Data Extraction Guide
for Sage X3
Step-by-step instructions for your IT team to extract the required data files from Sage X3 via the Syracuse REST API for the AuditCore security and controls assessment.
Extract-AuditCoreSageX3.ps1 uses the Sage X3 Syracuse REST API to extract all 18 files. No additional PowerShell modules required.| Requirement | Details | Notes |
|---|---|---|
| Sage X3 User | ADMIN profile or full-access equivalent | Required for AUTILIS, ADXTRACE, ADXLOG tables |
| Syracuse Server URL | https://[host]:[port] (default HTTPS port: 8124) | REST base: /api1/x3/erp/[solution]/ |
| Solution/Folder Name | e.g. ACME, X3DEMO, PROD | Administration → Folders → Solution name |
| Audit Table (ADXTRACE) | Must be enabled in Parameters → Traceability | Required for audit_table.csv and change-tracking checks |
User Accounts (AUTILIS)
All X3 users from AUTILIS table: user code, profile, status, last login, admin flag, auth type
User Profiles / Function Sets
Profile definitions: access type (ALL/RESTRICTED/READ), description, created date
Function Authorizations
Per-profile function access: function code (GACCENTRY, PAYMENTH, PTEMPH), access level, module
Connection Log (ADXLOG)
Login events from ADXLOG: user code, date, IP address, status, session duration, logout type
Audit Table (ADXTRACE)
Record change history from ADXTRACE: table, field, user, modification date, old/new value, action type
Workflow Definitions
X3 workflow config: object code, enabled flag, approval required, approver profile, dual approval
Fiscal Periods
All fiscal periods: period code, start/end dates, status (OPEN/CLOSED), fiscal year
Journal Entries (GACCENTRY)
Manual journals (last 90 days): journal ID, date, amount, created by, approved by, period status
Purchase Orders (PORDER)
PO records (last 90 days): PO ID, amount, supplier, created by, approved by, status
Vendor Master (BPSUPPLIER)
All suppliers: vendor ID, name, tax ID, bank account (masked), modified by, approved by
Payment Transactions (PAYMENTH)
Payment records (last 90 days): payment ID, amount, vendor, created by, approved by, method
Approval / Signature History
Workflow signature events: object code, submitted by, approved by, date, status, notes
Web Services Endpoints
Syracuse web service endpoints: URL, auth type (Basic/None/OAuth), status, last used
Batch Server Configuration
X3 batch task server settings: server name, host, status, run-as user, batch type
Data Access Rules
GESAME data restriction rules: table, profile, access type, filter condition
Report & Inquiry Permissions
Report access: report code, profiles with access, access level, data filter
Site / Folder Settings
System parameters (ADPPAR): session timeout, default admin changed, patch level, HTTPS, debug mode
Password & Security Settings
Password policy: min length, complexity requirements, expiry, lockout threshold, history
Extract-AuditCoreSageX3.ps1 queries the Syracuse REST API and saves all 18 files. Requires PowerShell 5.1+, no additional modules needed.- 1Confirm the Syracuse server is reachable: open a browser to
https://[host]:[port]/api1/x3/erp/[solution]/AUTILIS?$top=1— you should see a JSON response. - 2If ADXTRACE (audit table) is not enabled, enable it now: Administration → Parameters → General Parameters → ADXTRACE → set to Active.
- 3Download
Extract-AuditCoreSageX3.ps1and run:# Run with Syracuse credentials .\Extract-AuditCoreSageX3.ps1 ` -ServerUrl "https://x3.yourcompany.com:8124" ` -Solution "ACME" ` -Username "ADMIN" ` -Password "YourPassword" # For self-signed certificates (development/test environments only) .\Extract-AuditCoreSageX3.ps1 -ServerUrl "https://x3.internal:8124" ` -Solution "ACME" -Username "ADMIN" -Password "pass" ` -SkipCertificateCheck - 4All 18 CSV files saved to
C:\AuditCore\SageX3\. - 5Upload to AuditCore → New Audit → Sage X3 → Bulk Upload.
ACME, X3DEMO, PROD).| File | Export Path in Sage X3 | Notes |
|---|---|---|
users.csv | Administration → Users → AUTILIS → List → Export | Include all active and inactive users |
user_profiles.csv | Administration → Profiles → List → Export | |
function_authorizations.csv | Administration → Profiles → Function Access → Export | Export per-profile function assignments |
connection_log.csv | Administration → Log → ADXLOG → Export | Filter last 90 days |
audit_table.csv | Usage → Audit → ADXTRACE → Export (if enabled) | Must enable ADXTRACE first |
journal_entries.csv | Accounting → Journals → List → Export to CSV | Filter last 90 days; include GACCENTRY fields |
purchase_orders.csv | Purchasing → Orders → List → Export to CSV | Filter last 90 days |
vendor_master.csv | Common Data → Business Partners → Suppliers → List → Export | Include bank account and modification fields |
fiscal_periods.csv | Accounting → Fiscal Years → Periods → Export | |
site_settings.csv | Administration → Parameters → manual transcription into template | Use CSV template provided by AuditCore |
- 1Log in to AuditCore and click New Audit.
- 2Name the audit (e.g. "Acme X3 — Q1 2026 Assessment") and select Sage X3.
- 3Switch to Bulk Upload and drag in all 18 CSV files from
C:\AuditCore\SageX3\. - 4Verify Match Summary shows files matched (green), then click Run Assessment.
- 5Results within 2 minutes — full findings, risk score, remediation guidance, and DOCX/PDF export.
| Issue | Likely Cause | Resolution |
|---|---|---|
| "404 Not Found" on API requests | Incorrect URL or solution name | Confirm base URL: https://[host]:[port]/api1/x3/erp/[solution]/. Check solution name in Administration → Folders. |
| "401 Unauthorized" | Wrong credentials or account locked | Verify ADMIN username and password. Check Administration → Users → account not locked. |
| audit_table.csv empty | ADXTRACE not enabled | Enable in Administration → General Parameters → ADXTRACE → set to Active. Then re-run script. |
| connection_log.csv empty | ADXLOG not enabled | Enable in Administration → Activity Codes → ADXLOG |
| SSL certificate error | Self-signed certificate not trusted | Add -SkipCertificateCheck to script (test environments only), or install the certificate in the Windows trusted store. |
| Script returns 0 rows for function_authorizations | AFONCTION endpoint naming varies by X3 version | Try endpoint /AUTILIS with profile filter or contact support@vergent.co.ke for version-specific guidance. |
| patch_level not found in site_settings | ADPPAR table naming varies | Try /ADPVAL endpoint. Script includes automatic fallback — check output log. |