SAP SuccessFactors

Built, not certified Built and tested against recorded and synthetic responses (version 0.1.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the structure of an organisation from SAP SuccessFactors through its OData v2 API: departments, locations, job codes, positions and job requisitions. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read any employee’s record.

Status: Built, not certified (needs an SAP SuccessFactors sandbox).

At a glance

Collector	SAP SuccessFactors, version 0.1.0
Reads	SAP: SAP SuccessFactors (OData v2 API) (the vendor's documentation)
Family	ERP
Kind	Hr
Ways to connect	OAuth approval
Scopes	Read: FODepartment, FOLocation, FOJobCode, Position, JobRequisition
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	None
Hosts it may contact	*.successfactors.com, *.successfactors.eu, *.successfactors.cn, *.sapsf.com, *.sapsf.eu, *.sapsf.cn, *.accounts.ondemand.com, *.accounts.cloud.sap, *.hana.ondemand.com
Vendor API versions	OData v2
Lowest engine version	0.47.0

What it reads

Object	Entity
departments	FODepartment
locations	FOLocation (without street addresses)
job_codes	FOJobCode
positions	Position (without the person in it)
job_requisitions	JobRequisition (without recruiter and salary range)

You choose which to read; a whole tenant is never the default. Changes are found by lastModifiedDateTime.

What it never reads. Employee records and payroll: PerPerson, PerPersonal, EmpJob, EmpEmployment, EmpCompensation, EmpPayCompRecurring, PerNationalId, PerEmail, PerPhone, PerAddress, bank details, benefits, performance and health data. No object in this release reads them. As a last guard, any field whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national and tax ids, bank, birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a person, employee, manager or recruiter) is dropped before a record is written, and only the number dropped is noted on the record.

How to connect

1. In your SAP Cloud Identity Services tenant (or the OAuth client registration your SuccessFactors tenant uses), register an OAuth 2.0 client for client credentials and note the token address, client id and client secret.
2. Give the API user behind it read on the entities above and nothing else (role-based permissions, with no employee data).
3. In LightHouse, open Connectors and choose SAP SuccessFactors.
4. Enter the data centre’s API address (for example https://api55.sapsf.eu), your company id, the token address, client id and client secret.
5. Choose a label, the objects to read, and how often.

The secrets are sealed in your deployment and never shown again.

Permissions

Read on the entities above. The collector sends only GET requests; the one POST is the OAuth token request. Its read-only test proves it on every change. This release takes read-only credentials only.

Limits

• OAuth 2.0 client credentials only. SAML bearer assertions are not supported in this release, and there is no Basic fallback.
• The API address must be a SuccessFactors data-centre host (api*.successfactors.com, .eu, .cn, or api*.sapsf.com, .eu, .cn). The token host in your credential is the only other host contacted. A redirect is never followed.
• Effective-dated entities are read as the API returns them; a record that changes its start date appears as a new record.
• Deletions are found by listing keys every six hours.
• Entity and field names follow SAP’s published API descriptions; a field a tenant lacks is left out.
• Requests are paced and back off when the API asks.

Data handling

• No personal data is read (see “What it reads”).
• The responses are not cached; only the records written are kept, in your deployment.
• Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse.

Troubleshooting

What you see	What it means	What to do
auth_failed	The client was refused at the token address (invalid client or grant), or the API returned 401	Check the client id, secret, company id and token address
scope_missing	The API user may not read the entity (403)	Grant read on that entity in role-based permissions
unreachable	The API did not answer, or answered with an error	Check the data-centre address and that the tenant is up
HostNotAllowed	A request went to a host that is not in your credential	Correct the credential
Read succeeded, 0 written	Nothing changed since the last read	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	0.1.0	0.47.0	OData v2	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only