Sage Intacct – Connection Guide
Increase ROI and transform your organization with the first and only preferred provider of the AICPA for accounting and financial management software for companies of any size.
How to connect to Sage Intacct
Sage Intacct connects with your own company credentials: there is no OAuth consent screen and no browser authorization pop-up. You prepare the company in Sage Intacct yourself (steps 1 to 3), then fill four fields in Vault (step 4). Steps 1 to 3 need administrator access in Sage Intacct; if you do not hold it, do those steps together with whoever administers your company.
Prerequisites
- A Sage Intacct company with the Web Services subscription enabled. Web Services is a separately enabled item on your own account, at Company > Admin > Subscriptions. It is distinct from the Sender ID credentials your integration provider holds: your provider having a Sender ID does not switch Web Services on for your company.
- Administrator access in Sage Intacct, so you can add a Web Services user, create or assign a role, and edit the company's Security tab.
- The Sender ID your integration provider uses. You do not request this from Sage yourself; ask your provider for the exact value, which is case sensitive.
With those in place, you complete four steps.
- Add Web Services User
- Assign Permissions to the Web Services User
- Authorize your Sender ID on Sage Intacct Web Services
- Vault Connection Setup
1. Add Web Services User
The first step is to set up a dedicated Web Services User (WSU) in Sage Intacct. This way all of your Apideck Web Services usage will be logged as one user. This also allows you to limit permissions to Apideck. Select only the required permissions for your integration use case.
If you encounter 403 errors, ensure your WSU has enough permissions.
Navigate to Company > Admin > Web Services users.
On the Web Services Users page, click Add.
Fill out the required information for a Web Service User.
| Field | Description |
|---|---|
| User ID | Unique identifier for this User. For example apideck |
| User type | User type limits the permissions available to a user. Business is recommended, this type gives unlimited access rights. Permissions can be limited later in the user settings. If you choose a different user type, make sure it has the required permissions for your integration use case. |
| Admin privileges | Full is recommended. Only full administrators have complete access to Platform Services features. |
Click Save after completing the form.
2. Assign Permissions to the Web Services User
This step will assign Permissions to the Web Services User. 💡 REMARK: The creation of a new role is optional, if you assign the existing "Admin" role to the Web Services User.
Navigate to Company > Admin > Roles
Add a new Role by clicking the "Add" button in the top right of the screen.
Enter a "name" (description is optional) for the Role and click "Save" in the top right of the screen
After saving, the Roles Subscriptions page will be displayed.
Click on "Permissions" per Application/Module to set the required Permissions.
The permissions below are based on best-practices for allowing the "reading" of Sage Intacct data.
For "writing" data, make sure to check the "Add", "Edit", "Delete" options.
| Company | |
|---|---|
| Departments | List and View |
| Entities | List and View |
| Locations | List and View |
| Class | List and View |
| Reporting Periods | List and View |
| Territory | List and View |
| Attachments | List and View |
| Transaction Allocations | List and View |
| Transaction Currencies | List and View |
| Cash Management | |
|---|---|
| Bank Transactions | List and View |
| Deposits | List and View |
| General Ledger | |
|---|---|
| Journal Entries | List and View |
| Accounts | List and View |
| Account Groups | List and View |
| Journals | List and View |
| Accounts Payable | |
|---|---|
| Manual Payment | List and View |
| Vendors | List and View |
| Bills | List and View |
| Adjustments | List and View |
| Posted Payments | List and View |
| Accounts Receivable | |
|---|---|
| Customers | List and View |
| Invoices | List and View |
| Adjustments | List and View |
| Deposits | List and View |
| Posted Payments | List and View |
| Inventory Control | |
|---|---|
| Vendors | List and View |
After setting all Permissions, click "Save" in the top right of the screen.
Navigate to Company > Admin > Web Services Users.
Select "Edit" next to the Web Services User that was created in the previous step.
Navigate to the "Roles information" tab and assign the newly created Role to the Webservice User.
A "Verify your identity" pop-up will appear, which will require you to enter your password to confirm the role.
