# SAP Business One — Accounting API: connection

> Canonical URL: https://developers.apideck.com/apis/accounting/sap-business-one/connection

# How to connect to SAP Business One

Apideck connects to SAP Business One through the **Service Layer**, the REST API that ships with SAP Business One. You make your Service Layer reachable from Apideck over HTTPS, create a dedicated SAP Business One user for the integration, and enter four details in Vault: the Service Layer address, the company database, and that user's name and password. There is no app to install and nothing to request from SAP.

## Before you start

You need:

- **SAP Business One 10.0 or later**, in the version for SAP HANA or for Microsoft SQL Server, with the **Service Layer** installed. The connector uses Service Layer v2 (`/b1s/v2`), which is available from SAP Business One 10.0. On Microsoft SQL Server, the Service Layer is supported from 10.0 PL01.
- **Someone who can change your network setup**: publish the Service Layer on a public HTTPS address and open your firewall to Apideck (see step 1). This is usually your IT team or your SAP partner.
- **An SAP Business One administrator** who can create a user and assign authorizations (see step 2).

Steps 1 and 2 are a one-time setup on your side; step 3 is where you connect in Vault. If you only want to try the integration first, you can skip steps 1 and 2 and use Apideck's shared demo company instead (see step 4).

For SAP's own reference on installing and configuring the Service Layer, see [Working with SAP Business One Service Layer](https://help.sap.com/doc/fc2f5477516c404c8bf9ad1315a17238/10.0/en-US/Working_with_SAP_Business_One_Service_Layer.pdf).

## Steps

### 1. Make the Service Layer reachable from Apideck

Apideck calls your Service Layer from the internet, so it must be published like any other public HTTPS service:

1. **Use a public hostname.** Give the Service Layer an address that resolves on the public internet, for example `https://sap.example.com` or `https://sap.example.com:50000` (50000 is the Service Layer's default port).
2. **Use a CA-signed HTTPS certificate.** Apideck rejects self-signed certificates. Install a certificate issued by a public certificate authority for the hostname you use in Vault.
3. **Put a reverse proxy in front of an on-premise Service Layer.** SAP's recommended pattern is a reverse proxy (for example NGINX) in a DMZ that forwards requests to the Service Layer. The proxy is also a convenient place to terminate HTTPS with your CA-signed certificate. Configure it so that it **passes the `Set-Cookie` headers on the `/Login` response through unchanged**: Apideck keeps the session with the `B1SESSION` cookie (and the `ROUTEID` cookie on load-balanced setups), and the connection cannot log in if the proxy strips them.
4. **Allow Apideck's egress IPs through your firewall** on the port the Service Layer (or your proxy) listens on:
   - `18.197.244.247`
   - `18.156.9.3`
   - `3.65.139.215`

   These are Apideck's current EU (`eu-central-1`) egress IPs; support for other regions is upcoming. If you need to confirm the latest list for your region, contact [Apideck Support](https://help.apideck.com/en/articles/7774658).

### 2. Create a dedicated integration user

Create an SAP Business One user just for the integration rather than using a person's login. The connection runs as this one user, so a dedicated user keeps it independent of staff changes and password policies for named users.

1. In SAP Business One, create the user and set its password.
2. Give the user authorizations for the modules you plan to sync, for example business partners, sales, purchasing and financials. A superuser is not required. Set authorizations under **Administration > System Initialization > Authorizations > General Authorizations**.
3. Make sure the user can at least **read business partners**. Apideck reads your customers when you save the connection to check that it works.
4. License the user according to your SAP Business One agreement. Your SAP partner can confirm which licence type applies to an external integration.

Data that Apideck can read and write follows this user's authorizations. If the user lacks an authorization for an object, the Service Layer returns an error for that object (see [Troubleshooting](#troubleshooting)).

If the application you are connecting needs to work across several of your company databases with one connection, create the same user, with the same password and the authorizations it needs, in each of those companies.

### 3. Connect in Vault

Open the SAP Business One connection in Vault and fill in the four fields. All four are required.

| Field | What to enter |
|-------|---------------|
| **Instance URL** | The public base address of your Service Layer: scheme, host and optional port, **without** `/b1s/v2` and without a trailing slash. For example `https://sap.example.com:50000`. Apideck adds `/b1s/v2` itself. |
| **Company Database** | The name of the company database to connect to, for example `SBODEMOUS`. This is the database name, which can differ from the company name shown in SAP Business One. |
| **Username** | The integration user from step 2. |
| **Password** | That user's password. |

Save the connection. Apideck then logs in to your Service Layer with these details and lists your customers (business partners). When both succeed, Vault shows the connection as **connected**.

Apideck renews the Service Layer session automatically before the idle timeout set on your Service Layer runs out, so there is nothing to refresh on your side.

### 4. Optional: test before you connect a live company

Once connected, the integration creates, updates and cancels documents in the company database you entered. If you would rather not start on your live company, you have two options:

- **Apideck's shared demo company.** Ask [Apideck Support](https://help.apideck.com/en/articles/7774658) for access; you receive the connection details to enter in Vault.
- **A test company database on your own server**, for example a copy of production or an SAP demo database. Connect it the same way as above, entering the test database's name in **Company Database**.

## Troubleshooting

### Every call returns 404

- **Your SAP Business One version is older than 10.0.** Version 9.x only has Service Layer v1 (`/b1s/v1`), and the connector needs v2 (`/b1s/v2`). Upgrade to SAP Business One 10.0 or later.
- **The Instance URL already contains `/b1s/v2`.** Remove it; Apideck adds it, and a doubled path does not exist.
- **Your reverse proxy does not forward the `/b1s/v2` path** to the Service Layer. Check the proxy's routing rules.

### Certificate or TLS errors

The Service Layer, or the proxy in front of it, is presenting a self-signed certificate or a certificate that does not match the hostname in **Instance URL**. Install a CA-signed certificate for that exact hostname (see step 1).

### The connection times out

Apideck cannot reach your Service Layer. Check that:

- the hostname in **Instance URL** resolves on the public internet, not only inside your network;
- your firewall allows Apideck's egress IPs (listed in step 1) on the port in **Instance URL**;
- the Service Layer (and your proxy, if you use one) is running.

### Login fails although the user name and password are correct

- Check **Company Database**: it must be the database name, not the company's display name.
- Check that the user exists in that company database and is not locked.
- If you use a reverse proxy, check that it passes the `Set-Cookie` headers on the `/Login` response through unchanged (see step 1).

### Error -3000: "The logged-on user does not have permission to use this object"

The integration user lacks an authorization for the object Apideck tried to read or write. Grant it under **Administration > System Initialization > Authorizations > General Authorizations** in SAP Business One, then retry. If this happens when you save the connection, give the user read access to business partners.

### The connection stopped working after a change in SAP

Changing the integration user's password, locking the user or removing its authorizations breaks the connection. Update the password in Vault, or restore the user's access in SAP Business One, and save the connection again.


[API reference](https://developers.apideck.com/apis/accounting/reference.md) · [Coverage matrix](https://developers.apideck.com/apis/accounting/coverage)