SAP S/4HANA and Basware integration

What moves between them

Master data flows from SAP S/4HANA into Basware. ml-connector reads vendors from the Business Partner service and GL accounts and cost centers from their OData services, then imports them into Basware so the coding panel offers only valid suppliers, accounts, and dimensions. Open purchase orders move the same direction to support matching. Coded and approved invoices flow back from Basware into SAP: ml-connector reads each accountingDocument when Basware signals it is ready and posts it as a supplier invoice against the matching company code, vendor, and GL accounts. Once SAP records the payment, ml-connector confirms it to Basware through the payment response endpoint, since Basware has no outbound payment engine of its own. Master data sync runs on a schedule, while invoice posting is triggered by Basware webhooks.

How ml-connector handles it

ml-connector stores both credential sets encrypted and bridges the two OAuth client-credential logins, caching the SAP bearer token under its roughly 12-hour life and the Basware bearer token under its configured expiry. The SAP token endpoint and tenant URL are taken per customer, and the Basware region selects its base URL. Master data sync paginates SAP with $top and the nextLink and imports into Basware in batches, mapping SAP supplier numbers, GL accounts, and cost centers to the Basware vendor, account, and dimension codes; because a Basware import overwrites manual edits, SAP is treated as the system of record for that data. On the return path, each Basware approval webhook is verified against the HMAC-SHA256 X-BWAPI-Signature-256 header before processing, then ml-connector fetches an SAP X-CSRF-Token and posts the supplier invoice; the colon-free job id and SAP's own duplicate check on reference, company code, and fiscal year prevent double posting if a webhook is redelivered. Basware paginates with a continuation token returned in the response header and passed back as a request header, and unchanged records are silently skipped on re-import. SAP 429 and 403 CSRF responses trigger token re-fetch and exponential backoff, and every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized manufacturer with about 1,500 employees runs SAP S/4HANA Cloud for finance and procurement and uses Basware to receive and approve its supplier invoices across three legal entities. Before the integration, accounts payable exported approved invoices from Basware and re-keyed them into SAP, which delayed posting, introduced coding mistakes, and left vendor and cost center lists in Basware out of date whenever finance changed them in SAP. With SAP S/4HANA and Basware connected, vendor master, GL accounts, and cost centers sync into Basware on a schedule so coders always pick valid values, and each approved invoice posts into SAP as a supplier invoice within minutes of approval against the right company code. Posting is no longer manual, coding errors drop, and payment status flows back to Basware so AP can see which invoices have cleared.

What you can do

• •Push SAP S/4HANA vendor master, GL accounts, and cost centers into Basware so coders pick from valid values.
• •Post each coded and approved Basware invoice into SAP S/4HANA as a supplier invoice against the right company code and accounts.
• •Trigger invoice posting from Basware approval webhooks verified by HMAC-SHA256, with a scheduled poll as backup.
• •Fetch the SAP X-CSRF-Token for every write and rely on SAP duplicate detection plus a job id to prevent double posting.
• •Confirm payment status back into Basware after SAP records it, and keep a full audit trail with replay on every record.

Questions

Which direction does data move between SAP S/4HANA and Basware?

Master data moves from SAP S/4HANA into Basware: vendors, GL accounts, and cost centers are imported so the coding panel offers valid values. Coded and approved invoices move the other way, posting into SAP as supplier invoices against the right company code and accounts. After SAP records a payment, ml-connector confirms it back to Basware, since Basware has no outbound payment engine.

How does the integration post invoices into SAP S/4HANA safely?

Every SAP write requires an X-CSRF-Token fetched in a prior request, so ml-connector fetches and reuses it and re-fetches on a 403. It posts each Basware invoice once its approval webhook is verified by HMAC-SHA256. SAP also rejects duplicate supplier invoices on the same reference, company code, and fiscal year, which combined with a per-invoice job id stops double posting if a webhook is redelivered.

Does SAP S/4HANA push invoices, or does ml-connector poll for them?

SAP Cloud has no native webhook to external URLs, so ml-connector polls SAP master data on a schedule using filters on LastChangeDateTime. The invoice path is event-driven from the Basware side instead, where approval webhooks trigger the post into SAP. SAP Event Mesh is only used when the customer already licenses SAP BTP.