SAP S/4HANA
Reads the business records of an SAP S/4HANA system through SAP’s released OData v2 APIs: orders, invoices, stock movements, products, journal entries, cost centres and organisations. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read personal data.
Status: Built, not certified (needs an SAP S/4HANA sandbox).
At a glance
Section titled “At a glance”| Collector | SAP S/4HANA, version 0.1.0 |
|---|---|
| Reads | SAP: SAP S/4HANA (OData v2 released APIs) (the vendor's documentation) |
| Family | ERP |
| Kind | ERP |
| Ways to connect | OAuth approval, Access token |
| Scopes |
|
| Read only | Yes, except: [object Object] |
| Vendor's API can move money | No |
| Personal data | None |
| Hosts it may contact | *.s4hana.cloud.sap, *.s4hana.ondemand.com, *.hana.ondemand.com, *.accounts.ondemand.com, *.accounts.cloud.sap |
| Vendor API versions | OData v2 (released APIs) |
| Lowest engine version | 0.47.0 |
What it reads
Section titled “What it reads”You choose which of these to read; a whole system is never the default.
| Object | API and entity | Notes |
|---|---|---|
sales_orders |
API_SALES_ORDER_SRV, A_SalesOrder | order headers |
purchase_orders |
API_PURCHASEORDER_PROCESS_SRV, A_PurchaseOrder | order headers |
supplier_invoices |
API_SUPPLIERINVOICE_PROCESS_SRV, A_SupplierInvoice | invoice headers |
material_documents |
API_MATERIAL_DOCUMENT_SRV, A_MaterialDocumentHeader | stock movement headers |
products |
API_PRODUCT_SRV, A_Product | product master |
journal_entries |
API_JOURNALENTRYITEMBASIC_SRV, A_JournalEntryItemBasic | ledger line items, without item text |
cost_centres |
API_COSTCENTER_SRV, A_CostCenter | with the cost centre’s name |
business_partners |
API_BUSINESS_PARTNER, A_BusinessPartner | organisations only (BusinessPartnerCategory eq '2') |
Fields are selected by name. Changes are found by the entity’s change field
(LastChangeDateTime or LastChangeDate); an entity with none is read in
full each time, and only what changed is rewritten.
What it never reads. Business partners who are people, employees, contacts and addresses; payroll and employee cost postings; bank details and tax ids. As a last guard, any field whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national and tax ids, bank, birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a person, employee or worker) is dropped before a record is written, and only the number dropped is noted on the record.
How to connect
Section titled “How to connect”- In S/4HANA, create a communication user and a communication arrangement for the services above (Cloud public edition: the communication scenarios for those APIs), or an OAuth 2.0 client with the client-credentials grant. Give it read on those services only.
- In LightHouse, open Connectors and choose SAP S/4HANA.
- Enter the API address (
https://and the host, nothing after it), and either the OAuth token address, client id and client secret, or the communication user and password. Give exactly one of the two. - Choose a label for what the records are (for example
internal), the objects to read, and how often. Nothing reads on a schedule until you choose one.
The secrets are sealed in your deployment and never shown again.
Permissions
Section titled “Permissions”Read on the named services, and nothing that creates or changes. The
collector sends only GET requests to the entity sets; the one POST is the
OAuth token request. It never uses $batch, function imports or a CSRF
token (those exist to write). Its read-only test proves it on every change.
This release takes read-only credentials only.
Limits
Section titled “Limits”- One system per source.
- The hosts it contacts are the API host and, for OAuth, the token host in your credential, and no others. A redirect is never followed. The manifest lists SAP’s cloud domains; a gateway host you name yourself is also read, pinned by the sealed credential.
- Cost centres have no change field, so they are read in full each time.
- Journal entries use the posting date as their change field and look back 35 days each time, so a posting back-dated further than that is not seen until a first read is repeated.
- Entity and field names follow SAP’s published API descriptions; a system with different releases may lack a field. A missing field is left out.
- Deletions are found by listing keys every six hours.
- Requests are paced and back off when the system asks.
Data handling
Section titled “Data handling”- No personal data is read by default (see “What it reads”).
- The responses are not cached; only the records written are kept, in your deployment.
- Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse.
Troubleshooting
Section titled “Troubleshooting”| What you see | What it means | What to do |
|---|---|---|
auth_failed |
The client or user was refused (401, or an invalid client at the token address) | Check the secret and the token address; create a new one if it was rotated |
scope_missing |
The user or client may not read the service (403) | Add the communication scenario or role for that API |
unreachable |
The system did not answer, or answered with an error | Check the API address and that the system is up |
HostNotAllowed |
A request went to a host that is not in your credential | Correct the credential; the collector does not read elsewhere |
| Read succeeded, 0 written | Nothing changed since the last read | Nothing to do |
Certification
Section titled “Certification”Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.
| Date | Collector | Engine | Vendor API | Method | Expires |
|---|---|---|---|---|---|
| 10 November 2026 | 0.1.0 | 0.47.0 | OData v2 (released APIs) | Fixtures only: built, not certified | Not applicable |
Security posture
Section titled “Security posture”From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.
| Last scanned | 10 November 2026 |
|---|---|
| Critical findings | 0 |
| High findings | 0 |
| Medium findings | 0 |
| Low findings | 0 |
| Info findings | 0 |
| Release blocked | No |
| Network allow-list check | Pass |
| Read-only behavioural test | Pass |
| SBOM (CycloneDX) | Produced |
| Dependency licences | Pass |
| Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only |