DATEV and SAP SuccessFactors integration

What moves between them

The flow runs from SAP SuccessFactors into DATEV. ml-connector reads worker, compensation, cost center, and department records from SuccessFactors and posts the derived labor cost journals into DATEV as EXTF booking batches, with each line carrying the matching DATEV cost center and account. Cost center and department reference data is aligned so every booking lands on a valid dimension, and any employee whose reimbursements need a creditor record is written into the EXTF master data rows. DATEV cannot return posted journals, so the SuccessFactors side stays the source of HR truth and ml-connector never writes employee or org data back into SuccessFactors.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the SuccessFactors side it signs a SAML assertion with the customer's RSA private key, exchanges it for a Bearer token, and refreshes the token before its 24-hour expiry, calling the datacenter-specific host for that tenant; a missing Role-Based Permission shows up as a 403 rather than a 401, so the integration user needs grants for each entity it reads. On the DATEV side it runs the PKCE Authorization Code flow against Login mit DATEV, keeps the state parameter at least 20 characters, and refreshes the 900-second access token sending only the client_id. SuccessFactors is read by delta sync on lastModifiedDateTime with $top set to 1000 so records are not silently missed, and Intelligent Services events can trigger an immediate pull where they are configured. Cost centers and departments are mapped first, so every EXTF line references a DATEV cost center that already exists, and the chart of accounts is configured up front because DATEV does not expose it for reading. Each EXTF file is submitted as an asynchronous job and polled with exponential backoff until it completes, with deterministic filenames so a retry reuses the same name and DATEV's duplicate check does not reject a safe re-submit. Employees are deactivated, not deleted, in SuccessFactors, so termination logic keys on status changes, and every record carries a full audit trail and can be replayed if a DATEV job fails.

A real-world example

A German engineering firm of roughly 400 staff across two sites runs DATEV through its tax advisor for bookkeeping and uses SAP SuccessFactors Employee Central as the HR system of record. Before the integration, an accountant exported a payroll cost summary each month and typed the labor totals into DATEV by hand, splitting them across cost centers from a spreadsheet that drifted out of date whenever a department was renamed or a worker moved sites. With DATEV and SAP SuccessFactors connected, each period's labor cost journal is built from SuccessFactors data and submitted to DATEV as an EXTF batch allocated to the correct cost center, and worker and department changes keep the allocation current. The manual re-keying is gone and the cost center splits in the ledger match the HR records.

What you can do

• •Post labor cost journals derived from SAP SuccessFactors into DATEV as EXTF booking batches.
• •Map SAP SuccessFactors cost centers and departments to DATEV cost centers so every booking line lands on a valid dimension.
• •Read workers and compensation from SAP SuccessFactors by OData delta sync on lastModifiedDateTime.
• •Bridge the SAP SuccessFactors SAML Bearer token and DATEV's PKCE user-consent OAuth login.
• •Submit each DATEV EXTF job, poll it with backoff, and keep a full audit trail with replay on every record.

Questions

Which direction does data move between DATEV and SAP SuccessFactors?

The flow is SAP SuccessFactors into DATEV. Worker, compensation, cost center, and department data moves from SuccessFactors into DATEV, where ml-connector posts the labor cost journals as EXTF booking batches. DATEV's EXTF import is write-only and posted journals cannot be read back, so ml-connector never writes HR or financial data back into SuccessFactors.

Does SAP SuccessFactors hold invoices or GL accounts that post into DATEV?

No. SAP SuccessFactors is an HCM system with no invoice, purchase order, or general ledger objects. What it provides is workers, jobs, compensation, and cost center codes in EmpJob and FOCostCenter, and ml-connector maps that into DATEV as booking lines against cost centers rather than as ledger accounts, since DATEV does not expose its chart of accounts for reading.

How does the integration handle authentication on each side?

On the SuccessFactors side ml-connector signs a SAML assertion with the customer's RSA private key and exchanges it for a Bearer token that lasts up to 24 hours, and the API user must also hold Role-Based Permissions for each entity. On the DATEV side it uses the OAuth 2.0 Authorization Code flow with PKCE through Login mit DATEV, which requires interactive consent from the tax advisor or client and a 15-minute access token that is refreshed automatically.