Skip to content

guides

Intended Documentation

SAP S/4HANA Cloud Connector Setup (Beta)

Connect Intended to SAP S/4HANA Cloud (OData). Register an OAuth client (client-credentials), paste the OData base URL, token URL, client ID and secret, and run Test connection. Host-pinned to SAP cloud domains with an OData X-CSRF-Token handshake. Beta until validated against your live tenant.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

SAP S/4HANA Cloud Connector Setup (Beta)#

Connect Intended to SAP S/4HANA Cloud so approved intents can create purchase orders and post supplier invoices through the real SAP OData adapter (packages/execution-engine/src/adapters/sap.ts). Auth is an OAuth 2.0 client-credentials grant; OData writes use the X-CSRF-Token handshake. Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real S/4HANA tenant is pending — treat SAP as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionssap.purchaseorder.create, sap.invoice.post
AuthOAuth 2.0 client-credentials via HTTP Basic at tokenUrl → Authorization: Bearer <token> to baseUrl; OData v2 writes replay a fetched X-CSRF-Token + cookie
Host pinBoth baseUrl and tokenUrl must resolve to a SAP-cloud host — suffix allowlist: .hana.ondemand.com, .s4hana.cloud.sap, .s4hana.ondemand.com, .sap
SSRF hardeningHTTPS required; embedded credentials forbidden; 169.254.169.254, metadata.google.internal, and any 169.254.* blocked
Test connectionGET /sap/opu/odata/sap/API_PURCHASEORDER_PROCESS_SRV/ (service document)

Writes go to the standard S/4HANA OData services (A_PurchaseOrder, A_SupplierInvoice), preceded by a GET …?$top=0 with X-CSRF-Token: Fetch to obtain the CSRF token and cookie, which are replayed on the POST.

Provider-side steps#

1. Register an OAuth client#

  1. In your SAP BTP / S/4HANA Cloud communication-arrangement setup, register a communication user / OAuth client for the target Communication Scenarios (purchase order + supplier invoice APIs).
  2. Choose the OAuth 2.0 client-credentials grant.
  3. Copy the client ID (clientId) and client secret (clientSecret).

2. Collect the two URLs#

  • baseUrl — your OData API host, e.g. https://my-tenant.s4hana.cloud.sap.
  • tokenUrl — your tenant's UAA/authentication token endpoint, e.g. https://my-tenant.authentication.sap.hana.ondemand.com/oauth/token.

Both must resolve to one of the pinned SAP-cloud suffixes above.

Least-privilege scope guidance#

  • Matrix capabilities: purchaseorder:write, invoice:write.
  • Restrict the communication arrangement to only the two APIs used: API_PURCHASEORDER_PROCESS_SRV (purchase order create) and API_SUPPLIERINVOICE_PROCESS_SRV (supplier invoice post), plus read on the purchase-order service for the probe.
  • Do not grant the OAuth client access to unrelated communication scenarios.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → SAP → Configure auth:

Field labelKeyRequiredValue
OData API Base URLbaseUrlYeshttps://my-tenant.s4hana.cloud.sap
OAuth Token URLtokenUrlYeshttps://my-tenant.authentication.sap.hana.ondemand.com/oauth/token
OAuth Client IDclientIdYesThe OAuth client id
OAuth Client SecretclientSecretYesThe OAuth client secret

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter runs the client-credentials grant and fetches the purchase-order service document. A green result means both hosts passed the SAP-cloud pin and the OAuth client authenticated.

Next steps#

SAP S/4HANA Cloud Connector Setup (Beta) | Intended