3. Authorize your Sender ID on Sage Intacct Web Services
To enable the integration, you need to grant access to the Web Service User (Apideck in the example) in Sage Intacct. To do this, you need to add a Sender ID to your Sage Intacct account.
Navigate to Company > Setup > Company.
Go to the Security tab and click Edit.
Scroll down to Web Services authorizations and click Add.
Enter the Sender ID configured for your integration by your integration provider. This authorizes that integration's Web Services gateway to access your company. The provider obtains and configures the Sender ID and its password (these are integration-level gateway credentials, not something you request yourself). See the application-owner setup guide.
| Field | Description |
|---|---|
| Sender ID | Unique identifier provided by your Sage Intacct contact(case sensitive). |
| Status | Set the status to "Active". |
Click Save after completing the form.
The same Sender ID can be authorized on several Sage Intacct companies, so adding it here scopes it to this company only and leaves any other company you run untouched. Sage records each authorized Sender ID's use in a Web Services audit history report, so you keep a trail of when the integration connected.
This authorization is required, and Sage tells you clearly when it is missing rather than failing
quietly. A request from an unauthorized Sender ID comes back as an XML error body carrying
errorno XL03000006, the description Invalid Web Services Authorization, and this
description2:
The sender ID '{id}' is not authorized to make Web Services requests to company ID '{id}'.
Sage adds a correction message telling the company administrator to add the sender ID on the Company Configuration Security tab, which is the screen you are on. The fix is here: add the Sender ID, set its status to Active, and check the value character for character against what your provider gave you.
4. Vault Connection Setup
Now that you've created a WSU and authorized Apideck you're ready to fill out your credentials in Vault. All four fields are required.
| Field | Description |
|---|---|
| Company ID | The Company ID of your Sage Intacct instance. You can find this ID in the Sage Intacct dashboard. Navigate to Company > Setup > Company, Company ID is listed under Company information. If your company is managed through a Sage Intacct console, see Multi-entity companies first — the string you need is different. |
| User ID | The User ID of the WSU you created in step 1. For example apideck. |
| Password | The password of the WSU you created in step 1. |
| Default Entity | The entity this connection operates in. Choose Top level to work across the whole company (shared/top-level data), or a specific entity to scope the connection to it. See Multi-entity companies below. |
Click Save after completing the form. Your Sage Intacct account is now connected.
Notes
Multi-entity companies
Sage Intacct scopes a Web Services session to a single entity through a <locationid> element in
the login, sent alongside userid, companyid and password. The Default Entity you pick in
Vault is what supplies that value, which is why the choice decides what the connection can see:
Top level works across shared, company-wide data, while a named entity keeps the connection
within that entity.
If your company is managed through the Sage Intacct console as a client company, it is identified
differently: with explicit <clientid> and <locationid> elements, or with a pipe-delimited
<companyid>. Check the exact string in Sage Intacct at Company > Setup > Company before you
fill in the Company ID field; if a partner or Sage account manager runs the console for you,
they can confirm which form your company uses.
Large requests and timeouts
A synchronous Web Services request times out after 15 minutes. To stay comfortably inside that limit, Sage recommends keeping a query under 1,000 records and keeping a write to fewer than 100 affected records, so it is worth narrowing a very broad first sync or bulk write.
Troubleshooting
| What you see | What it means |
|---|---|
errorno XL03000006, "Invalid Web Services Authorization" | The Sender ID is not authorized on this company, or the value entered does not match your provider's exactly. Revisit step 3. |
| 403 or permission errors on some resources only | The role assigned to your Web Services user is missing permissions for those modules. Add the relevant List and View (and Add/Edit/Delete for writes) permissions in step 2. |
| Records you can see in the Sage Intacct UI are missing from the connection | The connection is likely scoped to a different entity than the one you are looking at. Check the Default Entity setting. |
| A very large request never returns | Sage's 15-minute synchronous limit. Narrow the request; see Large requests and timeouts. |
| Web Services pages are not present in your Sage Intacct menus | The Web Services subscription is not enabled on the company. Enable it at Company > Admin > Subscriptions. |
Still stuck? Reach out to Apideck Support.