AS2, SFTP, or REST API: Which EDI Protocol for SAP, NetSuite & Oracle?

What Are AS2, SFTP, and REST API for EDI?

EDI protocols are the communication methods used to transmit business documents (purchase orders, invoices, shipment notices) between trading partners and your ERP system.

AS2 (Applicability Statement 2)

What it is: A protocol that transmits EDI documents over the internet using HTTP/HTTPS with encryption and digital signatures.

Key features:

• Uses SSL/TLS encryption for data in transit
• Requires digital certificates for authentication
• Provides Message Disposition Notifications (MDNs) confirming receipt
• Supports compression to reduce transmission time
• Industry standard for retail, healthcare, and automotive

Typical use case: Walmart requires all suppliers to use AS2 for purchase orders (850s) and advance ship notices (856s).

SFTP (Secure File Transfer Protocol)

What it is: A file transfer protocol that uses SSH (Secure Shell) to encrypt data during transmission.

Key features:

• Simpler than AS2, easier to configure
• Supports batch file transfers
• Uses username/password or SSH keys for authentication
• Works well with legacy systems
• No built-in delivery confirmation (must be handled separately)

Typical use case: A distributor sends end-of-day inventory files to your warehouse management system via scheduled SFTP uploads.

REST API (Representational State Transfer Application Programming Interface)

What it is: A web-based protocol that uses HTTP methods (GET, POST, PUT, DELETE) to exchange data in real-time.

Key features:

• Real-time, event-driven data exchange
• Lightweight JSON or XML payloads
• Stateless (each request is independent)
• Ideal for cloud-native ERPs
• Enables microservices architecture

Typical use case: Your NetSuite system calls a trading partner's REST API to check real-time inventory availability before creating a purchase order.

Which EDI Protocol Should You Use?

The answer depends on three factors: trading partner requirements, data volume/frequency, and your ERP architecture.

Decision Framework

Use AS2 when:

• ✅ Trading partner requires it (most major retailers mandate AS2)
• ✅ You need guaranteed delivery confirmation (MDNs)
• ✅ Regulatory compliance requires encryption and non-repudiation
• ✅ You're in retail, healthcare, automotive, or logistics
• ✅ You exchange 1,000+ documents/month with critical partners

Use SFTP when:

• ✅ Trading partner doesn't require AS2
• ✅ You're doing batch transfers (end-of-day, weekly reports)
• ✅ You have legacy on-premises systems
• ✅ Setup speed is critical (SFTP is faster to configure)
• ✅ You exchange <1,000 documents/month

Use REST API when:

• ✅ You need real-time data exchange
• ✅ Your ERP is cloud-based (NetSuite, Oracle Cloud)
• ✅ You're building modern integrations with microservices
• ✅ Trading partner offers API endpoints
• ✅ You want fastest partner onboarding (24-48 hours)

AS2 Protocol: When and How to Use It

Why Major Retailers Require AS2

Compliance requirements:

• Walmart: AS2 mandatory for all EDI documents
• Target: AS2 required, SFTP allowed as backup
• Amazon Vendor Central: AS2 preferred, SFTP accepted
• Home Depot: AS2 required for new suppliers (legacy suppliers grandfathered on SFTP)
• CVS/Walgreens: AS2 mandatory for healthcare compliance

AS2 Technical Requirements

What you need to set up AS2:

1. Digital certificates (obtained from certificate authority)
   • Your certificate (for signing outbound messages)
   • Partner's certificate (for encrypting messages to them)
   • Certificate renewal every 1-2 years
2. AS2 software or VAN connection
   • Option A: In-house AS2 server (IBM Sterling, Cleo, Axway)
   • Option B: VAN handles AS2 (you connect via SFTP/API to VAN)
3. Partner-specific configuration
   • AS2 identifier (your unique ID in partner's system)
   • URL endpoint (where partner receives messages)
   • Encryption algorithm (3DES, AES-128, AES-256)
   • Signature algorithm (SHA-1, SHA-256)
   • MDN settings (sync vs. async, signed vs. unsigned)

