provide a gateway that decouples the dynamic proxy server from the clients. The gateway helps facilitate communications between the client and the dynamic proxy server. 
     The illustrative embodiments provide a proxy server and a gateway that form a system for managing access to resources that is both dynamic and distributed. In particular, this system allows participants, which may include resources, clients, or both, to join or leave the system in an organic fashion. The dynamic proxy server described by the illustrative embodiments allows the overall system to be organic and fluid in that clients and resources may join and leave over time. In some illustrative examples, a uniform interface may be used for implementing dynamic discovery and learning mechanisms to allow, for example, the proxy server to learn about new participants and dynamically add these participants to a corresponding network. Thus, the system may be scalable over time. 
     The description of the different illustrative embodiments has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the embodiments in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. Further, different illustrative embodiments may provide different features as compared to other desirable embodiments. The embodiment or embodiments selected are chosen and described in order to best explain the principles of the embodiments, the practical application, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.