# How to connect to Sage Intacct

Sage Intacct connects with your own company credentials: there is no OAuth consent screen and no
browser authorization pop-up. You prepare the company in Sage Intacct yourself (steps 1 to 3), then
fill four fields in Vault (step 4). Steps 1 to 3 need administrator access in Sage Intacct; if you
do not hold it, do those steps together with whoever administers your company.

## Prerequisites

- A Sage Intacct company with the **Web Services** subscription enabled. Web Services is a
  separately enabled item on your own account, at **Company > Admin > Subscriptions**. It is
  distinct from the Sender ID credentials your integration provider holds: your provider having a
  Sender ID does not switch Web Services on for your company.
- Administrator access in Sage Intacct, so you can add a Web Services user, create or assign a
  role, and edit the company's **Security** tab.
- The **Sender ID** your integration provider uses. You do not request this from Sage yourself;
  ask your provider for the exact value, which is case sensitive.

With those in place, you complete four steps.

1. [Add Web Services User](#1-add-web-services-user)
2. [Assign Permissions to the Web Services User](#2-assign-permissions-to-the-web-services-user)
3. [Authorize your Sender ID on Sage Intacct Web Services](#3-authorize-your-sender-id-on-sage-intacct-web-services)
4. [Vault Connection Setup](#4-vault-connection-setup)

## 1. Add Web Services User

The first step is to set up a dedicated Web Services User (WSU) in Sage Intacct. This way all of your Apideck Web Services usage will be logged as one user. This also allows you to limit permissions to Apideck. Select only the required permissions for your integration use case.

If you encounter 403 errors, ensure your WSU has enough permissions.

Navigate to **Company > Admin > Web Services users**.

![Navigate to Web Services Users in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/wsu.jpg)

On the Web Services Users page, click **Add**.

![Add Web Services User in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/wsu_add.jpg)

Fill out the required information for a Web Service User.

![Web Services User Form in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/wsu_form.jpg)

| Field            | Description                                                                                                                                                                                                                                                                                  |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User ID          | Unique identifier for this User. For example **apideck**                                                                                                                                                                                                                                     |
| User type        | User type limits the permissions available to a user. Business is recommended, this type gives unlimited access rights. Permissions can be limited later in the user settings. If you choose a different user type, make sure it has the required permissions for your integration use case. |
| Admin privileges | Full is recommended. Only full administrators have complete access to [Platform Services features](https://www-p04.intacct.com/ia/docs/en_US/help_action/More/Customization_and_Platform_Services/csps-permissions.htm?cshid=More/Customization_and_Platform_Services/csps-permissions.htm). |

Click **Save** after completing the form.

## 2. Assign Permissions to the Web Services User

This step will assign Permissions to the Web Services User.
**💡 REMARK**: The creation of a new role is optional, if you assign the existing "Admin" role to the Web Services User.

Navigate to **Company > Admin > Roles**

![Sage Intacct - Roles](https://res.cloudinary.com/apideck/image/upload/v1702479197/docs/connectors/sage-intacct/sage-company-admin.png)

Add a new Role by clicking the "Add" button in the top right of the screen.

![Sage Intacct - Add Role](https://res.cloudinary.com/apideck/image/upload/v1702479097/docs/connectors/sage-intacct/sage-roles.png)

Enter a "name" (description is optional) for the Role and click "Save" in the top right of the screen

After saving, the Roles Subscriptions page will be displayed.

![Sage Intacct - Add Role](https://res.cloudinary.com/apideck/image/upload/v1702479346/docs/connectors/sage-intacct/sage-roles-subscriptions.png)

Click on "Permissions" per Application/Module to set the required Permissions.

![Sage Intacct - Add Role](https://res.cloudinary.com/apideck/image/upload/v1702479540/docs/connectors/sage-intacct/sage-roles-subscriptions-permissions.png)

The permissions below are based on best-practices for allowing the "**reading**" of Sage Intacct data.

For "writing" data, make sure to check the "Add", "Edit", "Delete" options.

| Company                     |               |
|-----------------------------|---------------|
| **Departments**             | List and View |
| **Entities**                | List and View |
| **Locations**               | List and View |
| **Class**                   | List and View |
| **Reporting Periods**       | List and View |
| **Territory**               | List and View |
| **Attachments**             | List and View |
| **Transaction Allocations** | List and View |
| **Transaction Currencies**  | List and View |

| **Cash Management**   |                                 |
|-----------------------|---------------------------------|
| **Bank Transactions** | List and View                   |
| **Deposits**          | List and View                   |

| **General Ledger**  |               |
|---------------------|---------------|
| **Journal Entries** | List and View |
| **Accounts**        | List and View |
| **Account Groups**  | List and View |
| **Journals**        | List and View |

| **Accounts Payable**  |                                 |
|-----------------------|---------------------------------|
| **Manual Payment**    | List and View                   |
| **Vendors**           | List and View                   |
| **Bills**             | List and View                   |
| **Adjustments**       | List and View                   |
| **Posted Payments**   | List and View                   |

| **Accounts Receivable** |               |
|-------------------------|---------------|
| **Customers**           | List and View |
| **Invoices**            | List and View |
| **Adjustments**         | List and View |
| **Deposits**            | List and View |
| **Posted Payments**     | List and View |

| **Inventory Control** |                                 |
|-----------------------|---------------------------------|
| **Vendors**           | List and View                   |

After setting all Permissions, click "Save" in the top right of the screen.

Navigate to **Company > Admin > Web Services Users**.

Select "Edit" next to the Web Services User that was created in the previous step.

