SAP ECC and Ramp integration

What moves between them

Vendor master data and GL account hierarchies flow from SAP ECC into Ramp once at setup and then on a weekly or monthly interval to keep reference data current. Bill records created in Ramp are synced back into SAP ECC as incoming vendor invoices, mapped to the matching SAP GL accounts and cost centers so accountants see a unified bill register. When bills are paid or rejected in Ramp, those status changes flow into SAP ECC's invoice status tables. Accounting dimensions in Ramp (departments, cost centers) are aligned with SAP cost centers so bill line items post to the correct dimension in both systems.

How ml-connector handles it

ml-connector runs an on-premises agent at the customer's SAP gateway to make RFC_READ_TABLE and BAPI calls over HTTP Basic Auth without opening firewall ports to the outside world. The agent caches SAP session tokens to minimize logons and respects SAP's concurrent RFC limits of 10-50 calls per second to avoid SYSTEM_FAILURE exceptions. On the Ramp side, ml-connector uses OAuth 2.0 Client Credentials to obtain a fresh access token every 9 days (before the 10-day expiry) and stores the client secret encrypted. Bill data flowing from Ramp to SAP uses the REF_DOC_NO field to detect and skip duplicates on retry, since SAP BAPI_ACC_DOCUMENT_POST has no built-in external idempotency key. GL account mapping is validated bidirectionally so a new account in either system triggers a sync request before any bill posts against it. Cost center allocation happens at the bill line level so each line in Ramp lands on the correct SAP cost center. Every transaction carries a full audit trail in both systems and can be replayed if downstream posting fails.

A real-world example

A mid-sized manufacturing company runs SAP ECC on-premises for purchasing, accounts payable, and cost accounting across three plants. They recently deployed Ramp for corporate cards and bill pay to centralize spend approvals and reduce manual invoice handling. Before the integration, the AP team received bill approvals from Ramp, printed them, and manually entered each bill into SAP ECC by plant and cost center, a process that took two days per week and introduced data entry errors. With SAP ECC and Ramp connected, bill approvals from Ramp automatically post into SAP ECC against the matching plant cost center and GL account. Ramp's bill register becomes the single source of truth for pending invoices, SAP ECC reflects the current approval state, and the weekly manual entry step is eliminated. Month-end close is faster because bills are already reconciled against cost budgets by plant.

What you can do

• •Sync vendor master data from SAP ECC to Ramp and align vendors across both systems.
• •Post approved bills from Ramp into SAP ECC as incoming vendor invoices, mapped to GL accounts and cost centers.
• •Keep GL accounts and cost center dimensions aligned bidirectionally so bill allocations are always valid.
• •Poll SAP ECC on a schedule using the on-premises agent and RFC_READ_TABLE with duplicate detection on retry.
• •Bridge SAP Basic Auth with Ramp OAuth 2.0, handling token refresh and agent session caching.

Questions

How does ml-connector handle SAP ECC's on-premises requirement and firewall constraints?

ml-connector runs an on-premises agent on the customer network that makes all RFC and BAPI calls over HTTP Basic Auth. The agent is installed alongside the SAP .NET Connector or Java Connector and communicates outbound to ml-connector's cloud service, so the customer does not need to open inbound firewall ports. The agent caches SAP session tokens to minimize logons and respects SAP's concurrent RFC limits.

What happens when a bill is approved in Ramp but the GL account or cost center does not exist in SAP ECC?

ml-connector validates GL account and cost center mapping bidirectionally before any bill posts. If a referenced account or cost center is missing, ml-connector queues the bill for retry and notifies the operator. Once the account is created or mapped in either system, ml-connector automatically resyncs and posts the bill. This prevents orphaned records and ensures AP compliance.

Does Ramp's OAuth 2.0 token refresh happen automatically, and what if it fails?

ml-connector refreshes the Ramp OAuth token every 9 days, well before the 10-day expiry. If a token refresh fails, ml-connector retries with exponential backoff and raises an alert. If the token is already expired, bill syncs are queued and retried once a fresh token is obtained. The audit trail logs every token event so operators can investigate refresh failures.