Accessing SAP Cloud Integration (SAP CI) information programmatically has become quite common today.
Whether it’s iFlows, message processing logs, or deployed artifacts, SAP CI OData APIs make this information easily available, all we need is SAP CI technical user with the right roles.
This convenience often raises a natural question:
Can we do the same for SAP BTP as well?
Can we programmatically access:
SAP BTP account details ?Subaccounts and entitlements ?Services and runtime information ?
The answer is Yes, but unlike SAP CI, the authentication and access model for SAP BTP Core Services is fundamentally different.
Why SAP BTP Is Different from SAP CI?
When accessing SAP CI OData APIs, authentication is straightforward:
Use an SAP CI technical userAssign the required rolesCall the OData endpoint
However, SAP BTP Core Services APIs (Accounts, Entitlements, Directories, etc.) do not work this way.
One cannot:
Use SAP CI technical usersUse basic authenticationDirectly call these APIs without a management service
Introducing SAP Cloud Management Service (CIS)
To access SAP BTP Core Services APIs, SAP mandates the use of: SAP Cloud Management Service – CIS plan
CIS acts as:
An authorized OAuth clientA secure gateway to SAP BTP management APIsThe mechanism through which access tokens are issued for Core Services
Once CIS is configured, SAP Cloud Integration can securely access SAP BTP Core Services APIs.
Create SAP Cloud Management Service Instance
Step 1: BTP Cockpit –> Subaccount –> Service Marketplace –> Search “CIS”
Step 2: Create an instance of CIS using the three dots present on the top right of the tile.
Pick “central-viewer” as the plan and click on create
Step 3: Now create a Service key for this instance.
As soon as service key is created ServiceKey cis.json file is ready for the download.
The JSON looks like this :
Among the endpoints in the above picture, our focus is on the endpoint, which will give us the details related to SAP BTP Account.
“accounts_service_url”: “https://accounts-service.cfapps.eu10.hana.ondemand.com“
Now to access this URL, we need to setup OAuth 2.0 Credentials on SAP CI using the details provided in this JSON file.
Setting up OAuth 2.0 Credentials on SAP CI
Refer the JSON file and configure the security artifact as shown below.
SAP CI Iflow:
We have all the configuration in place, now the most interesting part, lets deploy and test the flow.
HTTP Adapter Configurations:
Address: https://accounts-service.cfapps.eu10.hana.ondemand.com/accounts/v1/globalAccount
Other resources of this API can be found here https://api.sap.com/package/SAPCloudPlatformCoreServices/rest
Credentails Name: As created above
Demo:
Lets deploy and execute the flow now:
Response: The information of the SAP BTP Global Account is seen in the response.
Conclusion:
SAP BTP Core Services APIs follow a different and more secure access model. These APIs are protected using OAuth 2.0 and require the SAP Cloud Management Service (CIS) as the authorized gateway.
Once CIS is configured, consuming SAP BTP Core Services APIs from SAP Cloud Integration becomes seamless, enabling automation, governance, and platform-level insights. Understanding this distinction is essential for designing robust and future-ready integration scenarios on SAP BTP.
Hope this helps!
Cheers,
Punith
Accessing SAP Cloud Integration (SAP CI) information programmatically has become quite common today.Whether it’s iFlows, message processing logs, or deployed artifacts, SAP CI OData APIs make this information easily available, all we need is SAP CI technical user with the right roles.This convenience often raises a natural question:Can we do the same for SAP BTP as well?Can we programmatically access:SAP BTP account details ?Subaccounts and entitlements ?Services and runtime information ?The answer is Yes, but unlike SAP CI, the authentication and access model for SAP BTP Core Services is fundamentally different. Why SAP BTP Is Different from SAP CI?When accessing SAP CI OData APIs, authentication is straightforward:Use an SAP CI technical userAssign the required rolesCall the OData endpointHowever, SAP BTP Core Services APIs (Accounts, Entitlements, Directories, etc.) do not work this way.One cannot:Use SAP CI technical usersUse basic authenticationDirectly call these APIs without a management serviceSAP BTP protects these APIs using OAuth 2.0 and requires a dedicated management service to act as a trusted client.And this is exactly where the SAP Cloud Management Service (CIS) comes into play. Introducing SAP Cloud Management Service (CIS)To access SAP BTP Core Services APIs, SAP mandates the use of: SAP Cloud Management Service – CIS planCIS acts as:An authorized OAuth clientA secure gateway to SAP BTP management APIsThe mechanism through which access tokens are issued for Core ServicesOnce CIS is configured, SAP Cloud Integration can securely access SAP BTP Core Services APIs. Create SAP Cloud Management Service InstanceStep 1: BTP Cockpit –> Subaccount –> Service Marketplace –> Search “CIS”Step 2: Create an instance of CIS using the three dots present on the top right of the tile.Pick “central-viewer” as the plan and click on createYou can check the scope of each plan here : SAP Cloud Management Service – Service Plans | SAP Help PortalOnce this step is done, CIS will be available in the Instances column of the subaccount.Step 3: Now create a Service key for this instance.As soon as service key is created ServiceKey cis.json file is ready for the download.The JSON looks like this :Among the endpoints in the above picture, our focus is on the endpoint, which will give us the details related to SAP BTP Account.”accounts_service_url”: “https://accounts-service.cfapps.eu10.hana.ondemand.com”Now to access this URL, we need to setup OAuth 2.0 Credentials on SAP CI using the details provided in this JSON file. Setting up OAuth 2.0 Credentials on SAP CIRefer the JSON file and configure the security artifact as shown below.Token Service URL : <<uaa_url>>/oauth/tokenClient ID : << clientid >>Client Secret : << clientsecret >>Custom Parameters : grantType : clientCredentials SAP CI Iflow:We have all the configuration in place, now the most interesting part, lets deploy and test the flow.HTTP Adapter Configurations:Base URL: https://accounts-service.cfapps.eu10.hana.ondemand.com (can be found in the JSON file)Resource to fetch information of Global Account: /accounts/v1/globalAccount Address: https://accounts-service.cfapps.eu10.hana.ondemand.com/accounts/v1/globalAccountOther resources of this API can be found here https://api.sap.com/package/SAPCloudPlatformCoreServices/restCredentails Name: As created above Demo:Lets deploy and execute the flow now: Response: The information of the SAP BTP Global Account is seen in the response. Conclusion:SAP BTP Core Services APIs follow a different and more secure access model. These APIs are protected using OAuth 2.0 and require the SAP Cloud Management Service (CIS) as the authorized gateway.Once CIS is configured, consuming SAP BTP Core Services APIs from SAP Cloud Integration becomes seamless, enabling automation, governance, and platform-level insights. Understanding this distinction is essential for designing robust and future-ready integration scenarios on SAP BTP.Hope this helps!Cheers,Punith Read More Technology Blog Posts by Members articles
#SAP
#SAPTechnologyblog
