Setup

Enterprise ERP: SAP and NetSuite

Step-by-step guide to connect Sellio to your SAP (OData) or NetSuite (REST) two-way: send accounts, orders and invoices to the ERP and receive events back (invoice paid, order/customer updated). BYO model: the ERP and credentials are yours.

This integration connects Sellio to your enterprise ERP, either SAP (via OData) or NetSuite (via REST Record Service), with deep, two-way sync. It complements the generic "ERP / Billing" connector (which only makes a simple POST to an endpoint): here we speak directly to each platform's typed API, with the real authentication of each one. BYO model: the account and credentials are yours; there is no cost on our side. Everything starts inert: nothing is sent or received until you configure and activate. The secrets are stored encrypted and are never displayed back.

What happens in each direction: on SENDING (Sellio → ERP), when you trigger it (or an automation triggers it) the CRM builds the record in the ERP's language (OData EntitySet in SAP; recordType in NetSuite) and makes the authenticated POST. On RECEIVING (ERP → Sellio), your ERP calls the Sellio webhook URL on each event (invoice paid, order updated, customer updated); Sellio reconciles a pending payment by amount + currency (when it is a paid invoice/order) or logs an activity on the corresponding Contact. Repeated events are deduplicated by the external id.

💡 Choose the path according to your platform. You can configure SAP, NetSuite, or both. Each has its own card in Settings → Integrations and its own webhook URL.

1. Prerequisites

SAP (S/4HANA Cloud, S/4HANA on-premise via SAP Gateway, or SAP BTP): you need a published OData service for the entities you will sync (for example, the standard service API_BUSINESS_PARTNER for accounts/contacts, API_SALES_ORDER_SRV for orders, API_BILLING_DOCUMENT_SRV for invoices) and a credential to call it. Two credential options: (a) a Communication User with Basic Auth, or (b) an OAuth 2.0 client (client credentials) on SAP BTP. Permissions: the user/client needs create (POST) authorization on the chosen OData entities.

NetSuite (SuiteTalk REST): you need the "SuiteTalk (SOAP and REST Web Services)" and "Token-Based Authentication" features enabled on your account, and a user with a Role that has the Lists/Records permissions for the objects you will sync (Customers, Sales Orders, Invoices) and the "REST Web Services" permission (under Setup). You will create an Integration Record (Consumer Key/Secret) and an Access Token (Token ID/Secret).

You must be a Sellio administrator (permission to manage settings) to save and activate the connector.
Have the URLs/IDs at hand: in SAP, the OData service base URL; in NetSuite, your Account ID (e.g., 1234567, or 1234567_SB1 for sandbox).

2. At the provider (SAP): expose the OData and create the credential

Publish/activate the OData service of the desired entity. In S/4HANA on-premise, use transaction /IWFND/MAINT_SERVICE to add and activate the service (e.g., API_BUSINESS_PARTNER); note the resulting base URL (something like https://yourhost:44300/sap/opu/odata/sap/API_BUSINESS_PARTNER). In S/4HANA Cloud, the service is already published, so copy the Service URL from the corresponding Communication Arrangement.
Create the communication credential. For Basic Auth: in Communication Management → Maintain Communication Users, create a Communication User with username and password; then, in Communication Arrangements, associate that user with the Communication Scenario that exposes the OData service. For OAuth 2.0 (BTP): create a service instance and note the Client ID, the Client Secret and the Token URL (endpoint /oauth/token).
Make sure the user/client has POST (create) permission on the entities. Quickly test the collection GET in the browser/Postman with the same credential to confirm access.

2. At the provider, NetSuite (Integration Record + Access Token TBA)

Enable the features: Setup → Company → Enable Features → SuiteCloud tab → check "SOAP Web Services" and/or "REST Web Services" and "Token-Based Authentication". Save.
Create the Integration Record: Setup → Integration → Manage Integrations → New. Give it a name (e.g., "Sellio CRM"), leave "Token-Based Authentication" checked, uncheck "TBA: Authorization Flow" and "OAuth 2.0" if you will use only TBA, and save. NetSuite shows the Consumer Key and Consumer Secret ONCE, so copy both now (they are not shown again).
Create the Access Token: Setup → Users/Roles → Access Tokens → New. Select the Application Name (the Integration Record you created), the User and the Role (a role with the Records permissions + "REST Web Services"). Save. NetSuite shows the Token ID and Token Secret ONCE, so copy both now.
Note your Account ID: Setup → Company → Company Information ("Account ID" field), e.g., 1234567 (production) or 1234567_SB1 (sandbox).

