# SAP SuccessFactors > SAP SuccessFactors: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 0.1.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the structure of an organisation from SAP SuccessFactors through its OData v2 API: departments, locations, job codes, positions and job requisitions. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read any employee’s record. Status: **Built, not certified** (needs an SAP SuccessFactors sandbox). ## At a glance | Collector | SAP SuccessFactors, version `0.1.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | SAP: SAP SuccessFactors (OData v2 API) ([the vendor's documentation](https://help.sap.com/docs/successfactors-platform/sap-successfactors-api-reference-guide-odata-v2)) | | Family | ERP | | Kind | Hr | | Ways to connect | OAuth approval | | Scopes | - Read: `FODepartment`, `FOLocation`, `FOJobCode`, `Position`, `JobRequisition` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `*.successfactors.com`, `*.successfactors.eu`, `*.successfactors.cn`, `*.sapsf.com`, `*.sapsf.eu`, `*.sapsf.cn`, `*.accounts.ondemand.com`, `*.accounts.cloud.sap`, `*.hana.ondemand.com` | | Vendor API versions | OData v2 | | Lowest engine version | `0.47.0` | ## What it reads | Object | Entity | | ------------------ | --------------------------------------------------- | | `departments` | FODepartment | | `locations` | FOLocation (without street addresses) | | `job_codes` | FOJobCode | | `positions` | Position (without the person in it) | | `job_requisitions` | JobRequisition (without recruiter and salary range) | You choose which to read; a whole tenant is never the default. Changes are found by `lastModifiedDateTime`. **What it never reads.** Employee records and payroll: PerPerson, PerPersonal, EmpJob, EmpEmployment, EmpCompensation, EmpPayCompRecurring, PerNationalId, PerEmail, PerPhone, PerAddress, bank details, benefits, performance and health data. No object in this release reads them. As a last guard, any field whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national and tax ids, bank, birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a person, employee, manager or recruiter) is dropped before a record is written, and only the number dropped is noted on the record. ## How to connect 1. In your SAP Cloud Identity Services tenant (or the OAuth client registration your SuccessFactors tenant uses), register an **OAuth 2.0 client** for client credentials and note the token address, client id and client secret. 2. Give the API user behind it **read** on the entities above and nothing else (role-based permissions, with no employee data). 3. In LightHouse, open **Connectors** and choose **SAP SuccessFactors**. 4. Enter the data centre’s API address (for example `https://api55.sapsf.eu`), your company id, the token address, client id and client secret. 5. Choose a label, the objects to read, and how often. The secrets are sealed in your deployment and never shown again. ## Permissions Read on the entities above. The collector sends only `GET` requests; the one `POST` is the OAuth token request. Its read-only test proves it on every change. This release takes read-only credentials only. ## Limits - OAuth 2.0 client credentials only. SAML bearer assertions are not supported in this release, and there is no Basic fallback. - The API address must be a SuccessFactors data-centre host (`api*.successfactors.com`, `.eu`, `.cn`, or `api*.sapsf.com`, `.eu`, `.cn`). The token host in your credential is the only other host contacted. A redirect is never followed. - Effective-dated entities are read as the API returns them; a record that changes its start date appears as a new record. - Deletions are found by listing keys every six hours. - Entity and field names follow SAP’s published API descriptions; a field a tenant lacks is left out. - Requests are paced and back off when the API asks. ## Data handling - No personal data is read (see “What it reads”). - The responses are not cached; only the records written are kept, in your deployment. - Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ------------------------- | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | `auth_failed` | The client was refused at the token address (invalid client or grant), or the API returned 401 | Check the client id, secret, company id and token address | | `scope_missing` | The API user may not read the entity (403) | Grant read on that entity in role-based permissions | | `unreachable` | The API did not answer, or answered with an error | Check the data-centre address and that the tenant is up | | `HostNotAllowed` | A request went to a host that is not in your credential | Correct the credential | | Read succeeded, 0 written | Nothing changed since the last read | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------- | ----------------------------------- | -------------- | | 10 November 2026 | `0.1.0` | `0.47.0` | OData v2 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/sap-successfactors/