Navigate to the "Roles information" tab and assign the newly created Role to the Webservice User.

![Sage - Assign role to user](https://res.cloudinary.com/apideck/image/upload/v1702479742/docs/connectors/sage-intacct/sage-assing-role.png)

A "Verify your identity" pop-up will appear, which will require you to enter your password to confirm the role.

## 3. Authorize your Sender ID on Sage Intacct Web Services

To enable the integration, you need to grant access to the Web Service User (Apideck in the example) in Sage Intacct. To do this, you need to add a **Sender ID** to your Sage Intacct account.

Navigate to **Company > Setup > Company**.

![Navigate to Company Setup in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/company_setup.jpg)

Go to the **Security** tab and click **Edit**.

![Company Security tab in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/company_security.jpg)

Scroll down to **Web Services authorizations** and click **Add**.

![Add Sender ID in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/add_sender.jpg)

Enter the **Sender ID** configured for your integration by your integration provider. This
authorizes that integration's Web Services gateway to access your company. The provider
obtains and configures the Sender ID and its password (these are integration-level gateway
credentials, not something you request yourself). See the application-owner setup guide.

![Sender form in Sage Intacct](https://res.cloudinary.com/apideck/image/upload/v1648649215/docs/connectors/sage-intacct/sender_form.jpg)

| Field     | Description                                                              |
|-----------|--------------------------------------------------------------------------|
| Sender ID | Unique identifier provided by your Sage Intacct contact(case sensitive). |
| Status    | Set the status to "Active".                                              |

Click **Save** after completing the form.

The same Sender ID can be authorized on several Sage Intacct companies, so adding it here scopes
it to this company only and leaves any other company you run untouched. Sage records each
authorized Sender ID's use in a Web Services audit history report, so you keep a trail of when
the integration connected.

This authorization is required, and Sage tells you clearly when it is missing rather than failing
quietly. A request from an unauthorized Sender ID comes back as an XML error body carrying
`errorno` **XL03000006**, the description **Invalid Web Services Authorization**, and this
`description2`:

```
The sender ID '{id}' is not authorized to make Web Services requests to company ID '{id}'.
```

Sage adds a correction message telling the company administrator to add the sender ID on the
Company Configuration **Security** tab, which is the screen you are on. The fix is here: add the
Sender ID, set its status to Active, and check the value character for character against what your
provider gave you.

## 4. Vault Connection Setup

Now that you've created a WSU and authorized Apideck you're ready to fill out your credentials in Vault. All four fields are required.

![Sage Intacct Vault Form](https://res.cloudinary.com/apideck/image/upload/v1737979183/docs/connectors/sage-intacct/sage-vault.png)

| Field           | Description                                                                                                                                                                                      |
|-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Company ID      | The Company ID of your Sage Intacct instance. You can find this ID in the Sage Intacct dashboard. Navigate to **Company > Setup > Company**, Company ID is listed under **Company information**. If your company is managed through a Sage Intacct console, see [Multi-entity companies](#multi-entity-companies) first; the string you need is different. |
| User ID         | The User ID of the WSU you created in step 1. For example **apideck**.                                                                                                                           |
| Password        | The password of the WSU you created in step 1.                                                                                                                                                   |
| Default Entity  | The entity this connection operates in. Choose **Top level** to work across the whole company (shared/top-level data), or a specific entity to scope the connection to it. See [Multi-entity companies](#multi-entity-companies) below. |

Click **Save** after completing the form. Your Sage Intacct account is now connected.

## Notes

### Multi-entity companies

Sage Intacct scopes a Web Services session to a single entity through a `<locationid>` element in
the login, sent alongside `userid`, `companyid` and `password`. The **Default Entity** you pick in
Vault is what supplies that value, which is why the choice decides what the connection can see:
**Top level** works across shared, company-wide data, while a named entity keeps the connection
within that entity.

If your company is managed through the Sage Intacct console as a client company, it is identified
differently: with explicit `<clientid>` and `<locationid>` elements, or with a pipe-delimited
`<companyid>`. Check the exact string in Sage Intacct at **Company > Setup > Company** before you
fill in the **Company ID** field; if a partner or Sage account manager runs the console for you,
they can confirm which form your company uses.

### Large requests and timeouts

A synchronous Web Services request **times out after 15 minutes**. To stay comfortably inside that
limit, Sage recommends keeping a query under 1,000 records and keeping a write to fewer than 100
affected records, so it is worth narrowing a very broad first sync or bulk write.

## Troubleshooting

| What you see | What it means |
|--------------|---------------|
| `errorno` **XL03000006**, "Invalid Web Services Authorization" | The Sender ID is not authorized on this company, or the value entered does not match your provider's exactly. Revisit [step 3](#3-authorize-your-sender-id-on-sage-intacct-web-services). |
| 403 or permission errors on some resources only | The role assigned to your Web Services user is missing permissions for those modules. Add the relevant **List and View** (and **Add/Edit/Delete** for writes) permissions in [step 2](#2-assign-permissions-to-the-web-services-user). |
| Records you can see in the Sage Intacct UI are missing from the connection | The connection is likely scoped to a different entity than the one you are looking at. Check the **Default Entity** setting. |
| A very large request never returns | Sage's 15-minute synchronous limit. Narrow the request; see [Large requests and timeouts](#large-requests-and-timeouts). |
| Web Services pages are not present in your Sage Intacct menus | The Web Services subscription is not enabled on the company. Enable it at **Company > Admin > Subscriptions**. |

Still stuck? Reach out to [Apideck Support](https://help.apideck.com/en/articles/7774658).