SAP ECC and Brex integration

What moves between them

The main flow is Brex into SAP ECC. When accounting records are ready in Brex, ml-connector reads them via webhook or polling and posts them into SAP ECC's general ledger as documents (BAPI_ACC_DOCUMENT_POST), mapped to the GL accounts and cost centers configured for each Brex spend category. Vendor master data flows from Brex into SAP ECC to keep supplier records current. Payments and transfers from Brex that require GL posting are captured and posted into SAP on a configurable schedule. GL account and cost center reference data can sync in both directions to ensure Brex allocations always land on valid SAP dimensions.

How ml-connector handles it

ml-connector connects through an on-premises agent that runs on the customer network with SAP .NET Connector or Java Connector installed, so RFC calls can reach SAP ECC from the integration engine. On the SAP side, it uses HTTP Basic Auth to query vendors and GL accounts via OData, and RFC to read and post general ledger documents via BAPI. On the Brex side it authenticates with the static API key or OAuth2 bearer token and listens for ACCOUNTING_RECORD_READY_FOR_EXPORT webhooks (with HMAC-SHA256 signature verification) or polls periodically for new accounting records. Before posting to SAP ECC, ml-connector validates the cost center and GL account exist and uses the BAPI_ACC_DOCUMENT_POST call, which requires an explicit BAPI_TRANSACTION_COMMIT to lock in the document - a missed commit leaves the post in a transactional hold state and is detected on retry. Brex transfers and expenses require an Idempotency-Key header to prevent duplicate posts on retry. Reference data is synced first so every Brex allocation references a SAP GL account and cost center that already exists. Every record carries a full audit trail, and failed GL posts can be replayed once the root cause is fixed.

A real-world example

A mid-sized professional services firm runs SAP ECC on-premises for finance and procurement, and uses Brex for corporate cards and expense management across four offices. Before the integration, the accounting department received weekly expense reports from Brex, reviewed them offline, and manually entered GL postings into SAP ECC by cost center - a process that took two days per week and introduced transcription errors. After expenses were allocated incorrectly across cost centers, month-end GL reconciliation required tracing back to the original Brex export to find and correct the mistakes. With Brex and SAP ECC connected, expenses from the Brex API post automatically into SAP ECC on a daily schedule, allocated to the correct cost center per cardholder, and the manual entry and re-keying step is eliminated. Month-end close starts with the expense accounts already reconciled, and the accounting team now focuses on the substantive audit instead of data entry.

What you can do

• •Post Brex accounting records directly into SAP ECC's general ledger with cost center allocation configured per cardholder and expense type.
• •Sync Brex vendor records into SAP ECC to keep supplier master data current across both systems.
• •Authenticate Brex with OAuth2 or static API key, and SAP ECC with HTTP Basic Auth over OData plus RFC via an on-premises agent.
• •Validate Brex allocations against SAP cost centers and GL accounts before posting, and replay failed posts with full audit trail.
• •Parse Brex webhooks with HMAC-SHA256 verification and idempotency keys, or poll periodically for accounting records.

Questions

Why does SAP ECC require an on-premises agent?

SAP ECC is an on-premises system that exposes data through RFC/BAPI, which cannot be called directly from the cloud. ml-connector connects through an agent running on the customer network with SAP .NET Connector or Java Connector installed, so RFC calls can safely reach SAP ECC without opening inbound firewall rules to the cloud.

Which direction does data move between Brex and SAP ECC?

The main flow is Brex into SAP ECC. Accounting records and expense allocations move from Brex into SAP ECC's general ledger, and vendor master records flow from Brex into SAP. GL account and cost center reference data can sync in both directions to ensure Brex spend always lands on valid SAP dimensions.

How does the integration handle SAP ECC's lack of webhooks and Brex's webhook requirement?

ml-connector listens for Brex ACCOUNTING_RECORD_READY_FOR_EXPORT webhooks with HMAC-SHA256 signature verification, and can also poll Brex periodically if webhooks are not enabled in your account. On the SAP side it polls OData and RFC on a configurable schedule, since SAP ECC has no native webhook registry - this ensures records reach SAP even if Brex webhooks are unavailable.