AS2 Setup Timeline

AS2 Cost Comparison

SFTP Protocol: When and How to Use It

SFTP Advantages

Why businesses choose SFTP:

1. Simpler configuration - No certificates, just SSH keys or username/password
2. Faster setup - 3-7 days vs. 1-3 weeks for AS2
3. Lower upfront cost - Most Linux servers include SFTP built-in
4. Familiar to IT teams - Standard file transfer process
5. Works with legacy systems - Compatible with older infrastructure

SFTP Technical Requirements

What you need to set up SFTP:

1. SFTP server or VAN connection
   • Option A: Your own SFTP server (Linux, Windows Server, cloud VM)
   • Option B: VAN provides SFTP endpoint
2. Authentication method
   • Username/password (less secure, easier)
   • SSH keys (more secure, recommended)
3. File transfer logic
   • Scheduled jobs (cron, Task Scheduler)
   • Automated scripts to pick up files
   • Naming conventions for file organization

SFTP Setup Timeline

SFTP Limitations

What SFTP lacks:

• ❌ No built-in delivery confirmation (unlike AS2 MDNs)
• ❌ No message-level encryption (only transport encryption)
• ❌ No non-repudiation (can't prove message contents)
• ❌ Manual error handling required
• ❌ Batch-only (not suitable for real-time)

Workarounds:

• Use functional acknowledgments (997s) for confirmation
• Implement application-level encryption
• Add audit logging
• Build retry logic into automation scripts

REST API: When and How to Use It

Why Cloud ERPs Prefer REST APIs

NetSuite SuiteTalk, Oracle Integration Cloud, SAP Cloud Platform:

Modern cloud ERPs use REST APIs because they enable:

• Real-time data sync (no batch delays)
• Event-driven workflows (triggered by business events)
• Microservices architecture (decoupled systems)
• Mobile app integration
• Faster partner onboarding (no file formats to map)

REST API Technical Requirements

What you need:

1. API endpoint (URL where requests are sent)
2. Authentication (API keys, OAuth tokens)
3. Request/response format (JSON or XML)
4. Rate limits (max requests per minute/hour)
5. Error handling (HTTP status codes, retry logic)

REST API Setup Timeline

Average implementation:

• API documentation review: 1-2 days
• Authentication setup: 1 day
• Endpoint testing: 2-3 days
• Error handling and retry logic: 2-3 days
• Total: 1-2 weeks for first integration

Subsequent integrations: 2-3 days (reuse authentication and error handling patterns)

REST API Integration Example

NetSuite to Trading Partner API:

1. Order created in NetSuite
2. NetSuite calls partner's API: POST /orders
3. Partner returns order confirmation: 200 OK
4. NetSuite updates order status: "Sent to supplier"
5. Partner ships order, calls NetSuite API: POST /shipments
6. NetSuite creates shipment record automatically

Protocol Comparison: AS2 vs. SFTP vs. REST API

SAP EDI Integration Best Practices

SAP IDoc Integration

How SAP processes EDI:

1. Outbound: SAP generates IDoc → Middleware converts to EDI → VAN sends via AS2/SFTP
2. Inbound: VAN receives EDI → Middleware converts to IDoc → SAP posts to tables

Key SAP Integration Patterns

Pattern 1: Direct IDoc to VAN (via middleware)

SAP → IDoc → SAP PI/PO → EDI translation → VAN → AS2 → Trading Partner

Pattern 2: File-based integration

SAP → IDoc to file → SFTP → VAN → EDI translation → AS2 → Trading Partner

Pattern 3: API-based (modern SAP Cloud)

SAP S/4HANA Cloud → REST API → VAN → EDI translation → AS2 → Trading Partner

SAP-Specific Challenges

SAP Onboarding Timeline

NetSuite EDI Integration Best Practices

NetSuite SuiteTalk Integration

How NetSuite processes EDI:

Outbound:

NetSuite → Sales Order → SuiteTalk API → VAN → EDI translation → AS2 → Trading Partner

Inbound:

