Skip to main content
Private Edition and on-premise systems only. Basis administrator access (SICF, /IWFND/MAINT_SERVICE, SOAUTH2) is required. For SAP S/4HANA Cloud Public Edition use Basic Auth, Client Certificate or OAuth 2.0 (Authorization Code + PKCE) instead.

​
Find your API host

The API host is the HTTPS host and port of your system’s OData endpoint.

1

Get the host from your Basis team

Use the host and port that serve /sap/opu/odata, for example s4.example.com:44300.

​
Activate the OAuth token service

The token endpoint is an ICF service that must be active.

1

Activate the service in SICF

In transaction SICF, activate default_host/sap/bc/sec/oauth2. Tokens are then issued at https://<host>/sap/bc/sec/oauth2/token.

​
Enable OAuth on the OData services

Each OData service you want to call must allow OAuth.

1

Enable OAuth per service

In /IWFND/MAINT_SERVICE, select each service and enable OAuth. This creates its OAuth scope.

  • API_BUSINESS_PARTNER (scope API_BUSINESS_PARTNER_0001) for Business Partner, Customer and Supplier
  • API_SALES_QUOTATION_SRV, API_SALES_CONTRACT_SRV, API_SLSPRICINGCONDITIONRECORD_SRV
  • API_CUSTOMER_MATERIAL_SRV, API_MATERIAL_STOCK_SRV, API_MATERIAL_DOCUMENT_SRV, API_BILLING_DOCUMENT_SRV
  • If the service is registered under a different technical name (e.g. ZAPI_...), its scope uses that name

​
Register the OAuth client

The OAuth client is tied to a technical user whose roles allow the APIs.

1

Create the client in SOAUTH2

In transaction SOAUTH2, create an OAuth 2.0 client for a technical (system) user.

  • The Client ID is the technical user name; the Client Secret is that user’s password
  • Enable the Client Credentials grant type
  • Assign the scopes of every service you enabled, e.g. API_BUSINESS_PARTNER_0001
2

Authorize the technical user

Calls run as the technical user, so give it roles (PFCG) that allow the APIs, including authorization object S_SCOPE for the OAuth client and its scopes.

1

Connect

  • Click Connect.
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup.
2

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.