SAP ECC and Slack integration

What moves between them

Procurement and financial events flow from SAP ECC into Slack channels on a scheduled interval. Purchase orders, vendor invoices matched or mismatched, GL posting summaries at period close, and cost center utilization alerts are polled from SAP ECC tables and posted into Slack channels mapped to approval workflows, finance teams, and operations groups. Data moves in one direction only: SAP ECC to Slack. No write-back to SAP ECC occurs through this integration.

How ml-connector handles it

ml-connector runs an on-premises relay agent that connects to SAP ECC via RFC using the customer's Basic Auth credentials and the NCo/JCo library, executing RFC_READ_TABLE and BAPI calls on schedule. Slack authentication uses OAuth 2.0 to obtain a non-expiring bot token, which is stored encrypted and presented on every API call. Messages posted to Slack are rate-limited to 1 per second per channel to respect the rate limit, and ml-connector tracks Slack HMAC signatures via HMAC-SHA256 constant-time comparison for any inbound event notifications. SAP ECC polling intervals are configured per data category: purchase orders every 4 hours, invoices every 2 hours, GL postings at close-of-business. The on-premises agent must be running on the customer network with SAP NCo or JCo installed, and RFC throughput is kept to 10-50 concurrent calls to avoid SYSTEM_FAILURE exceptions. Every record carries a full audit trail and can be manually replayed if a downstream Slack post fails or the rate limit causes a backoff.

A real-world example

A mid-sized manufacturing company runs SAP ECC on-premises for procurement and accounting, with a distributed team of buyers, finance staff, and operations managers using Slack daily. Before integration, purchase order approvals required logging into SAP separately, invoice mismatches were discovered during month-end close, and GL posting summaries were emailed manually. With SAP ECC and Slack connected, purchase orders above a threshold post automatically to a channel monitored by procurement, invoice exceptions surface in real-time to the accounting team, and month-end GL postings with cost center breakdowns are posted to the finance channel at close-of-business. The team stays current on operations without context-switching out of Slack, and audit trails for approvals and postings are stored in both systems.

What you can do

• •Route SAP ECC purchase orders and vendor invoices to Slack channels on a scheduled polling interval, with cost center and account mappings.
• •Post GL posting alerts and month-end GL summaries from SAP ECC into Slack channels mapped to accounting workflows.
• •Authenticate SAP ECC via on-premises RFC agent with HTTP Basic Auth, and Slack via OAuth 2.0 bot tokens.
• •Verify Slack webhook signatures via HMAC-SHA256, respect rate limits, and handle retries with exponential backoff.
• •Maintain a full audit trail of every event polled from SAP ECC and posted to Slack, with manual replay support.

Questions

How does ml-connector access SAP ECC data from the cloud?

ml-connector cannot call RFC directly from the cloud. Instead, it runs an on-premises relay agent on the customer network that connects to SAP ECC via RFC using the SAP .NET Connector or Java Connector library. The agent executes RFC_READ_TABLE and BAPI calls on a schedule configured by data category, and returns results to ml-connector, which then posts the data to Slack.

What is the on-premises agent requirement, and how often must it run?

The agent is a lightweight service that must run on a machine with network access to SAP ECC and outbound HTTPS to ml-connector. It requires SAP NCo or JCo to be installed. The agent connects on a schedule (every 2-4 hours for most data categories), executes read-only RFC calls, and transmits the results. If the agent goes offline, polling pauses until it reconnects; no data is queued or buffered.

What safeguards protect Slack webhook integrity and rate limits?

ml-connector verifies every inbound Slack webhook using HMAC-SHA256 constant-time comparison and rejects callbacks older than 5 minutes. Outbound posts to Slack are rate-limited to 1 per second per channel by queuing and backoff logic. Slack retries failed deliveries up to 3 times with exponential backoff, and ml-connector logs every attempt in the audit trail.