Visma and Plaid integration

What moves between them

Customer invoices created in Visma flow into Plaid as transaction records and payment setup. When a Visma payment instruction is recorded, ml-connector initiates an ACH transfer through Plaid to the mapped bank account. Customer records and account dimensions are synced from Visma to Plaid to ensure transfers land on the correct accounts. Journal transactions are read from Visma to reconcile against Plaid webhook notifications of completed transfers. The main cadence is on-demand when invoices are created and confirmed in Visma, with polling for changes to existing records every 4 hours.

How ml-connector handles it

ml-connector stores both Visma tenant credentials and Plaid client secrets encrypted, and refreshes the Visma OAuth token before expiry since refresh tokens are not issued. It accepts the customer's Visma tenant_id and ipp-company-id, and maps Visma customers to Plaid account items obtained via the Link flow. When a payment instruction is issued in Visma, ml-connector initiates a Plaid transfer with the mapped account and amount. Plaid webhooks notify ml-connector of transfer completion, which is then posted as a payment record in Visma. Plaid's signature verification is performed on every webhook using JWT validation with ES256 and JWK public key lookup, and the iat claim is checked to reject messages older than 5 minutes. ACH transfer descriptions are truncated to 10 characters per Plaid limits, and every transfer carries an idempotency key to handle retries without duplication. Plaid rate-limited responses are retried with exponential backoff for up to 24 hours. Every record from both systems carries a full audit trail and can be replayed if a call fails.

A real-world example

A mid-sized Nordic software company uses Visma.net ERP for accounting and manages customer invoices and supplier payments. The finance team previously exported payment lists from Visma and manually entered them into the bank's portal, a process that was slow and error-prone. With Visma and Plaid connected, each customer invoice in Visma automatically triggers an entry in the connected Plaid account, and payment instructions flow directly to ACH transfers without manual re-keying. The accounts payable workflow is cut from a full business day to minutes, and the cash position is always current in both systems.

What you can do

• •Sync customer invoices from Visma to Plaid-connected bank accounts with automatic account mapping.
• •Initiate ACH transfers from Visma payment instructions through Plaid to supplier bank accounts.
• •Map Visma customers and dimensions to Plaid accounts, ensuring payments land on the correct accounts.
• •Handle Visma tenant OAuth 2.0 and Plaid signature verification with JWT on every webhook.
• •Poll for changes on a schedule and replay failed transfers with full audit trail and idempotency keys.

Questions

Which direction does data move between Visma and Plaid?

The main flow is Visma into Plaid. Customer invoices and payment instructions move from Visma into Plaid-connected bank accounts as ACH transfers, while account mappings and transfer confirmations sync back to Visma. Visma is read for invoices and payments; Plaid is written to for transfer initiation.

How does ml-connector verify Plaid webhooks and handle ACH transfers?

Plaid webhooks are verified using JWT signature validation with ES256 algorithm and JWK public key lookup, and the iat claim is checked to reject messages older than 5 minutes. When a payment is due in Visma, ml-connector initiates an ACH transfer through Plaid with the mapped account, idempotency key, and truncated description, then listens for Plaid's transfer webhook to confirm completion.

How does the integration handle Visma's tenant isolation and Plaid's rate limits?

ml-connector accepts the customer's Visma tenant_id and ipp-company-id on configuration, refreshing the OAuth token before expiry since Visma does not issue refresh tokens to service applications. Plaid rate-limited responses (HTTP 429) are retried with exponential backoff for up to 24 hours, and all customer data is isolated by tenant and access token.