Epicor Kinetic and Tipalti integration

What moves between them

Vendor master data and invoices flow from Epicor Kinetic into Tipalti for supplier onboarding and invoice processing. Purchase orders also move from Epicor into Tipalti to enrich the payment batch process. Payment events from Tipalti flow back into Epicor Kinetic via webhook, updating APPayment records with confirmation status and transaction IDs. The sync runs on a schedule you set, with optional webhook ingestion for real-time payment status updates.

How ml-connector handles it

ml-connector stores both credential sets encrypted and translates Epicor OData query filters into polling calls on a schedule to fetch new vendors and invoices. On the Tipalti side it computes the HMAC-SHA256 signature for every SOAP call using the payer_name and api_key, and verifies incoming webhook signatures with the same algorithm to ensure authenticity. When payment events arrive via webhook, ml-connector maps Tipalti payment batch IDs and confirmation numbers back to Epicor APPayment records using vendor and invoice cross-references. Epicor API keys expire in roughly one hour if using Bearer tokens, so ml-connector refreshes before each call. Tipalti single IPN endpoint means all event types arrive at one URL, so ml-connector filters events in code. Because Epicor has no idempotency-key header support, deduplication relies on business object uniqueness constraints, so duplicate payloads are blocked at the database level. Every record carries a full audit trail and can be replayed if a downstream Epicor write fails.

A real-world example

A mid-sized distributor runs Epicor Kinetic for order-to-cash and accounts payable, and uses Tipalti for global supplier payments and tax compliance across 40 countries. Before the integration, the AP team entered vendor master data from Epicor into Tipalti by hand, matched invoices in both systems manually each week, and recorded payment confirmations from Tipalti back into Epicor as custom notes, creating manual touch points and reconciliation drift. With Epicor Kinetic and Tipalti connected, vendor setup flows automatically from Epicor into Tipalti, invoices post to Tipalti in real time, and payment confirmations flow back to Epicor as native APPayment records. The AP team now focuses on exception handling instead of data re-entry, and payment reconciliation is automatic.

What you can do

• •Sync Epicor Kinetic vendor master data into Tipalti for automated supplier onboarding and tax form collection.
• •Push invoices and purchase orders from Epicor Kinetic to Tipalti for payment batch processing.
• •Receive payment status notifications from Tipalti via webhook and update Epicor Kinetic APPayment records with confirmation details.
• •Authenticate Epicor Kinetic via OAuth2, Basic Auth, or Token Resource Service, and Tipalti via HMAC-SHA256 SOAP signatures.
• •Poll Epicor Kinetic on a schedule using OData filters to capture only changed records, with full audit trail and replay on error.

Questions

How does the integration handle the difference between Epicor OData polling and Tipalti webhook architecture?

ml-connector polls Epicor Kinetic on a schedule you set, using OData date filters to fetch only new and updated records since the last run. Tipalti publishes real-time events via IPN webhooks to a single account-wide endpoint that ml-connector receives and verifies using HMAC-SHA256 signatures. This hybrid approach combines Epicor pull-based model with Tipalti push-based event notifications.

Which vendor and invoice data moves from Epicor to Tipalti, and does payment data move back?

Vendor master records, APInvoices, and purchase orders flow from Epicor Kinetic to Tipalti for onboarding and payment processing. Payment status and confirmation details flow back from Tipalti to Epicor Kinetic to update APPayment records, but the actual invoice amounts and GL coding remain read-only in Tipalti and are not written back.

How does ml-connector authenticate with both systems given their different auth schemes?

Epicor Kinetic uses OAuth2 client credentials, Basic Auth with API Key, or Token Resource Service (on-prem), and ml-connector stores and refreshes credentials as needed. Tipalti SOAP calls require HMAC-SHA256 signatures computed from payer_name and api_key, and incoming webhook events are verified with the same signature algorithm. ml-connector manages both authentication models transparently.