Set up a Sage Intacct connector

Capabilities

The Sage Intacct connector syncs the following resources:

Resource	Sync	Provision
Users		Create
User groups
Roles		Grant, Revoke

Notes:

All sync and provisioning goes through the classic XML Web Services gateway (api.intacct.com/ia/xml/xmlgw.phtml).
User provisioning creates users in Sage Intacct. Sage sends a password-reset email on creation; the connector never sets a password. User accounts are persistent and cannot be deleted once they have any history — use the disable_user action to deactivate an account instead.
Role provisioning grants and revokes role assignments (role:assigned) for user principals.
User-group membership is sync-only. Sage Intacct exposes no write path for user-group memberships; grant role-based access instead.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step.

Action name	Additional fields	Description
`disable_user`	`user_id` (string, required)	Sets `STATUS=inactive` on the user. The user can no longer sign in; the record stays for audit.
`enable_user`	`user_id` (string, required)	Sets `STATUS=active` on the user, restoring sign-in.

Gather Sage Intacct credentials

You need Sage Intacct administrator access (a Business user with Full admin privileges) to authorize a Web Services sender ID and create the Web Services user. You also need Web Services sender credentials issued by Sage — these are not self-serve.

Request Web Services sender credentials

Confirm your organization has an active Sage Intacct Web Services / Marketplace Partner registration through the Sage Intacct Developer Program.

Contact your Sage Intacct account representative (or log a case through Sage Community) to request Web Services sender credentials.

Record the Sender ID and Sender Password that Sage issues. These are used in the connector’s sage-intacct-sender-id and sage-intacct-sender-password fields.

The sender ID/password pair is distinct from the gateway login user (created below). The sender credentials populate the request <control> block; the user credentials populate the <login> block.

Authorize the sender ID for your company

Go to Company > Setup > Configuration > Company.

Select the Security tab, then select Edit.

In the Web Services authorizations section, select Add.

Enter the Sender ID (case-sensitive; it cannot be changed after saving) and, optionally, a description. Set Status to Active.

Select Save.

Create the Web Services user

Go to Company > Admin > Users, roles, and groups and select Add next to Web Services users.

Enter a unique User ID (it cannot reuse a standard user’s ID and cannot be changed after saving). This is the value for the connector’s sage-intacct-user-id field.

Enter a Username, Account email address, and Contact name. Set User type to Business user.

Grant the user access to the objects the connector reads and writes — USERINFO, USERGROUP, ROLES, USERROLES, ROLEGROUPS, and MEMBERUSERGROUP — with read/write on USERINFO and USERROLES (needed for account creation, activation/deactivation, and role grant/revoke).

Verify before publishing. Sage’s role UI grants permissions by application/module checkbox rather than by these XML object names. The simplest confirmed setup is to set Admin privileges to Full on the Web Services user, which covers every object. To use a scoped custom role instead, confirm in a live tenant which permission checkboxes map to the objects above, create the role under Company > Admin > Users, roles, and groups > Roles, then assign it in the user’s Role table. Role assignment is only available when the company uses role-based permissions.

Select Save, then confirm with your admin password. Sage emails an auto-generated password to the account email — this is the value for the connector’s sage-intacct-password field.

That’s it! You now have the company ID, sender ID/password, and user ID/password needed to configure the connector.

Configure the Sage Intacct connector

You need the Connector Administrator or Super Administrator role in C1, plus the Sage Intacct company ID, sender ID, sender password, user ID, and user password gathered above.

Cloud-hosted
Self-hosted

In C1, select Add connector and search for Sage Intacct.

Choose the Sage Intacct app, set the connector owner, and select Next.

Select Edit Settings.

Enter the required configuration:

Sage Intacct Company ID: Sage Intacct company ID.
Sage Intacct Sender ID: XML gateway partner sender ID written into every request’s <control> block.
Sage Intacct Sender Password: XML gateway partner sender password matching the sender ID.
Sage Intacct User ID: XML gateway user written into the <login> block.
Sage Intacct Password: Password for the user ID.

Select Save. The connector begins syncing; its status moves to Syncing and then Connected.

Done. Your Sage Intacct connector is now pulling access data into C1.

Resources

Download the latest release from the C1 download center.
View the source on GitHub.

Step 1: Set up the connector in C1

In C1, select Add connector, search for Sage Intacct, and add it.

Set the connector owner and select Next.

Rotate the connector’s credentials to generate a C1 Client ID and Client Secret. Save these — you’ll need them for the deployment.

Step 2: Deploy the connector

Create a Kubernetes Secret with the Sage Intacct credentials and the C1 client credentials:

apiVersion: v1
kind: Secret
metadata:
  name: baton-sage-intacct
type: Opaque
stringData:
  BATON_SAGE_INTACCT_COMPANY_ID: "your-company-id"
  BATON_SAGE_INTACCT_SENDER_ID: "your-sender-id"
  BATON_SAGE_INTACCT_SENDER_PASSWORD: "your-sender-password"
  BATON_SAGE_INTACCT_USER_ID: "your-user-id"
  BATON_SAGE_INTACCT_PASSWORD: "your-user-password"
  BATON_CLIENT_ID: "your-c1-client-id"
  BATON_CLIENT_SECRET: "your-c1-client-secret"

Then create a Deployment that runs the connector against the C1 platform:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-sage-intacct
spec:
  replicas: 1
  selector:
    matchLabels:
      app: baton-sage-intacct
  template:
    metadata:
      labels:
        app: baton-sage-intacct
    spec:
      containers:
        - name: baton-sage-intacct
          image: public.ecr.aws/conductorone/baton-sage-intacct:latest
          envFrom:
            - secretRef:
                name: baton-sage-intacct

Step 3: Apply and verify

Apply the manifests: kubectl apply -f secret.yaml -f deployment.yaml.

Confirm the connector reaches Connected in C1 and that Sage Intacct users, user groups, and roles appear in your access data.

Prebuilt binaries and container images for every release are available at dist.conductorone.com/ConductorOne/baton-sage-intacct.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Sage Intacct connector

Capabilities

Connector actions

Gather Sage Intacct credentials

Request Web Services sender credentials

Authorize the sender ID for your company

Create the Web Services user

Configure the Sage Intacct connector

Resources

Step 1: Set up the connector in C1

Step 2: Deploy the connector

Step 3: Apply and verify

​Capabilities

​Connector actions

​Gather Sage Intacct credentials

​Request Web Services sender credentials

​Authorize the sender ID for your company

​Create the Web Services user

​Configure the Sage Intacct connector

​Resources

​Step 1: Set up the connector in C1

​Step 2: Deploy the connector

​Step 3: Apply and verify

Capabilities

Connector actions

Gather Sage Intacct credentials

Request Web Services sender credentials

Authorize the sender ID for your company

Create the Web Services user

Configure the Sage Intacct connector

Resources

Step 1: Set up the connector in C1

Step 2: Deploy the connector

Step 3: Apply and verify