How does ml-connector handle SAP ECC's on-premises agent requirement?

SAP ECC does not allow direct cloud-to-cloud RFC/BAPI calls because RFC traffic must originate from within the SAP network. ml-connector accepts the customer's on-premises agent configuration (SAP .NET Connector or Java Connector hostname and credentials) and routes all RFC and BAPI calls through that agent. For OData calls, ml-connector uses the SAP Gateway URL and HTTP Basic Auth directly, provided the Basis team has activated the OData service via TCODE SICF.

How does ml-connector keep Square and SAP ECC customer and GL reference data aligned?

ml-connector receives Square webhook events for order and invoice changes in real time and posts those changes into SAP ECC. For slower-moving reference data such as customer master changes and GL account lists, ml-connector runs scheduled OData reads on the SAP ECC side and pushes updates back to Square via its REST API so that both systems see the same customer names and valid GL posting dimensions.

SAP ECCSquare

SAP ECC and Square integration

SAP ECC powers your on-premises finance and procurement. Square handles your payments, point-of-sale, and customer management. Connecting the two keeps your order and invoice data aligned between both systems without manual re-entry. New orders and customer invoices from Square flow into SAP ECC and post to the correct sales GL accounts and customer master records. ml-connector manages the complexity of Square's cloud authentication, SAP's on-premises agent requirements, and the transaction-level locking that comes with SAP's BAPI calls.

How SAP ECC works

SAP ECC is an on-premises ERP suite that does not expose a public cloud REST API. Instead, data flows through RFC/BAPI function modules (via SAP .NET Connector or Java Connector running on-premises), OData v2 REST via SAP Gateway (after SICF configuration by SAP Basis), SOAP web services, or inbound IDoc XML. Writing documents to SAP ECC requires explicit BAPI_TRANSACTION_COMMIT calls after each post, and forgetting the commit leaves documents locked in memory. RFC_READ_TABLE reads data on demand or on a scheduled interval, but no native webhook registry exists, so polling is the primary pattern for pull. Outbound IDoc push is available but requires WE21/WE20 configuration by the SAP Basis team.

How Square works

Square exposes sales orders, payments, invoices, customers, and inventory through a versioned REST API at https://connect.squareup.com/v2, secured with OAuth2 bearer tokens that expire every 30 days and must be refreshed. Square pushes events such as order.created, invoice.published, invoice.payment_made, and inventory.count.updated to a registered webhook endpoint, signing each notification with an HMAC-SHA256 signature that ml-connector validates to prevent spoofing. Square's Vendors API is currently in beta, and there is no Purchase Orders API, so vendor workflows must be modeled via Orders with vendor references.

What moves between them

Orders and customer invoices from Square flow into SAP ECC. When a Square customer places an order or an invoice is published, ml-connector receives the webhook notification, reads the full order or invoice detail from Square's API, and posts a matching sales document (BAPI_SALESDOCUMENT_CREATE or equivalent) into SAP ECC, mapped to the customer master record and the sales GL account. Payment confirmations and refunds from Square can also post as cash application or credit memo documents in SAP ECC. The primary direction is Square to SAP ECC because Square is the merchant-facing system; SAP ECC feeds reference data such as customer master changes and GL account lists back to Square via scheduled OData reads to keep the customer and GL master records aligned.

How ml-connector handles it

ml-connector stores both credential sets encrypted. For SAP ECC, it accepts either an OData Gateway URL and HTTP Basic Auth credentials, or the hostname and credentials needed to route RFC/BAPI calls through the customer's on-premises agent (either SAP .NET Connector or Java Connector). For Square, it stores the OAuth2 access token and refresh token, detecting 30-day expiry and refreshing the token before any call returns 401. When a Square webhook arrives, ml-connector validates the HMAC-SHA256 signature against its stored webhook signing key. After mapping the Square order or invoice to SAP ECC customer and GL dimensions, it posts the document via the chosen transport (OData PATCH to create a sales order, or BAPI_SALESDOCUMENT_CREATE via RFC), then immediately calls BAPI_TRANSACTION_COMMIT to release the locked record so SAP does not keep it in memory. If the commit call fails, ml-connector replays the post and commit atomically, deduplicating via SAP's REF_DOC_NO external reference field. Square's 429 rate limits are handled with exponential backoff. Every record carries a full audit trail.

A real-world example

A mid-sized restaurant group with 15 locations uses SAP ECC for central accounting and procure-to-pay, and Point-of-Sale terminals and payment processing all run on Square. Before the integration, the operations team exported daily sales summaries from Square by hand and the finance team re-entered them into SAP ECC to close each day's cash reconciliation and post labor and food-cost GL entries. With SAP ECC and Square connected, each order posts as a sales document in SAP ECC the moment it is completed in Square, and the GL amounts flow directly to the revenue and cost accounts. Cash reconciliation and GL posting happen automatically, and the finance team's manual daily entry task is eliminated.

What you can do

Receive Square webhooks for orders, invoices, and payments, validate HMAC signatures, and post matching sales documents into SAP ECC without re-keying.
Route SAP ECC writes through an on-premises agent (SAP .NET Connector or Java Connector) and handle explicit BAPI_TRANSACTION_COMMIT calls to prevent document locking.
Refresh Square's OAuth2 access token before expiry and route all calls to the correct SAP ECC OData Gateway URL or RFC destination.
Map Square customer names and invoice amounts to SAP ECC customer master records and sales GL accounts, with scheduled syncs to keep reference data aligned.
Track the Square order ID and SAP ECC document number in the audit trail, replay failed posts atomically, and deduplicate retries via REF_DOC_NO.

Questions

How does ml-connector handle SAP ECC's on-premises agent requirement?: SAP ECC does not allow direct cloud-to-cloud RFC/BAPI calls because RFC traffic must originate from within the SAP network. ml-connector accepts the customer's on-premises agent configuration (SAP .NET Connector or Java Connector hostname and credentials) and routes all RFC and BAPI calls through that agent. For OData calls, ml-connector uses the SAP Gateway URL and HTTP Basic Auth directly, provided the Basis team has activated the OData service via TCODE SICF.
Why does ml-connector call BAPI_TRANSACTION_COMMIT after posting a document to SAP ECC?: SAP ECC BAPI calls do not automatically commit documents to the database. After BAPI_SALESDOCUMENT_CREATE or BAPI_ACC_DOCUMENT_POST succeeds, the document exists in memory and is locked. ml-connector immediately calls BAPI_TRANSACTION_COMMIT to release the lock and persist the document. If the commit fails, ml-connector replays both the post and commit atomically, deduplicating via the REF_DOC_NO external reference field so SAP does not create a duplicate.
How does ml-connector keep Square and SAP ECC customer and GL reference data aligned?: ml-connector receives Square webhook events for order and invoice changes in real time and posts those changes into SAP ECC. For slower-moving reference data such as customer master changes and GL account lists, ml-connector runs scheduled OData reads on the SAP ECC side and pushes updates back to Square via its REST API so that both systems see the same customer names and valid GL posting dimensions.

Connect SAP ECC and Square

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started