Trading Partner → AS2 → VAN → EDI translation → SuiteTalk API → NetSuite Purchase Order

NetSuite-Specific Advantages

Why NetSuite EDI is easier:

1. Cloud-native - No on-premises infrastructure
2. RESTful APIs - Modern integration patterns
3. Saved searches - Easy data extraction for EDI
4. Custom records - Store trading partner mappings
5. Scheduled scripts - Automated EDI processing

NetSuite Integration Patterns

NetSuite Onboarding Timeline

Oracle EDI Integration Best Practices

Oracle Integration Cloud (OIC)

How Oracle processes EDI:

Outbound:

Oracle EBS → Integration → OIC → EDI translation → AS2 → Trading Partner

Inbound:

Trading Partner → AS2 → VAN → EDI translation → OIC → Oracle EBS tables

Oracle-Specific Challenges

Oracle Integration Patterns

Pattern 1: Oracle Integration Cloud

Oracle EBS → Business Event → OIC → VAN REST API → EDI → AS2 → Partner

Pattern 2: File-based (legacy)

Oracle EBS → Concurrent program → XML file → SFTP → VAN → EDI → AS2

Pattern 3: Direct API

Oracle Cloud → REST API → VAN → EDI translation → AS2 → Partner

Oracle Onboarding Timeline

How to Choose the Right Protocol for Your ERP

Decision Matrix

Hybrid Architecture (Most Common)

Typical setup for mid-market company:

• Tier 1 partners (Walmart, Target, Amazon): AS2 via VAN
• Tier 2 partners (regional retailers, distributors): SFTP via VAN
• Cloud integrations (3PL, WMS, TMS): REST API to VAN
• Your ERP: Single connection to VAN (SFTP or API)

Benefits:

• One connection to maintain (ERP → VAN)
• VAN handles protocol translation
• Add partners in 24-48 hours
• No protocol expertise needed in-house

Common Integration Challenges and Solutions

Challenge 1: Certificate Expiration Causes Outage

Root cause: AS2 certificates expire every 1-2 years, must be renewed

Solution:

• Use VAN that manages certificates automatically
• Set calendar reminders 60 days before expiration
• Test new certificate in staging before production swap

Challenge 2: Data Mapping Errors

Root cause: Mismatch between ERP data format and EDI requirements

Example:

• ERP: Ship date = "2026-04-02"
• EDI 850: Ship date must be "CCYYMMDD" = "20260402"
• Error: Trading partner can't parse ISO 8601 format

Solution:

• VAN's data mapping handles format conversions
• Test all data transformations before going live
• Use EDI validation tools to catch errors

Challenge 3: Slow Partner Onboarding

Root cause: Manual configuration, no standardized process

Solution:

• Use VAN with 24-48 hour onboarding SLA
• Standardize connection method (all partners via VAN)
• Automate testing and validation

Protocol Migration Strategy

Migrating from SFTP to AS2

Why migrate: Trading partner mandates AS2 (common when supplier grows)

Migration steps:

1. Keep SFTP running (don't shut down until AS2 is validated)
2. Set up AS2 connection in parallel (24-48 hours with VAN)
3. Run dual mode (send via both SFTP and AS2 for 1 week)
4. Validate AS2 (confirm partner receives and processes correctly)
5. Cut over (disable SFTP, AS2 becomes primary)
6. Monitor (1 week of close monitoring)

Timeline: 2 weeks with zero downtime

Migrating from Legacy VAN to Modern VAN

Why migrate: Reduce costs by 40-80%, faster support, better technology

Migration steps:

1. Audit current setup (document all trading partners, protocols, mappings)
2. Get new VAN configured (modern VAN replicates your setup)
3. Connect ERP to new VAN (SFTP/API connection, test environment first)
4. Migrate partners one at a time (or in batches)
5. Run parallel (both VANs active during transition)
6. Cut over (redirect traffic to new VAN)
7. Decommission old VAN (after 30-day validation period)

Timeline: 1-2 weeks for small businesses, 4-8 weeks for enterprises

Frequently Asked Questions About EDI Protocols