How to connect to SAP S/4HANA Cloud

The Apideck Accounting API uses Basic Authentication with a dedicated SAP Communication User. Before you can connect, an SAP administrator must create a Communication Arrangement that grants the Communication User access to the OData services this connector reads from.

Before you start, you'll need: an SAP S/4HANA Cloud Public Edition tenant and administrator access to it (the SAP_BR_ADMINISTRATOR business role) so the arrangement and user can be created.

Create a Communication Arrangement

1. Sign in to your SAP S/4HANA Cloud tenant as an administrator and open the Communication Arrangements app (Fiori launchpad → search "Communication Arrangements"). See SAP's Maintaining Communication Arrangements for a walkthrough of the app.

2. Choose New and activate the Communication Scenarios that cover the resources you need. Only activate what you plan to use:

   • SAP_COM_0008 – Business Partner Integration (customers, suppliers)
   • SAP_COM_0057 – Supplier Invoice Integration (bills, purchase orders)
   • SAP_COM_0120 – Billing Document Integration (invoices, invoice items)
   • SAP_COM_0303 – Accounting Document Integration (reads for journal entries, invoices, payments, bill payments)
   • SAP_COM_0002 – Journal Entry posting (required to create journal entries, invoices, payments or bill payments — all four post through this synchronous service)
   • SAP_COM_0084 – Finance Master Data Integration (ledger accounts, subsidiaries/company codes, departments/cost centers)

3. Bind a Communication User to the arrangement. If you do not already have one, create it from the Maintain Communication Users app (SAP documentation) and assign a strong password. Note the user's ID and password — you will paste these into Vault.

4. Authentication method on the arrangement must be User ID and Password (Basic Authentication). OAuth is rejected by several of the OData services used by this connector.

5. Save and activate the arrangement.

Find Your Tenant ID

Your tenant ID is the subdomain of your SAP S/4HANA Cloud URL. For example, if your Fiori launchpad is at https://my123456.s4hana.cloud.sap, then my123456 is your tenant ID. The connector builds its API host from that value (my123456-api.s4hana.cloud.sap), so enter the subdomain only.

Vault Connection Setup

Paste the values below into Vault:

• Tenant ID – The subdomain of your SAP S/4HANA Cloud URL (e.g., my123456). Do not include https:// or .s4hana.cloud.sap.
• Communication User – The Communication User name bound to the Communication Arrangement (e.g., APIDECK_UNIFY).
• Communication User Password – The password generated for that Communication User.

Click Save, then click Authorize.

Your SAP S/4HANA Cloud account is now connected.

Notes

• Company code is sent per request, not stored on the connection. There is no company-code setting on this connection. The company code travels as the unified company_id field, which maps to SAP CompanyCode on each resource. It is required when creating journal entries, invoices, payments and bill payments — the integration sends it with every write.

• Getting a single accounting document needs a composite ID. SAP identifies these records by a compound key, so GET by id takes a colon-delimited value rather than a bare document number:

  • bills — <SupplierInvoice>:<FiscalYear> (e.g. 5105600102:2025)
  • journal entries, invoices, payments, bill payments — <CompanyCode>:<FiscalYear>:<AccountingDocument> (e.g. 1010:2025:100000123)

  The ids returned by the corresponding list calls are already in this form, so passing them straight through works.

• Posted documents cannot be edited. SAP treats posted accounting documents as immutable, so journal entries, invoices, payments and bill payments support create only — there is no update. Correcting a mistaken post means reversing it, which creates a new offsetting document. For bills, a delete request issues an SAP cancellation (a reversal) rather than removing the record; for the other four, do the reversal in SAP.

• Plan for password rotation. Communication User passwords expire according to your own tenant's password policy; SAP publishes no fixed lifetime. Ask your SAP administrator what your policy is and update the credential in Vault before the password expires, otherwise calls start failing with 401.

• Test on a test or quality tenant. A connection always targets one specific tenant, and this connector can write, so point test writes at a non-production tenant.

Troubleshooting

• 401 Unauthorized – The Communication User is not bound to the arrangement covering the service you called, the arrangement's authentication method is not User ID and Password, or the password has expired or been reset in SAP. Re-check the arrangement, then re-save the credentials in Vault.
• Some resources fail while others work – The Communication Scenario for the failing resource is not activated. Each scenario in the list above unlocks a different resource group; activate the missing one and re-try.
• Every resource fails – Verify the tenant ID is the bare subdomain, with no https://, no -api, and no .s4hana.cloud.sap. Note that this connector targets S/4HANA Cloud Public Edition hosts only; Private Edition and on-premise S/4HANA cannot be configured.
• "id has invalid format" – The GET-by-id value is not in the composite form described above.
• A create is rejected for a missing company code – Journal entry, invoice, payment and bill payment posts require company_id; there is no default to fall back on.

Still stuck? Contact Apideck Support.