API Integration: What It Costs and What Breaks

Share

In short

An API integration is not a data transfer, it is an agreement about what happens when the transfer fails. Most of the cost sits in the exceptions: a record that arrives twice, a field that is empty in one system and mandatory in the other, a token that expires at 03:00 on a Sunday. Budget roughly a third of the work for the happy path and two thirds for everything else, and insist that any quote names what happens on failure.

From message to invoice

Where an integration stands or falls

Moving data is the easy part. These are the five places the real work sits.

Connecting
Two systems, one truth
An integration moves agreements, not data: which system is right when the two disagree.
E-invoicing
The invoice became a data format
Since 2026 the e-invoice is becoming the regional norm. Build for it now, not after.
The quote
What sets the price
Not the message but the exceptions: partial receipts, corrections, and what happens during an outage.
Limits
What it really runs into
Rate limits, batch windows and timeouts shape the design more than the desired messages per second.
When not to
Sometimes an export is enough
At low volume with few changes, a daily export is less expensive and more robust than an integration.

What it is

What an integration has to do beyond moving data

A working integration answers four questions that a demo never asks. If a proposal does not address them, it is quoting the easy third of the job.

Idempotency. If the same message arrives twice, does the second one create a duplicate order, or is it recognised and ignored? Retries are normal, so duplicates are guaranteed without this.
Field mapping under disagreement. One system allows an empty customer reference, the other requires it. The mapping has to decide, and someone has to own that decision.
Failure visibility. When a message fails at 02:00, who finds out, and how? An integration nobody is watching is an integration that has already stopped.
Replay. After an outage, can the last four hours be re-sent safely? If not, the recovery is manual and the outage costs a day.

What changed

What changed in 2026: the invoice became a data format

Until recently a Dutch company could treat integration as an efficiency question. During 2026 it turned into a trading requirement, and the change arrived from Brussels rather than from The Hague.

Since 1 January 2026, Belgian VAT-registered businesses have had to exchange structured electronic invoices with each other, over the Peppol network in Peppol BIS format unless both parties agree an alternative that still meets the EN 16931 standard. A PDF attached to an email no longer counts, and neither does paper. A short list of exceptions applies, mostly businesses carrying out only VAT-exempt activities. That is the Belgian government's own summary of who is covered, not a software vendor's reading of it.

Three details decide what this means for a Dutch supplier, and the articles circulating on this subject routinely get the first two wrong.

You are probably not in scope. A business that is not established in Belgium and has no permanent establishment there falls outside the obligation, and that remains true even if it holds a Belgian VAT number. The exclusion covers both issuing and receiving.
But the burden of saying so is yours. Because the permanent-establishment test is genuinely complicated, the Belgian rules put the duty on the foreign supplier to tell its counterparties that it has no permanent establishment. Say nothing and your customer's finance system reads it as non-compliance rather than as an exemption.
Registering on Peppol is itself consent. For transactions outside the mandatory B2B scope, being present on the Peppol network counts as agreement to receive electronic invoices. It is not a neutral technical step, so decide it deliberately.

What is coming

Is the Netherlands going the same way?

Yes, but slowly, and the gap is your planning window. There is no Dutch B2B e-invoicing mandate today. On 10 March 2026 the State Secretary for Finance sent parliament a study by EY, commissioned jointly by the ministries of Finance, Economic Affairs, and the Interior. EY recommends Peppol as the mandatory exchange infrastructure, with domestic B2B e-invoicing starting around 1 January 2030 and domestic digital reporting following in 2032.

Read the split carefully, because most summaries collapse it. Those are EY's recommendations, not government policy. The covering letter does not commit to Peppol at all and names the European Business Wallet as a possible alternative infrastructure. What the government has actually committed to is an internet consultation on a draft bill in the fourth quarter of 2026. A definitive cabinet position was expected in the summer of 2026 and had still not been published when we checked this page on 1 September 2026.

The practical consequence is not urgency, it is shape. An integration you commission in 2026 will still be running in 2030. Ask now whether the invoice data leaving your system is genuinely structured to EN 16931 and Peppol BIS Billing 3.0, or whether it is a PDF with a database behind it. The first is a format change later; the second is a rebuild.

