Xero and SAP SuccessFactors integration

What moves between them

Employee records flow from SAP SuccessFactors into Xero as contacts. When a new employee is hired in SuccessFactors, ml-connector creates or updates a contact in Xero with the employee name, email, and cost center assignment. When an employee is terminated, ml-connector deactivates the matching contact. Cost center and department mappings are maintained so Xero's tracking categories reflect the current organizational structure. Changes flow on the SuccessFactors event push schedule and also via polling if your tenant has event push disabled.

How ml-connector handles it

ml-connector stores both OAuth credentials encrypted and handles the SAML Bearer token generation flow for SuccessFactors: it constructs a time-bound SAML assertion, signs it with your private key, and exchanges it for a 24-hour token before the 10-minute assertion expiry causes token refresh requests to fail. On the Xero side, it refreshes OAuth tokens when the 30-minute lifetime expires and validates that all follow-up GET requests succeed when webhook payloads arrive. SuccessFactors event signatures are verified using HMAC-SHA256 with your registered webhook key. Since SuccessFactors does not support hard delete, deactivated employees are marked with a status flag so Xero contacts map correctly to active vs. inactive employee records. If event push is unavailable, ml-connector falls back to polling the PerPerson entity with lastModifiedDateTime filtering. Cost center and job code mappings are cached after the first pull so employee lifecycle events do not trigger redundant reference data lookups. SuccessFactors returns paged results defaulting to 20 records, so all queries explicitly request $top=1000 to prevent silent data loss. Rate-limit responses at 429 or 503 are retried with exponential backoff.

A real-world example

A mid-sized professional services firm uses Xero for accounts payable and general ledger, and SAP SuccessFactors for employee management across three offices in different regions. Before the integration, HR processes new-hire paperwork and managers review cost center assignments in SuccessFactors, but the operations team had to manually add each new hire as a contact in Xero and manually update cost center codes in the expense tracking categories after each organizational change. With Xero and SuccessFactors connected, each new hire is automatically created as a Xero contact, cost centers align between the two systems, and the operations team no longer spends hours each month reconciling employee records. Terminations are also synchronized, so access to Xero and other systems can be revoked as soon as the HR record is updated.

What you can do

• •Sync new hires, terminations, and employee record changes from SAP SuccessFactors into Xero contacts automatically.
• •Map SuccessFactors cost centers and departments to Xero tracking categories so employee assignments stay synchronized.
• •Generate SAML Bearer tokens for SuccessFactors and refresh Xero OAuth tokens as they expire, handling the different token lifetimes of each system.
• •Verify webhook signatures from SuccessFactors and follow up Xero webhook events with full-record GET calls to capture the complete updated data.
• •Fall back to polling when SuccessFactors event push is unavailable, and cache reference data to reduce redundant API calls on employee lifecycle events.

Questions

Which direction does data move between Xero and SAP SuccessFactors?

The primary flow is from SAP SuccessFactors into Xero. Employee records, cost centers, and organizational structure from SuccessFactors populate Xero's contact system and tracking categories. Reference data such as cost center and department codes may be aligned in both directions to ensure Xero's tracking categories remain current. Xero is read-only on the SuccessFactors side; ml-connector does not write changes back to SuccessFactors.

How does ml-connector handle the different authentication models?

SAP SuccessFactors uses SAML Bearer token authentication where you upload an RSA public certificate to the Admin Center and ml-connector signs a time-bound SAML assertion with your private key to obtain a 24-hour token. Xero uses OAuth2 where tokens expire every 30 minutes. ml-connector stores both credential sets encrypted, generates the SAML assertion on demand, and refreshes the OAuth token before it expires so both integrations stay alive.

What happens if SAP SuccessFactors event webhooks are not available?

If event push is disabled in your SuccessFactors Admin Center, ml-connector falls back to polling the PerPerson and EmpJob entities using lastModifiedDateTime filters to detect changes. Polling runs on the same schedule as event delivery would, but without the real-time trigger. Reference data such as cost centers and departments are cached after the first pull to reduce redundant requests.