# SAP S/4HANA > SAP S/4HANA: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 0.1.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the business records of an SAP S/4HANA system through SAP’s released OData v2 APIs: orders, invoices, stock movements, products, journal entries, cost centres and organisations. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read personal data. Status: **Built, not certified** (needs an SAP S/4HANA sandbox). ## At a glance | Collector | SAP S/4HANA, version `0.1.0` | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | SAP: SAP S/4HANA (OData v2 released APIs) ([the vendor's documentation](https://api.sap.com/products/SAPS4HANACloud/apis/ODATAV2)) | | Family | ERP | | Kind | ERP | | Ways to connect | OAuth approval, Access token | | Scopes | - Read: `API_SALES_ORDER_SRV`, `API_PURCHASEORDER_PROCESS_SRV`, `API_SUPPLIERINVOICE_PROCESS_SRV`, `API_MATERIAL_DOCUMENT_SRV`, `API_PRODUCT_SRV`, `API_JOURNALENTRYITEMBASIC_SRV`, `API_COSTCENTER_SRV`, `API_BUSINESS_PARTNER` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `*.s4hana.cloud.sap`, `*.s4hana.ondemand.com`, `*.hana.ondemand.com`, `*.accounts.ondemand.com`, `*.accounts.cloud.sap` | | Vendor API versions | OData v2 (released APIs) | | Lowest engine version | `0.47.0` | ## What it reads You choose which of these to read; a whole system is never the default. | Object | API and entity | Notes | | -------------------- | ------------------------------------------------------ | ----------------------------------------------------- | | `sales_orders` | API_SALES_ORDER_SRV, A_SalesOrder | order headers | | `purchase_orders` | API_PURCHASEORDER_PROCESS_SRV, A_PurchaseOrder | order headers | | `supplier_invoices` | API_SUPPLIERINVOICE_PROCESS_SRV, A_SupplierInvoice | invoice headers | | `material_documents` | API_MATERIAL_DOCUMENT_SRV, A_MaterialDocumentHeader | stock movement headers | | `products` | API_PRODUCT_SRV, A_Product | product master | | `journal_entries` | API_JOURNALENTRYITEMBASIC_SRV, A_JournalEntryItemBasic | ledger line items, without item text | | `cost_centres` | API_COSTCENTER_SRV, A_CostCenter | with the cost centre’s name | | `business_partners` | API_BUSINESS_PARTNER, A_BusinessPartner | organisations only (`BusinessPartnerCategory eq '2'`) | Fields are selected by name. Changes are found by the entity’s change field (`LastChangeDateTime` or `LastChangeDate`); an entity with none is read in full each time, and only what changed is rewritten. **What it never reads.** Business partners who are people, employees, contacts and addresses; payroll and employee cost postings; bank details and tax ids. As a last guard, any field whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national and tax ids, bank, birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a person, employee or worker) is dropped before a record is written, and only the number dropped is noted on the record. ## How to connect 1. In S/4HANA, create a **communication user** and a **communication arrangement** for the services above (Cloud public edition: the communication scenarios for those APIs), or an **OAuth 2.0 client** with the client-credentials grant. Give it read on those services only. 2. In LightHouse, open **Connectors** and choose **SAP S/4HANA**. 3. Enter the API address (`https://` and the host, nothing after it), and either the OAuth token address, client id and client secret, or the communication user and password. Give exactly one of the two. 4. Choose a label for what the records are (for example `internal`), the objects to read, and how often. Nothing reads on a schedule until you choose one. The secrets are sealed in your deployment and never shown again. ## Permissions Read on the named services, and nothing that creates or changes. The collector sends only `GET` requests to the entity sets; the one `POST` is the OAuth token request. It never uses `$batch`, function imports or a CSRF token (those exist to write). Its read-only test proves it on every change. This release takes read-only credentials only. ## Limits - One system per source. - The hosts it contacts are the API host and, for OAuth, the token host in your credential, and no others. A redirect is never followed. The manifest lists SAP’s cloud domains; a gateway host you name yourself is also read, pinned by the sealed credential. - Cost centres have no change field, so they are read in full each time. - Journal entries use the posting date as their change field and look back 35 days each time, so a posting back-dated further than that is not seen until a first read is repeated. - Entity and field names follow SAP’s published API descriptions; a system with different releases may lack a field. A missing field is left out. - Deletions are found by listing keys every six hours. - Requests are paced and back off when the system asks. ## Data handling - No personal data is read by default (see “What it reads”). - The responses are not cached; only the records written are kept, in your deployment. - Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `auth_failed` | The client or user was refused (401, or an invalid client at the token address) | Check the secret and the token address; create a new one if it was rotated | | `scope_missing` | The user or client may not read the service (403) | Add the communication scenario or role for that API | | `unreachable` | The system did not answer, or answered with an error | Check the API address and that the system is up | | `HostNotAllowed` | A request went to a host that is not in your credential | Correct the credential; the collector does not read elsewhere | | Read succeeded, 0 written | Nothing changed since the last read | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------ | ----------------------------------- | -------------- | | 10 November 2026 | `0.1.0` | `0.47.0` | OData v2 (released APIs) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/sap-s4hana/