Sage Intacct — Extraction Guide

Data Extraction Guide
for Sage Intacct

Step-by-step instructions for your IT team to extract the required CSV files from Sage Intacct via the XML Web Services API for the AuditCore security and controls assessment.

18Data Files
6Domains
41+Checks
~20 minEst. Time
All Guides
0 Before You Begin
Automated extraction recommended. Extract-AuditCoreSageIntacct.ps1 uses Sage Intacct's XML Web Services API to extract all 18 files. No additional PowerShell modules required — works on PowerShell 5.1+.
Read-only — no changes to Sage Intacct. All operations use readByQuery and read functions. AuditCore never creates, modifies, or deletes any Sage Intacct data. Disable the extraction user/sender after the assessment.
RequirementDetailsNotes
User RoleSystem Administrator or custom role with full module accessRequired to query all modules including audit trail
Web Services SenderSenderID + SenderPasswordSetup → Web Services → Manage Senders. Request CSA-WSDK from Sage if not enabled.
Company IDYour Intacct Company IDDisplayed at Company → Company Information → Company ID
Multi-Entity AccessLogin at top-level entityRequired to extract cross-entity configuration
1 Required Files (18 total)
Identity & Access
users.csvIdentity

User Accounts

All Intacct users: type (Full/Web Services/Employee), admin flag, status, last login, created date

roles.csvIdentity

Roles & Permissions

Role definitions: name, description, subscriptions accessible

user_role_assignments.csvIdentity

User Role Assignments

User ↔ role mappings with entity scope and assignment date

module_permissions.csvIdentity

Module Permissions

Per-role, per-module access level (Full/Read/None) and dimension restrictions

Audit & Compliance
audit_trail.csvAudit

Audit Trail

Object-level change history (last 90 days): action type, user, timestamp, old/new values

login_history.csvAudit

Login History

User login events: username, date/time, IP address, success/failure, failure reason

Financial Controls
accounting_periods.csvFinancial

Accounting Periods

All periods: name, start/end, status (Open/Closed), period type

vendors.csvFinancial

Vendor Master

All vendors: name, tax ID, bank account (masked), status, created by, last modified

journals.csvFinancial

Journal Entries

Manual journal entries (last 90 days): batch ID, amount, created by, approval status

ap_transactions.csvFinancial

AP Transactions

AP bills and invoices (last 90 days): amount, vendor, created by, approved by, status

payments.csvFinancial

Payments

Payment records (last 90 days): amount, vendor, created by, approved by, approval status, method

approval_workflows.csvFinancial

Approval Workflow Config

Workflow definitions: object type, enabled flag, minimum amount, approver role, dual-signature requirement

Integration Security / Data Security / System Config
api_credentials.csvIntegration

Web Services / API Credentials

Sender credentials: sender ID, company, permissions, created date, last rotated, last used

platform_apps.csvIntegration

Platform App Connections

Marketplace/third-party apps: name, vendor, permissions granted, last reviewed date

entities.csvData Sec

Multi-Entity Configuration

Entity list with isolation levels (Shared/Isolated) and status

dimensions.csvData Sec

Dimension Definitions

Dimension types: name, required flag, access level, PII content flag

reports.csvData Sec

Custom Report Definitions

Custom reports with creator, access level, role restrictions, and sensitive data flags

password_policy.csvSys Config

Password & Security Policy

Password complexity, expiry, MFA requirement, session timeout, account lockout settings

2 Automated Extraction (Recommended)
Fastest path. Extract-AuditCoreSageIntacct.ps1 authenticates via Sage Intacct's XML API and extracts all 18 files. Requires PowerShell 5.1+ and Web Services subscription.
  1. 1Confirm Web Services is enabled: Subscriptions → Company → check "Web Services".
  2. 2Obtain Sender credentials: Setup → Web Services → Manage Senders. If none exist, request activation via Sage support (reference: CSA-WSDK).
  3. 3Download Extract-AuditCoreSageIntacct.ps1 and run:
    # Run with your Sage Intacct credentials .\Extract-AuditCoreSageIntacct.ps1 ` -CompanyId "ACME_CORP" ` -UserId "apiuser" ` -UserPassword "P@ssw0rd!" ` -SenderId "ACME_SENDER" ` -SenderPassword "SenderP@ss"
  4. 4All 18 CSV files saved to C:\AuditCore\SageIntacct\.
  5. 5Upload to AuditCore → New Audit → Sage Intacct → Bulk Upload.
3 Manual Extraction
FileExport Path in Sage IntacctNotes
users.csvCompany → Admin Console → Users → ExportInclude all active and inactive users
roles.csvCompany → Roles → List → Export
user_role_assignments.csvCompany → Users → select each user → Roles tabExport per-user or use Web Services query
accounting_periods.csvCompany → Accounting Periods → List → ExportInclude all period types
vendors.csvAccounts Payable → Vendors → List → Export to CSVInclude bank account and modification fields
journals.csvGeneral Ledger → Journal Entries → List → Export to CSVFilter last 90 days; include ApprovedBy
payments.csvAccounts Payable → Payments → List → Export to CSVInclude approval status column
approval_workflows.csvCompany → Workflow → Approvals → ListManual transcription into CSV template
api_credentials.csvSetup → Web Services → Manage SendersNo native export — use CSV template
audit_trail.csvCompany → Audit Trail (requires subscription) → ExportRequires Audit Trail subscription
4 Uploading to AuditCore
  1. 1Log in to AuditCore and click New Audit.
  2. 2Name the audit (e.g. "Acme Intacct — Q1 2026 Assessment") and select Sage Intacct.
  3. 3Switch to Bulk Upload and drag in all 18 CSV files from C:\AuditCore\SageIntacct\.
  4. 4Verify Match Summary shows files matched (green), then click Run Assessment.
  5. 5Results within 2 minutes — full findings, risk score, remediation guidance, and DOCX/PDF export.
5 Troubleshooting
IssueLikely CauseResolution
"XL03000006 Not Authorized"Web Services subscription not activeEnable Web Services under Company → Subscriptions
"Session ID invalid" / auth failureCredentials expired or user lockedRe-run script; check user is not locked in Company → Users
Empty api_credentials.csvNo sender credentials configuredCreate sender in Setup → Web Services → Manage Senders
Multi-entity data missingLogged in at wrong entity levelEnsure userId is at the top-level entity login with cross-entity access
audit_trail.csv emptyAudit Trail not subscribedContact Sage Intacct support to add Audit Trail subscription
"readByQuery failed" on some objectsModule not in subscriptionSkip that file — mark as N/A. The assessment will skip related checks.
login_history.csv emptyUser login history not retainedCheck Company → Security → Login History retention settings
Ready to start your Sage Intacct assessment?
Upload your extracted files and receive a full Sage Intacct security report within minutes.
Go to Dashboard