Cost

What drives the price, and what a real quote contains

Integration quotes vary by a factor of five for the same two systems, and the difference is almost never developer rate. It is scope honesty.

The three things that move the number most: how many record types cross the boundary, whether the flow is one-way or two-way, and whether either side has a sandbox you can actually test against. Two-way sync is more than twice the cost of one-way, because now both systems can disagree about the truth and something has to arbitrate.

A quote worth signing names the record types, the direction, the error path, and who is called when it breaks. A quote that says "koppeling tussen systeem A en B" is quoting the happy path.

Limits

The limits your integration will actually hit

Most integration designs fail at a number nobody looked up. Take the system a Dutch SME is most likely to be connecting to. Exact Online's published API limits allow an app 60 calls per company per minute and 5,000 calls per company per day, with a higher daily ceiling on premium licences. A new access token may be requested no more than once every ten minutes, and more than ten errors per key, per user, per company, per endpoint, per hour gets the key temporarily blocked for an hour, with the block lengthening if the errors continue.

Work that through and the design constraints appear on their own. Running flat out at the per-minute ceiling, a full day's allowance is gone in about 83 minutes. Any pattern that fetches records one at a time will exhaust the budget on a mid-sized customer base, which is why the answer is batched pages and incremental syncs on a changed-since timestamp rather than a nightly full refresh. The error ceiling matters more than it looks: a retry loop that does not back off will trip the block itself, and then the integration is down for reasons of its own making.

Other systems publish different numbers, and the numbers move. The point is not these specific figures, it is that they are the first thing to read and the last thing most proposals mention. If a quote does not say what happens at the rate limit, nobody has looked.

When not to

When you should not build one

We turn integration work down in three situations, and they are common enough to check first.

The vendor already ships one. A supported connector that covers 80% of your case beats a custom build that covers 100%, because you are not the one maintaining it when the API version changes.
The volume does not justify it. Under roughly twenty records a day, a scheduled export and a person is less expensive for years, and it fails visibly rather than silently.
The process is still moving. Automating a process that changes next quarter buys you a rebuild. Fix the process first, then connect it.

Buyer guides

Compare further

Process automation Custom software or a package Custom software development Choosing a software company AI with Exact, AFAS and e-Boekhouden

FAQ

Frequently asked questions

What does an API integration cost in the Netherlands?

For a single one-way flow between two systems that both have a documented REST API and a sandbox, plan on a small project. Two-way sync, several record types, or an undocumented legacy endpoint move it into a full build. We quote fixed against a defined scope: audit at €2,500, proof of concept at €20,000, production from €50,000.

How long does it take?

The build is usually the shortest part. The schedule is set by access: getting credentials, a sandbox and a named contact on both sides routinely takes longer than writing the code. Ask for those on day one, not at the point of testing.

What if one of the systems has no API?

There are usually three options: a supported file exchange, a database-level read, or robotic entry against the user interface. The first is dull and reliable, the last is fragile and breaks whenever the screen changes. We would rather sell you the dull one.

Who owns the integration afterwards?

You own the code either way. The question worth settling before you start is who watches it. An integration without monitoring and a named owner reverts to manual within a year, and nobody notices until a customer does.

Do we need to be on Peppol if we sell to Belgium?

Legally, not if you have no permanent establishment in Belgium: businesses not established there are outside the obligation even when VAT-registered, for issuing and for receiving. Commercially it is a different question, because your Belgian customers now run structured invoicing by default and manual handling of your PDF is their problem, not yours to be forgiven for. Being reachable on Peppol is usually the less expensive side of that argument, and you are separately expected to tell Belgian counterparties that you have no permanent establishment there.

Does the new cybersecurity law change how we build integrations?

Indirectly, and mostly through your customers. The Dutch Cyberbeveiligingswet, the national implementation of NIS2, entered into force on 15 August 2026 and applies to roughly eight thousand organisations across eighteen designated sectors. The duty of care sits on those organisations, not on you, but one of its named measures is securing the supply chain, including the relationship with direct suppliers. It reaches you contractually rather than legally. If you sell into one of them, expect their security requirements to arrive as questions about your integration: how credentials are stored, who can reach the endpoint, what is logged and how long you keep it. Those are answerable at low cost if the integration was designed with them in mind and expensive to retrofit.

API integration: what it costs, and what breaks after go-live