Epicor Kinetic and Basware integration

What moves between them

The main flow runs from Basware into Epicor Kinetic. When Basware fires an AccountingDocuments notification, ml-connector reads the coded and approved invoice and posts it into Epicor as an AP invoice with its GL coding lines. Master data flows the other way: Epicor vendors, GL accounts, and cost-center dimensions are imported into Basware so coders pick from valid values. Purchase order references are carried so Basware matching and the Epicor PO line up. Once Epicor records payment, ml-connector confirms it back to Basware through the payment response endpoint, since Basware initiates no payments itself.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Basware side it requests an OAuth2 bearer token against the customer region URL and refreshes it near the one-hour expiry, and it verifies every webhook by recomputing the HMAC-SHA256 over the raw UTF-8 body against the subscription token and checking the timestamp before acting. On the Epicor side it sends Basic credentials plus the x-api-key header against the company-scoped tenant URL, and posts AP invoices through UpdateMaster so the expense and GL lines commit in one call, avoiding the known empty-account bug on the per-line endpoint. Vendors, GL accounts, and dimensions are mapped and imported into Basware first, so coding only references accounts that exist. Because Epicor has no webhooks, ml-connector polls Epicor with an OData modified-date filter and top and skip paging, while Basware drives invoice posting by push. Epicor publishes no idempotency header, so re-reading the same invoice is deduplicated on its document id and a BullMQ job id, and Epicor's own uniqueness on invoice number plus vendor blocks a true duplicate. Basware silently skips unchanged master records on import, and continuation tokens for its paging are read from the response header. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized industrial equipment manufacturer with around 600 employees runs Epicor Kinetic for production, procurement, and finance, and rolls out Basware so plant and office staff can capture and approve supplier invoices through a single coding workflow. Before the integration, an AP clerk opened each approved invoice in Basware and re-keyed it into Epicor by hand, which delayed posting, introduced coding mistakes, and left the vendor lists in the two systems slowly drifting apart. With Epicor Kinetic and Basware connected, each approved invoice posts into Epicor as an AP invoice against the right GL accounts and cost centers, vendors and accounts stay aligned, and payment status flows back. The re-keying step is gone and the AP ledger reconciles against both systems.

What you can do

• •Post coded and approved Basware invoices into Epicor Kinetic as AP invoices through the UpdateMaster call.
• •Import Epicor vendors, GL accounts, and cost-center dimensions into Basware so coding lands on valid values.
• •Verify each Basware webhook by HMAC-SHA256 and post the invoice as soon as it is ready for transfer.
• •Authenticate Basware with OAuth2 client credentials and Epicor with Basic plus its API key.
• •Confirm paid invoices back to Basware and replay any record from a full audit trail on failure.

Questions

Which direction does data move between Epicor Kinetic and Basware?

The main flow is Basware into Epicor Kinetic. Coded and approved invoices move from Basware and post into Epicor as AP invoices, while vendors, GL accounts, and cost-center dimensions are imported from Epicor into Basware so coding stays valid. Once Epicor records the payment, ml-connector confirms it back to Basware, which initiates no payments on its own.

How does the integration handle Basware webhooks and Epicor's lack of them?

Basware pushes signed notifications such as AccountingDocuments when an invoice is ready for transfer, and ml-connector verifies each one by recomputing the HMAC-SHA256 over the raw body before posting to Epicor. Because Epicor Kinetic has no native webhooks, ml-connector reads Epicor by polling its OData endpoints with a modified-date filter on a schedule you control.

Why are AP invoices posted to Epicor through UpdateMaster?

Epicor's per-line GL endpoint has a known bug that can leave accounts empty on current versions. ml-connector posts the invoice header, expense lines, and GL coding in a single UpdateMaster call so the lines commit together. Epicor also enforces uniqueness on invoice number plus vendor, which blocks a duplicate even if the same Basware document is read twice.