Acumatica and Basware integration

What moves between them

The primary flow runs from Basware into Acumatica. After an invoice is coded, matched, and approved in Basware, ml-connector reads it from accountingDocuments and creates the matching AP Bill in Acumatica, mapped to the right vendor, GL accounts, and cost dimensions, then acknowledges the transfer back to Basware. Reference data flows the other direction: Acumatica vendors, GL accounts, and cost dimensions are imported into Basware so its coding panel only offers valid values, and purchase orders can be imported to enable matching. When a payment is recorded against the Bill in Acumatica, ml-connector posts a payment response back into Basware, since Basware does not initiate payments itself.

How ml-connector handles it

ml-connector stores both credential sets encrypted and runs two auth bridges at once: it requests a fresh Basware bearer token before expiry, since the client-credentials flow has no refresh token, and it manages the Acumatica OAuth token against the tenant-specific identity server. Every Acumatica write wraps field values in value objects and targets the exact endpoint version the customer runs, because a version mismatch returns a 404. Approved invoices arrive either by Basware HMAC-SHA256 webhook, whose X-BWAPI-Signature-256 header is verified against the UTF-8 body, or by polling accountingDocuments, paging with the continuation response header. Vendor, account, and dimension imports run first so every Bill posts against values that already exist on both sides. Acumatica push notifications carry no HMAC, so changed master data is read by polling on LastModifiedDateTime with a stored high-water mark. Acumatica rate limits return 429 near the licensed per-minute ceiling and Basware may throttle high volume, so ml-connector backs off with jitter and retries. Two gotchas are handled directly: Basware silently skips an import identical to the prior version, so a field must change to retrigger, and Basware overwrites manual UI edits on the next import, so the connector is the system of record for what it pushes.

A real-world example

A mid-sized distribution company running Acumatica Cloud ERP for finance and purchasing rolls out Basware to automate accounts payable across several warehouses. Before the integration, AP clerks approved invoices in Basware and then re-keyed each one into Acumatica as a Bill, while the GL accounts and cost centers shown in Basware drifted out of step with the Acumatica chart of accounts, so coding errors piled up at month end. With Acumatica and Basware connected, approved invoices post into Acumatica automatically against the correct vendor and accounts, and the chart of accounts and cost dimensions are pushed into Basware nightly so coders only see valid values. The re-keying step disappears and month-end close starts with AP already in agreement.

What you can do

• •Post approved Basware invoices into Acumatica as AP Bills, mapped to the right vendor and GL accounts.
• •Import Acumatica vendors, GL accounts, and cost dimensions into Basware so its coding panel only offers valid values.
• •Acknowledge each transfer back to Basware and post payment responses when Acumatica records the payment.
• •Bridge Basware client-credentials tokens and Acumatica OAuth on the customer's version-locked, region-specific endpoints.
• •Verify Basware HMAC-SHA256 webhooks or poll on LastModifiedDateTime, with backoff, retries, and a full audit trail.

Questions

Which direction does data move between Acumatica and Basware?

The primary flow is Basware into Acumatica: coded, approved invoices become AP Bills in Acumatica. Master data moves the other way, with Acumatica vendors, GL accounts, and cost dimensions imported into Basware to keep coding valid. When a payment is recorded in Acumatica, a payment response is posted back to Basware, which does not initiate payments itself.

How does the integration handle Acumatica's version-locked endpoints and field wrapping?

ml-connector accepts the customer's exact endpoint version and tenant URL, since an Acumatica version mismatch returns a 404. Every Acumatica field value is wrapped in a value object on write, because flat key-value pairs are rejected. Both rules are applied automatically so Bills and master data post cleanly against the running ERP release.

How are Basware tokens and webhook security handled?

Basware uses OAuth2 client credentials with a bearer token valid about an hour and no refresh token, so ml-connector requests a fresh token before each one expires. Inbound Basware webhooks are signed with HMAC-SHA256 in the X-BWAPI-Signature-256 header, verified against the raw UTF-8 body before processing. Where webhooks are not configured, ml-connector polls accountingDocuments on a schedule instead.