API integration connects the systems a business already runs, so data moves between them without anyone copying it by hand. A typical SME has a website, a CRM, accounting or ERP software such as bexio, Xero or Abacus, a payment provider, an email tool and analytics, and often a person who retypes orders from one into another. Sensaria designs and builds these integrations for companies in Switzerland and abroad. We define which system owns which data, move it through REST APIs and webhooks, and monitor every flow, so a failure shows up as an alert and not as a missing invoice three weeks later.
Which systems does an integration connect?
Most projects link the same chain: website, CRM, ERP or accounting, payment provider, marketing automation and analytics, with AI services reading and writing under strict permissions. Each link is a separate flow with its own trigger, direction and owner of the data. Mapping these flows before building is what keeps two systems from overwriting each other.
| Flow |
Trigger |
Data |
System of record |
| Website → CRM |
Form submitted |
Contact, deal, source, UTM |
CRM |
| CRM → ERP or accounting |
Deal won |
Customer, order, draft invoice |
ERP for customer master and invoices |
| Payment provider → ERP and CRM |
Signed webhook |
Payment, refund, dispute |
Payment provider for payment status |
| Shop → CRM and email |
Order event |
Customer, order, consent |
Shop for orders |
| CRM → marketing automation |
Segment or consent change |
Contact, segment, consent |
CRM for consent |
| Systems → analytics |
Server-side event |
Conversions, revenue by source |
Analytics holds a reporting copy |
| AI service ↔ systems |
Tool call |
Allow-listed reads and writes |
The system being called |
Direct API, middleware or an integration service?
Use a direct API connection for two systems and a simple mapping. Use no-code middleware such as Zapier, Make or n8n when volumes are low and ready-made connectors exist. Build a small integration service with its own queue and database when several systems, business rules, audit requirements or volume are involved. Many companies end up with a mix: middleware for notifications, a service for money and orders.
| Option |
Strengths |
Limits |
| Direct API connection |
Few moving parts |
Fails silently without monitoring |
| No-code middleware |
Quick to set up; many connectors |
Per-task pricing; limited error handling and versioning |
| Custom integration service |
Retries, audit log, tests, business rules |
Code to maintain, which you own |
How do you make an integration reliable?
Assume every call can fail, arrive twice or arrive out of order, and design for it. That means verifying signatures on incoming webhooks, processing each event once using an idempotency key, retrying failures with back-off, respecting rate limits and logging every event with an ID you can trace. Then monitor the business result, not only the process.
- Signed webhooks and idempotency. Stripe and Shopify, for example, sign their webhooks and retry failed deliveries, so the same event can arrive more than once, and not always in order. We verify the HMAC signature before processing and record each event ID, so a replay never creates a second invoice. Webhooks we send are signed too, retried, and disabled automatically for endpoints that keep failing.
- Retries and a dead-letter queue. Failed jobs retry with back-off. Jobs that keep failing move to a dead-letter queue, where they can be inspected and replayed.
- Rate limits and incremental sync. Syncs page through data with cursors and slow down when a provider throttles. The affiliate reactivation system reads its source platform at one request per second, backs off on throttling and writes with idempotent upserts.
- Least privilege. That same integration can call only an allow-list of read operations, enforced in two layers and proven by a test. Credentials live in a secret store, never in the code.
- Monitoring and reconciliation. Alerts on error rates and queue backlog, plus a scheduled check that compares counts, for example payments at the provider against paid invoices in accounting.
Who owns the data?
Every field has one system of record, and the integration copies from it rather than deciding. Customer master data usually belongs to the ERP, consent to the CRM, payment status to the payment provider. For personal data processed in Switzerland, the revised FADP allows disclosure to a service abroad only to a country with adequate protection or with safeguards such as standard contractual clauses, and the GDPR sets similar rules for transfers out of the EU. The integration map therefore shows which flows cross those borders. API keys should be registered in your accounts, and the code and documentation are handed over to you.
Accounting systems and your own APIs
SMEs often run bexio or Abacus in Switzerland, or Xero, QuickBooks or Microsoft Dynamics elsewhere, for accounting and ERP, next to e-banking, a shop platform and a CRM. What an integration can do depends on the API the vendor offers for your edition and license, so we check scopes, limits and test access during discovery before promising a flow.
We also build APIs. PingMyUsers publishes a REST API with an OpenAPI document, plus a read-only MCP server that AI agents can query. The affiliate recruitment engine runs its discovery sources through a job queue with retries, back-off and a dead-letter queue.
What drives cost and timeline
| Driver |
Why it matters |
| Systems and flows |
Each flow needs mapping, tests and monitoring |
| API quality |
Missing endpoints, tight rate limits or no sandbox add work |
| Data mapping |
Different customer, product or tax models must be reconciled |
| Historical data |
Initial import and cleanup before the live sync |
| Error handling |
Money and orders need reconciliation; notifications usually don’t |
| Hosting and security |
Where the service runs, access control, audit log |
After a short discovery we send a fixed-price or phased proposal.
How it connects
Integrations are the plumbing behind CRM automation, marketing automation, online shops and custom CRM and ERP systems. For company-wide process design, see internal business systems.
Why Sensaria
We have designed and published REST APIs, built incoming and outgoing webhooks with signatures and retries, connected third-party platforms over OAuth 2.0, built for Shopify and WooCommerce, and run job queues with dead-letter handling. We write integrations as tested code with logs and runbooks. Sensaria AG is based in Lugano and works in English, Italian, German and French.