SYSPRO and Brex integration

What moves between them

The main flow runs from Brex into SYSPRO. After each business day, ml-connector reads Brex card transactions, expenses, and accounting records, maps them to valid SYSPRO GL accounts and vendor codes, and posts them into SYSPRO's general ledger. Expense details including card holder, amount, category, and merchant are extracted from Brex and attached to the GL posting so SYSPRO reconciliation includes both the amount and the context. Vendor records from Brex card transactions are aligned in both directions so new merchants are registered in SYSPRO if required. GL postings are read-only in Brex, so ml-connector never writes financial entries back into the spend platform.

How ml-connector handles it

ml-connector stores both credential sets encrypted and manages two separate authentication flows. For SYSPRO, it caches the session token obtained at login and reuses it across calls, re-authenticating if the session expires. For Brex, it presents the bearer token on each call and refreshes it on 401 responses; if using OAuth 2.0 multi-tenant credentials, it handles token refresh with the offline_access scope. Because SYSPRO is pull-only, ml-connector polls Brex transaction and accounting data on a configurable schedule (typically daily or after payroll cycles). Before posting any GL entry, it validates that the target GL account and vendor exist in SYSPRO so the posting does not fail on an invalid dimension. Brex API responses include a max of 100 expenses per page, so ml-connector paginates through all results. Brex requires an Idempotency-Key header on transfer POST calls to prevent duplicate charges; ml-connector derives this from the transaction ID so retries land safely. The Brex token has a 90-day inactivity expiry for user-generated keys, and OAuth tokens expire after 1 hour, so ml-connector tracks expiry and alerts on upcoming renewal windows. Every record carries a full audit trail so any posting can be traced back to the source Brex transaction and replayed if a downstream call fails.

A real-world example

A mid-sized manufacturing company with distributed plants uses SYSPRO for ERP and Brex for corporate cards and expense management across the group. Before the integration, the finance team exported Brex transactions every week and manually entered the GL codes, vendor names, and amounts into SYSPRO, then reconciled corporate card spend against the general ledger in month-end close. With SYSPRO and Brex connected, every card transaction and reconciled expense posts into SYSPRO automatically on a daily basis, mapped to the correct GL accounts and vendor records. The finance team spends month-end close verifying the postings instead of re-entering transactions, and reconciliation is complete on day one of the close.

What you can do

• •Post Brex card transactions and expenses into SYSPRO general ledger daily, mapped to the correct GL accounts and vendor codes.
• •Validate every GL account and vendor dimension in SYSPRO before posting so the ledger stays clean.
• •Handle Brex bearer token refresh and SYSPRO session token expiry so credentials never stale mid-flow.
• •Support both single-tenant Brex API keys and multi-tenant OAuth 2.0 credentials with automatic token lifecycle management.
• •Paginate through Brex expense results and use Idempotency-Key on transfers to prevent duplicates on retry.

Questions

Which direction does data move between SYSPRO and Brex?

The main flow is Brex into SYSPRO. Card transactions, expenses, and accounting records move from Brex into SYSPRO's general ledger, mapped to valid GL accounts and vendor codes. Vendor records are aligned in both directions so new merchants can be registered in SYSPRO if needed. GL postings are read-only in Brex, so ml-connector does not write financial entries back into the spend platform.

How does ml-connector handle the different token lifetimes on each system?

SYSPRO session tokens expire on logoff or timeout, so ml-connector maintains the session and re-authenticates if needed. Brex API keys expire after 90 days of inactivity, and OAuth tokens expire after 1 hour. ml-connector tracks both expiry windows and alerts on upcoming renewal so a token change does not cause an outage.

What happens if a GL account or vendor does not exist in SYSPRO when ml-connector tries to post?

ml-connector validates every GL account and vendor dimension before posting. If either is missing, the posting is logged to the audit trail with the validation failure, flagged for manual resolution, and not posted to SYSPRO so the ledger remains accurate.