SAP OData Setup Guide Private Preview

Follow our setup guide to connect SAP OData to your destination using the Fivetran connector.

Prerequisites

To connect your SAP OData API to Fivetran, you need:

SAP User Account: An SAP Communication or System user with the authorizations specified in the Configure SAP user section
Host: The host name of the SAP Gateway on which the SAP OData source is located
To use HTTPS, you must specify a host name, not an IP address. If your SAP Gateway does not have a DNS name, add an entry that maps its IP address to a host name in your local hosts file.
Port Configuration: The HTTPS port configured on your SAP system (typically 443 or 8443)
Authentication: The username and password associated with the SAP user
OData Services: The OData services that you want to extract data from, properly exposed and available for consumption.
For more information, see the SAP ODP-Based Data Extraction via OData documentation.
The OData services must reside in the SAP namespace /sap/opu/odata/sap and be registered in the SAP Gateway using transaction /IWFND/MAINT_SERVICE.

Setup instructions

Check SAP Gateway activation

To check the status of the SAP Gateway, do the following:

Open transaction SPRO.
Navigate to SAP NetWeaver > SAP Gateway > OData Channel > Configuration > Activate or Deactivate SAP Gateway.
Click the Activity icon. A message shows the current status: Active or Not Active.
If the SAP Gateway status is inactive, click Activate.

Check services in transaction SICF

The SICF transaction ensures the activation of required HTTP services for OData functionality. To check the node service status, do the following:

Open transaction SICF.
Navigate to the following service path: /sap/opu/odata/SAP/.
Check that the node is active.
If the required OData service is inactive, right-click and select Activate Service.
Repeat for all services under the service path /sap/opu/odata/iwfnd.

Configure SAP user

This section lists the authorizations that you must assign to an SAP Communication or System user to access SAP Gateway services and extract data from Core Data Services (CDS) views. These authorizations cover:

OData services - Access to specific OData endpoints
Batch jobs - Background job execution for data extraction
Fivetran connectivity - Connection verification and health checks
CDS views - Access to Core Data Services views
Business Warehouse (BW) extractors - Access to traditional BW data extraction objects
OData catalog - Service discovery and metadata access

To access SAP Gateway services, you need the authorization object S_SERVICE. This object contains two fields, SRV_NAME and SRV_TYPE, which you must configure with encoded values. Look up the encoded values for these fields in the SAP standard dialog (TADIR entries).

Work with your SAP security administrator to ensure proper authorization assignment and to avoid overly broad permissions.

For troubleshooting authorization issues, use the USOBHASH table to identify missing authorizations. This table contains authorization hash values that help diagnose permission problems.

Authorization for OData services

Assign the following authorizations to allow user access to OData endpoints:

Authorization Object	Authorization Field	Authorization Value
S_SERVICE	Program ID	R3TR
	Object Type	IWSG
	Object Name	<Service Group Name>
S_SERVICE	Program ID	R3TR
	Object Type	IWSV
	Object Name	<Service Name>

Authorization for batch jobs

SAP data extraction runs as background jobs. Assign the following authorizations to enable the creation and release of these jobs:

Authorization Object	Authorization Field	Authorization Value
S_BTCH_ADM	BTCADMIN	Y
S_BTCH_JOB	JOBACTION	RELE
	JOBGROUP	*

Authorization for Fivetran connectivity

Fivetran requires access to the SAP Gateway Catalog Service to verify connectivity with your SAP system. We first attempt to connect using the versioned v2 endpoint, IWFND/CATALOGSERVICE;v=2/, and then fall back to the unversioned path IWFND/CATALOGSERVICE/ if v2 is not available. This service is part of the standard SAP namespace /sap/opu/odata and must be registered and activated in the SAP Gateway using transaction /IWFND/MAINT_SERVICE. To allow access to the Catalog Service, assign the following authorization values to the SAP user:

Authorization Object	Authorization Field	Authorization Value
S_SERVICE	Program ID	R3TR
	Object Type	IWSG

Authorization for data extraction

Assign the following authorizations to extract data from CDS views:

Authorization Object	Authorization Field	Authorization Value
S_DHCDCSTP	DHCDCSBTYP	ODP
	ACTVT	03

Authorization for OData catalog

Assign the following authorizations to access the OData catalog service:

Authorization Object	Authorization Field	Authorization Value
S_START	AUTHPGMID	R3TR
	AUTHOBJTYP	G4BA
	AUTHOBJNAM	/IWFND/CONFIG

Authorizations required by ODP

SAP periodically updates the authorizations required for ODP data replication. For the current list of roles and authorization objects, refer to SAP Note 2855052 – Authorizations required for ODP Data Replication API 2.0. Accessing SAP Notes requires an SAP Support account.

Choose connection method

Decide on your preferred method for connecting Fivetran to your SAP Application Server.

Connect directly

Fivetran connects directly to your SAP system's application host, specified in the Hostname field during connection setup.

Connect using private networking

Private networking enables secure communication between private networks and services without exposing traffic to the public internet. It is the most secure connection method available and is recommended for production environments.

You must have a Business Critical plan to use private networking.

We support the following private networking providers:

AWS PrivateLink – Used for Virtual Private Clouds (VPCs) and AWS-hosted or on-premises services. See our AWS PrivateLink setup guide for details.
Azure Private Link – Used for Virtual Networks (VNets) and Azure-hosted or on-premises services. See our Azure PrivateLink setup guide for details.

Connect via Proxy Agent

Fivetran connects to your SAP Application Server through a Proxy Agent. Use this method when your SAP Application Server is behind a firewall or in a private network and direct or private networking is not available.

If you selected Connect via Proxy Agent, choose the necessary proxy agent from the Proxy agents drop-down list, if one is available, or configure a new proxy agent.

Connections to your SAP system must use HTTPS. The connector doesn't support plain HTTP.

Running multiple SAP OData connectors? Give each connector its own SAP user and its own set of OData services. SAP tracks ODP subscriptions and delta queues per user and service, so reusing either across connectors causes conflicting delta state and failed syncs. For more information, see our SAP OData limitations.

Finish Fivetran configuration

In the connection setup form, enter the Destination schema name of your choice.
(Hybrid Deployment only) If your destination is configured for Hybrid Deployment, the Hybrid Deployment Agent associated with your destination is pre-selected for the connection. To assign a different agent, click Replace agent, select the agent you want to use, and click Use Agent.
In the Username field, enter your SAP system username.
In the Password field, enter the password associated with your SAP system username.
In the Hostname field, enter the host name of the SAP Gateway on which your SAP OData source is located.
You must enter a host name, not an IP address. This is required because the connector uses HTTPS.
In the Port field, enter your SAP system port number.
From the Connection method drop-down, select how Fivetran connects to your SAP system:
- Connect directly
- Connect via private networking
- Connect via Proxy Agent
  - Select an existing agent from the Proxy agents drop-down list or click + Configure a new proxy agent to set up a new agent.
Click Save & Test. Fivetran validates the connection and begins the initial sync of your SAP OData data.

The initial sync may take some time depending on the volume of data in your selected OData services. Subsequent syncs will use delta extraction for improved performance.