YonBIP Integration Guide: Open Platform Access and Master Data Synchronization

Onboarding Preparation

YonBIP exposes its capabilities through the open platform in a standard RESTful + token style — quite different from Kingdee Cloud's "service-name + session cookie" model. Before integrating: create a self-built app in the tenant console to obtain an AppKey and AppSecret; confirm the tenant ID, which most APIs require; and grant the app permission to the API packages it needs.

Getting an access_token

Self-built apps exchange an HmacSHA256 signature for a token:

GET https://open.yonyoucloud.com/open-auth/selfAppAuth/getAccessToken
  ?appKey={appKey}&timestamp={ms}&signature={signature}

The signature is computed by sorting the participating parameters by name, concatenating them, and applying HmacSHA256 with the AppSecret as the key. Key points: the timestamp is in milliseconds and must be close to server time (synchronize your clock); tokens expire, so refresh proactively rather than fetching one per call — the token endpoint is itself rate-limited; and parameter ordering and encoding must follow the docs exactly, since case mismatches are the number-one cause of signature failures.

Calling Business APIs

Business calls go through the gateway at https://openapi.yonyoucloud.com/apiproxy/open/{path} with access_token attached. Different domains (finance, supply chain, marketing) use different path prefixes per the API marketplace docs. Responses are generally wrapped in a uniform code / message / data envelope, and the platform enforces per-app quotas — clients need backoff and retry.

Master Data Sync Design

For syncing customers, materials, and suppliers out of (or into) YonBIP: initialize with a paged full pull and persist a local mapping table (local code ↔ YonBIP archive ID/code); run incremental pulls by modification time every 15–30 minutes; let YonBIP win conflicts and alert on differences; and require a cross-mapping entry before a new archive is enabled downstream.

Common Issues

Signature failures — check parameter ordering, millisecond timestamps, and whether the AppSecret was copied completely. Missing token-expiry handling — on a 401-style error, refresh once and retry before alerting. Pagination boundaries — stop when a page returns fewer items than the page size rather than relying on a total field. Environment separation — sandbox AppKeys do not work in production; switch tenantId along with credentials.