How does ml-connector route requests to the correct Exact Online region?

Exact Online publishes region-specific base URLs (Netherlands, Belgium, UK, Germany, France, Spain, USA). ml-connector stores the customer's assigned region in configuration, and all API calls use the matching base URL. The division ID, required for every API call, is fetched fresh from the customer's user endpoint on the same region.

What happens if a vendor from Basware does not exist in Exact Online?

ml-connector can create new supplier accounts in Exact Online's Accounts entity on first sight of a new vendor in Basware. The vendor name and contact details are mapped from Basware into Exact Online's supplier fields. If auto-creation is disabled, the invoice is blocked with an error in the audit log until the vendor is manually created in Exact Online.

Why does Exact Online require a re-authorization after 30 days?

Exact Online's refresh tokens expire after 30 days if not used. ml-connector monitors token age during normal operation and surfaces a reauth reminder when the token is within 5 days of expiry, so the customer can refresh the OAuth grant before the session becomes invalid.

Exact OnlineBasware

Exact Online and Basware integration

Exact Online runs accounting, purchasing, and inventory for SMEs across Europe and North America. Basware handles the full AP automation and invoice lifecycle. Connecting the two keeps purchase orders and invoices synchronized without re-entry, so your accounting team approves invoices in Basware while the same records flow automatically into Exact Online's purchasing and GL. ml-connector bridges the regional differences, handles the OAuth2 handoff on each side, and maps vendors and accounts across the systems.

How Exact Online works

Basware exposes purchase orders, purchase requisitions, invoices, vendors, contracts, and dimension tables through REST APIs secured with OAuth2 Client Credentials. It supports both webhooks for P2P events (purchase orders, invoices, exports) and pull-based polling for the Network and Data Access APIs. Webhook payloads are signed with HMAC-SHA256. Basware is deployed regionally (EU, US, AU, CA) and credentials are provisioned by Basware delivery consultants, not self-serve. The Network API requires a unique request ID header on every call.

How Basware works

Exact Online exposes accounts, purchase orders, purchase invoices, GL accounts, cost centers, items, and journal entries through REST APIs with OData v3 query syntax. It authenticates via OAuth2 Authorization Code Grant with a 10-minute access token lifetime and 30-day rotating refresh token. Every API call requires a division ID, which is fetched from the current user endpoint. Exact Online is deployed regionally (Netherlands, Belgium, UK, Germany, France, Spain, USA). Webhooks are supported for purchase orders, invoices, accounts, and other resources, though the webhook payload contains only the entity key and action - full data must be fetched via REST in a second call.

What moves between them

The main flow is from Basware into Exact Online. When a purchase order or invoice is created or updated in Basware, the webhook fires with the record ID. ml-connector fetches the full details from Basware, maps the vendor to an Exact Online supplier account, maps invoice lines to GL accounts and cost centers, and writes the purchase order or invoice into Exact Online. Vendor master data flows from Basware into Exact Online's Accounts entity as suppliers. Cost center and GL account validation happens before any write to catch mismatches early.

How ml-connector handles it

ml-connector manages two independent OAuth2 flows: for Exact Online, it exchanges the authorization code once at setup, then refreshes the token on each call if the 10-minute lifetime has expired; for Basware, it uses Client Credentials to request a token on each session, respecting the configurable 1-hour default. On the Basware side it validates the webhook signature using HMAC-SHA256 and the registered secret. When a purchase order or invoice webhook arrives from Basware, ml-connector routes the customer to the correct Exact Online region based on stored configuration, fetches the division ID from the user endpoint (required for all Exact calls), fetches the full invoice or PO from Basware, and writes it into Exact Online. Vendor names from Basware are looked up in Exact Online's Accounts entity using IsSupplier=true to find the matching supplier. If a vendor does not yet exist in Exact Online, the integration can create one. Dimension mapping (cost center, GL account) is done before the write, and any mismatch blocks the record with a detailed error in the audit log. Basware's Network API requires a unique X-BW-REQUEST-ID header (UUID v4) on every call, which ml-connector generates and includes. Refresh tokens in Exact Online must be used at least once every 30 days or the user must re-authorize, so the integration also checks token age and surfaces a reauth reminder when nearing the 30-day window.

A real-world example

A mid-sized manufacturing distributor in Germany uses Exact Online for accounting and purchasing, and Basware for AP automation and e-invoicing with its suppliers. Before the integration, the AP team approved invoices in Basware, then the accounting team exported a CSV and manually entered the invoices into Exact Online's purchase invoice module, line by line. The GL coding was re-done to match Exact's cost center structure, and month-end reconciliation revealed systematic coding differences. With Exact Online and Basware connected, each approved invoice in Basware triggers an automatic entry into Exact Online, already coded to the right GL accounts and cost centers, and the accounting team's month-end close starts with the invoices already matching between the two systems.

What you can do

Receive purchase orders and invoices from Basware via webhook and write them into Exact Online's purchasing and accounting modules.
Map vendors from Basware to Exact Online supplier accounts and create new suppliers automatically if they do not yet exist.
Route API calls to the correct Exact Online region (Netherlands, Belgium, UK, Germany, France, Spain, or USA) based on customer configuration.
Validate GL accounts and cost centers in Exact Online before writing any invoice, and block records with detailed errors if dimensions do not exist.
Authenticate Exact Online with OAuth2 Authorization Code, refresh the token on each call, and monitor refresh token expiry to trigger re-authorization before the 30-day window closes.

Questions

How does ml-connector route requests to the correct Exact Online region?: Exact Online publishes region-specific base URLs (Netherlands, Belgium, UK, Germany, France, Spain, USA). ml-connector stores the customer's assigned region in configuration, and all API calls use the matching base URL. The division ID, required for every API call, is fetched fresh from the customer's user endpoint on the same region.
What happens if a vendor from Basware does not exist in Exact Online?: ml-connector can create new supplier accounts in Exact Online's Accounts entity on first sight of a new vendor in Basware. The vendor name and contact details are mapped from Basware into Exact Online's supplier fields. If auto-creation is disabled, the invoice is blocked with an error in the audit log until the vendor is manually created in Exact Online.
Why does Exact Online require a re-authorization after 30 days?: Exact Online's refresh tokens expire after 30 days if not used. ml-connector monitors token age during normal operation and surfaces a reauth reminder when the token is within 5 days of expiry, so the customer can refresh the OAuth grant before the session becomes invalid.

Connect Exact Online and Basware

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started