Using Adapter HTTP – Response 403 for OData API Post Method- How to solve the big challenge

X-CSRF-Token: Fetch

X-CSRF-Token: <token>
Cookie: <cookies>

Method: POST
Content-Type: application/json
Accept: application/json
X-CSRF-Token: <fetched token>
Cookie: <SAP cookies>

{
“Name”: “Sample Item”,
“Quantity”: 10
}

Set Header for Cookie + CSRF token 

 Groovy Script 1(Shown from above Iflow image)

import com.sap.gateway.ip.core.customdev.util.Message;

def Message processData(Message message) {
def headers = message.getHeaders();
def cookie = headers.get(“Set-Cookie”);
def csrf = headers.get(“x-csrf-token”);
StringBuffer bufferedCookie = new StringBuffer();
for (Object item : cookie)
{
bufferedCookie.append(item + “; “);
}
message.setHeader(“Cookie”, bufferedCookie.toString());
message.setHeader(“x-csrf-token”, csrf)

return message
}

POST Method  

6. Conclusion – Turning a Frustrating 403 into a Successful POST

The HTTP 403 Forbidden error for OData POST calls is one of the most common yet misunderstood issues when integrating SAP systems. But once you understand:

CSRF handlingRole/authorization requirementsHeader and policy rulesGateway restrictions

…the problem becomes easy to solve.

Following the troubleshooting guidelines above will help you quickly identify the root cause and ensure your POST requests work reliably—whether you’re integrating via CPI, API Management, BTP, or direct HTTP calls.

​ Connecting SAP S/4 HANA or ERP systems with external applications using OData services is becoming the backbone of modern enterprise integrations. Tools such as SAP Cloud Integration (CPI) or Integration Suite’s using HTTP Adapter make it easy to consume or expose APIs—until you hit a frustrating roadblock:“HTTP 403 – Forbidden” when calling an OData API POST method.This error is notoriously deceptive. Your GET requests work fine. Your endpoint is correct. Your payload is correct. Yet POST still fails.Why?In this blog, we’ll break down why HTTP 403 happens, what makes POST requests special, and—most importantly—how to solve this challenge with proven, real-world fixes.1. Understanding the 403 Forbidden ErrorA 403 Forbidden response means:The server understood your request but refuses to authorize it.In the context of OData POST calls via the HTTP adapter, this almost always indicates an authorization, CSRF, or policy-related issue.2. Why GET Works but POST FailsMany developers test an OData service with a GET call, find that it works, and assume the setup is correct. But POST behaves differently because it:Modifies data, triggering stricter authorization checksRequires CSRF token handling (depending on the endpoint)May require additional headersThis is why GET succeeding does not prove the integration is fully configured.3. The Top Causes of HTTP 403 for OData POST (and How to Fix Them)Cause 1 — Missing or Incorrect CSRF TokenMany SAP OData services require a valid X-CSRF-Token for POST/PUT/PATCH/DELETE.✔ Solution:Perform a GET request with header:X-CSRF-Token: Fetchand capture:Returned CSRF tokenReturned cookiesThen send them along in your POST call:X-CSRF-Token: <token>
Cookie: <cookies>Cause 2 — Incorrect or Missing HeadersSome OData services enforce additional constraints.Mandatory headers may include:Content-Type: application/json
Accept: application/json4. How to Troubleshoot 403 EfficientlyStep 1 — Test POST via PostmanFetch CSRF token firstSend cookies + token in POSTAdd all required headersStep 2 — Check SAP Gateway Error LogsUse transaction /IWFND/ERROR_LOG or /IWBEP/ERROR_LOG.You may see:”No CREATE authorization””CSRF Token validation failed””Request method not allowed”These messages are extremely helpful.5. Example Adapter HTTP Configuration for POST (CPI)Headers Method: POST
Content-Type: application/json
Accept: application/json
X-CSRF-Token: <fetched token>
Cookie: <SAP cookies>Body (Example){
“Name”: “Sample Item”,
“Quantity”: 10
}Set Header for Cookie + CSRF token  Groovy Script 1(Shown from above Iflow image)import com.sap.gateway.ip.core.customdev.util.Message;

def Message processData(Message message) {
def headers = message.getHeaders();
def cookie = headers.get(“Set-Cookie”);
def csrf = headers.get(“x-csrf-token”);
StringBuffer bufferedCookie = new StringBuffer();
for (Object item : cookie)
{
bufferedCookie.append(item + “; “);
}
message.setHeader(“Cookie”, bufferedCookie.toString());
message.setHeader(“x-csrf-token”, csrf)

return message
}POST Method  6. Conclusion – Turning a Frustrating 403 into a Successful POSTThe HTTP 403 Forbidden error for OData POST calls is one of the most common yet misunderstood issues when integrating SAP systems. But once you understand:CSRF handlingRole/authorization requirementsHeader and policy rulesGateway restrictions…the problem becomes easy to solve.Following the troubleshooting guidelines above will help you quickly identify the root cause and ensure your POST requests work reliably—whether you’re integrating via CPI, API Management, BTP, or direct HTTP calls.   Read More Technology Blog Posts by SAP articles 

#SAP

#SAPTechnologyblog