How does ml-connector handle SAP Concur's multi-datacenter architecture?

When the SAP Concur OAuth token is issued, it includes a geolocation field indicating the correct datacenter (US, EMEA, or China). ml-connector pins all subsequent API calls to that base URL for the token's 1-hour lifetime and refreshes the token when it expires. If the user's datacenter changes, a new OAuth exchange updates the routing.

Does FreshBooks require Client Credentials OAuth, or can user-delegated tokens work?

FreshBooks supports user-delegated Authorization Code grant only; Client Credentials is not available. ml-connector uses the user-delegated flow and stores the long-lived refresh token encrypted, so the integration does not require the original user to re-authenticate for each sync cycle.

What happens if a FreshBooks webhook times out or SAP Concur rejects a Payment Request?

ml-connector retries failed webhook deliveries up to 5 times with exponential backoff. If SAP Concur returns an error (invalid vendor, missing cost code), the transaction is logged with full details and can be replayed once the underlying issue is fixed and the record is resubmitted.

FreshBooksSAP Concur

FreshBooks and SAP Concur integration

FreshBooks tracks invoicing, expenses, and client billing for small businesses. SAP Concur handles employee expenses, travel approvals, and vendor invoice processing across a global organization. Connecting the two systems keeps vendor records aligned and moves approved expenses into FreshBooks for accurate cost accounting without manual re-entry. FreshBooks invoices can flow into SAP Concur as vendor records and payment requests, while SAP Concur's expense and invoice approvals post back into FreshBooks as journal entries for month-end reconciliation.

How FreshBooks works

FreshBooks exposes clients, invoices, expenses, bills, bill vendors, payments, journal entries, and chart of accounts through REST APIs rooted at https://api.freshbooks.com. Authentication uses OAuth 2.0 Authorization Code grant (user-delegated, not client credentials), and FreshBooks delivers real-time notifications through webhooks signed with HMAC-SHA256. Webhook events include invoice.create, invoice.update, expense.create, bill.create, bill.update, and many others across the full entity lifecycle. Webhook delivery is asynchronous and can take seconds to minutes; each attempt times out at 10 seconds. Status fields on invoices and payments are computed by the system and cannot be written directly.

How SAP Concur works

SAP Concur exposes vendors, invoices (called Payment Requests), purchase orders, expense reports, and financial integration documents (for expense, invoice, cash advance, and payroll entries) through REST APIs spread across multiple geographic datacenters (US, EMEA, China). Authentication uses OAuth 2.0 with a company-level password grant flow that returns a geolocation identifier; all subsequent API calls must route through that datacenter's base URL. SAP Concur pushes expense report, invoice, and user updates through an Event Subscription Service with at-least-once delivery and mutual TLS certificate verification. The platform also supports direct pull requests for expense reports, vendors, and financial documents.

What moves between them

The main flow captures FreshBooks invoices and expenses through webhooks, transforms them into SAP Concur vendors and Payment Requests, and pushes them into the matching SAP Concur datacenter. SAP Concur can also push approved expense reports and financial integration documents back to FreshBooks as journal entries tied to the original expense or invoice. Reference data such as vendor names and cost codes are mapped bidirectionally so expenses land on valid accounts. The sync runs in near-real-time from FreshBooks (webhook-driven) and pulls SAP Concur financial documents on a schedule aligned with the expense approval cycle.

How ml-connector handles it

ml-connector manages two separate OAuth 2.0 credentials: FreshBooks (user-delegated) and SAP Concur (company-level password grant). When the SAP Concur token is issued, ml-connector reads the geolocation field and pins all subsequent SAP Concur API calls to that datacenter for the token's lifetime (1 hour); token refresh extends the 6-month refresh token. FreshBooks invoices and expenses arrive via webhook delivery, each signed with HMAC-SHA256 and validated before processing. When a FreshBooks invoice or expense is created, ml-connector maps the FreshBooks vendor record to an existing SAP Concur vendor or creates a new one, then posts the amount and description as a Payment Request (for invoices) or Expense Entry (for expenses). SAP Concur Financial Integration documents that arrive via the Event Subscription Service webhook are pulled periodically and transformed into FreshBooks journal entries, with the document systemId persisted to prevent duplicates across polling windows. Webhook timeouts and network errors trigger exponential backoff with up to 5 retries, and every record carries a full audit trail so transactions can be replayed if a downstream call fails.

A real-world example

A mid-sized professional services firm uses FreshBooks for invoicing and expense reporting, and SAP Concur for employee travel and expense pre-approval. Before integration, the finance team tracked expenses in two systems: employees submitted receipts to Concur for approval, then accounting exported approved expenses and re-entered them into FreshBooks for project cost tracking, leading to delays and reconciliation errors between the two. With FreshBooks and SAP Concur connected, approved Concur expenses post automatically into FreshBooks as project-mapped journal entries, and FreshBooks vendor invoices flow into Concur for consolidated supplier payment requests. Month-end close is faster because expense and vendor data sync without manual intervention.

What you can do

Map FreshBooks invoices to SAP Concur vendors and Payment Requests, routing requests through the correct geographic datacenter.
Push FreshBooks expenses into SAP Concur as approved Expense Entries tied to employee and project codes.
Pull SAP Concur Financial Integration documents for expenses and invoices, posting them back into FreshBooks as journal entries.
Validate OAuth 2.0 credentials and geolocation routing for both systems, with token refresh handling and at-least-once webhook delivery.
Maintain a full audit trail on every record with replay support for failed downstream transactions.

Questions

How does ml-connector handle SAP Concur's multi-datacenter architecture?: When the SAP Concur OAuth token is issued, it includes a geolocation field indicating the correct datacenter (US, EMEA, or China). ml-connector pins all subsequent API calls to that base URL for the token's 1-hour lifetime and refreshes the token when it expires. If the user's datacenter changes, a new OAuth exchange updates the routing.
Does FreshBooks require Client Credentials OAuth, or can user-delegated tokens work?: FreshBooks supports user-delegated Authorization Code grant only; Client Credentials is not available. ml-connector uses the user-delegated flow and stores the long-lived refresh token encrypted, so the integration does not require the original user to re-authenticate for each sync cycle.
What happens if a FreshBooks webhook times out or SAP Concur rejects a Payment Request?: ml-connector retries failed webhook deliveries up to 5 times with exponential backoff. If SAP Concur returns an error (invalid vendor, missing cost code), the transaction is logged with full details and can be replayed once the underlying issue is fixed and the record is resubmitted.

Connect FreshBooks and SAP Concur

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started