--- cuppy_hub: sap cuppy_path: reference/connectivity/choose-a-connection-path.md cuppy_section: docs cuppy_doc: QENQ-92HH cuppy_doc_uuid: db94ce56-799b-4cfc-8a91-eced46a5cbce cuppy_permalink: https://cuppy.io/sap/d/QENQ-92HH cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/sap/docs/reference/connectivity/choose-a-connection-path cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 60e3c92ad3a40d75b9a2b6041f352da5f7a989654f54474e6370f2e57c12e354 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Choosing how to connect to SAP ## Ask the customer first 1. **Which system and edition?** S/4HANA Cloud Public Edition, Private Edition, on-premise S/4HANA, or ECC, and which release. 2. **Which business objects and operations?** Read or write: business partners, sales orders, products, invoices. 3. **Is there a published API for them?** Check the Business Accelerator Hub (api.sap.com) together with the customer. 4. **Does the customer run SAP BTP**, with a Cloud Connector installed for on-premise systems? 5. **Who will the calls run as?** A technical (communication) user, or the end user through principal propagation. 6. **Does this integration count as AI-agent access** under the customer's SAP contract and SAP's API policy? See the last section. ## Paths by system | System | Path | Authentication | Notes | |---|---|---|---| | **Business Accelerator Hub sandbox** | HTTPS to the sandbox URL shown on each API's *Try Out* page | An **API key** in a request header (copy the header name from the hub) | Shared sample data. Good for learning the API shape; no writes that matter, no customer data | | **S/4HANA Cloud Public Edition** | HTTPS straight to the tenant's API host, or through a BTP destination of proxy type `Internet` | What the communication arrangement allows: basic (communication user), OAuth or client certificate | An administrator creates a **communication user**, a **communication system** (your app) and a **communication arrangement** for the API's **communication scenario**. Only published APIs are exposed. This is the hub's reading of SAP's setup terms; the steps aren't sourced yet | | **S/4HANA Private Edition or on-premise** | BTP destination with proxy type **`OnPremise`** → connectivity service → **Cloud Connector** in the customer network → SAP Gateway OData | Basic, client certificate, or **principal propagation** (the cloud user's identity is passed through) | The Cloud Connector opens an outbound connection only, so no inbound firewall change is needed. It exposes only allowlisted hosts and paths | | **ECC or no OData API** | As above, or RFC through the Cloud Connector | RFC needs SAP's connector libraries (JCo for Java) | **node-rfc is deprecated** ("No longer supported"). Prefer a published OData or SOAP API, or SAP Integration Suite | | **PrivateLink** | BTP destination of proxy type `PrivateLink` | Per service | For selected BTP services reaching your own IaaS accounts | All BTP destination authentication types are listed in `reference/connectivity/btp-destinations-and-cloud-connector.md`. Your first call, against the sandbox and then a destination: `guides/connectivity/first-call-from-typescript.md`. ## Restrictions on third-party and AI-agent access (2026) Reported by several outlets, but the hub couldn't read SAP's own policy text. Check the customer's contract and SAP's published API policy before building. - **SAP API Policy, version 4 (April 2026):** - Third-party AI agents may call SAP APIs only through **SAP-endorsed architectures**. Reports name Joule, Business Data Cloud and an "Agent Gateway". - Undocumented or private APIs are banned. - SAP reserves the right to throttle, suspend or terminate non-compliant access. Integrations on **published Business Accelerator Hub APIs** are described as compliant. - **SAP Note 3255746:** third-party applications using **ODP over RFC** (a common bulk data-extraction route) are blocked. Vendor articles give June or July 2026 as the date. The hub's reading: - Build agents on **published APIs** called with a named technical user and least-privilege scopes. - Keep a human approval step for writes. - Log every call. - Don't use RFC, ODP or unreleased services for agent access without written agreement from SAP or the customer. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 10 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/sap/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.