💡 Store the Consumer Key/Secret and Token ID/Secret safely: NetSuite does not show them a second time. If you lose them, you must generate them again.

3. In Sellio: paste the credentials and activate

Open Settings → Integrations and find the "SAP (enterprise ERP)" or "NetSuite (enterprise ERP)" card.
SAP: in "OData service URL", paste the service base URL (without the trailing slash and without the EntitySet name, since Sellio appends the correct EntitySet). In "Authentication type", choose Basic (and paste Username + Password) or OAuth 2.0 (and paste the token URL + Client ID + Client Secret).
NetSuite: in "Account ID", paste your ID (e.g., 1234567 or 1234567_SB1). In "Authentication type", choose Token-Based Authentication (TBA) and paste Consumer Key, Consumer Secret, Token ID and Token Secret. (If you prefer OAuth 2.0, choose that option and paste the Access Token.)
Fill in the "Webhook secret" if you will send ERP events back to Sellio. It is REQUIRED for inbound: for security (events can settle a payment), Sellio only accepts webhooks carrying this secret/signature. Without it, inbound is rejected (see step 4). Stored encrypted.
Click "Save connector". The credentials are stored encrypted. Then click "Activate". Sending and receiving only work once the connector is ACTIVATED.

To receive ERP events: after saving, use "Generate webhook URL" and copy the URL (format https://app.../api/inbound/erp/YOUR_TOKEN). Paste that URL into your ERP's webhook destination: in SAP, into an automation/middleware (Event Mesh, SAP BTP, or a job that POSTs); in NetSuite, into a User Event Script/RESTlet or an automation tool (SuiteFlow + script) that POSTs the event. The provider (SAP or NetSuite) is identified by the token itself, so there is nothing to choose in the URL.

4. How to test

With the connector activated, click "Send test record" on the card. Sellio builds a fictitious account (a "Sellio CRM" connection test) and sends it to your ERP.
Check in the ERP: in SAP, look for the newly created Business Partner in the corresponding entity; in NetSuite, look for the new Customer under Lists → Relationships → Customers.
If "Test record sent to ERP" appears, the authentication and endpoint are correct. Then, to send a REAL record, trigger the send from the CRM record (account, contact, order, opportunity or invoice), and Sellio uses the same path.
To test RECEIVING: generate (or simulate) an event in the ERP (for example, mark an invoice as paid) and check in Sellio whether a pending payment of the same amount was reconciled, or whether an activity appeared on the corresponding Contact.

💡 The test send does NOT write anything to your CRM. It is just a call to the ERP to validate the connection. Sending real records fetches the record by id, respecting your permissions.

5. Troubleshooting

401 (unauthorized): wrong or expired credentials. SAP Basic → check the Communication User's username/password; SAP OAuth → check Client ID/Secret and the token URL; NetSuite TBA → check Consumer Key/Secret and Token ID/Secret (one extra/missing character invalidates the signature). Re-paste the secrets (they do not come back from the server for security).
Invalid TBA signature (NetSuite): Token-Based Authentication uses OAuth 1.0a with HMAC-SHA256; the signature depends on the method, the exact URL (including query parameters) and the Account ID (realm). Confirm the Account ID is correct (with the _SB1 suffix in sandbox) and that the four values (Consumer Key/Secret, Token ID/Secret) were pasted without spaces. If you regenerated the token in NetSuite, update it in Sellio.
403 (forbidden): the credential authenticates, but the role/user does not have permission to create that record. In NetSuite, review the Role permissions (Lists/Records + "REST Web Services"); in SAP, review the POST authorization on the OData entity / the Communication Scenario.
Entity/recordType not found (404): in SAP, the OData service URL is wrong or the service is not activated. Confirm the base URL (without the EntitySet) and activate the service in /IWFND/MAINT_SERVICE. In NetSuite, the default recordType may not match yours, and custom accounts/orders/invoices may require a different recordType (contact support to adjust the mapping).
Rejected fields: SAP and NetSuite are strict with property names. Sellio sends a conservative set of common fields (name, email, phone, company, amount, currency, reference). If your ERP requires additional mandatory fields (e.g., BP Category in SAP, subsidiary in NetSuite), they must be mapped, so adjust the mapping in the configuration or contact support.
Webhook does not arrive (receiving): confirm the connector is ACTIVATED (a disabled connector webhook responds 404), that the URL pasted into the ERP is complete (with the token) and, if you set a "Webhook secret", that the ERP sends the secret in the X-Sellio-Secret header or the HMAC-SHA256 of the body in the signature header. Otherwise the response is 401.

Open this article inside the system →