Prerequisites & Access
Release, services, a read-only user — and the path an off-SAP collector takes to reach the system.
In the SAP System
| Prerequisite | Why | Verification |
|---|---|---|
| Release ≥ 2302 (on-premise, private, or public cloud) | The field mapping is built against the released metadata of this version. Older releases are possible, but then the fields are checked individually. | System status |
API_OPLACCTGDOCITEMCUBE_SRV active | The open item — receivables and payables in the same entity. | $metadata reachable |
API_BUSINESS_PARTNER active | Customer, address, bank, tax numbers, payment terms, and dunning data. | $metadata reachable |
API_SALES_ORDER_SRV and API_BILLING_DOCUMENT_SRV active | Only within order scope. | Service in the catalog |
| Technical user, read-only | Display access to documents (F_BKPF_BUK with ACTVT 03), customers, and business partners of the involved company codes — no creating, no editing. | POST to a service → 403 |
| QA system with the same services | Building and testing is done against QA, never against production. | Access via a second destination |
The Path from Outside
An on-premise system connects to the Cloud Connector, which opens into SAP BTP, not into the internet. A collector outside of BTP therefore needs a facade:
Path A (recommended): API Management. One API proxy per OData service in the Integration Suite; the proxy uses Destination + Connectivity to reach the on-prem system; the collector calls the proxy with OAuth 2.0 Client Credentials (XSUAA). Rate limits, quotas, logging, and key rotation all in one place.
Path B: Collector in BTP. The collector runs as a job in Cloud Foundry or Kyma and speaks Destination + Connectivity natively. No API Management needed, but a second runtime environment to operate.
Public Cloud: no facade needed. The service is directly reachable via a Communication Arrangement with a Communication User; everything else in this guide remains the same.
Credentials
Credentials, certificates, and keys are never transmitted via questionnaires or email. Bilendo provides a separate, secure channel; the IMS only contains the names of the secrets.