Connecting to S/4HANA Cloud Public Edition via OData V4

SAP S/4HANA Cloud Public Edition does not support importing the dab RFC add-on for this connection method. Instead, configure access through the communication applications in the SAP Fiori launchpad. This requires a Communication User, a Communication System representing the Nexus environment, and a Communication Arrangement for the required communication scenario.

After the SAP-side configuration is complete, configure the OData V4 endpoint provided by the target tenant in dab Nexus as an OData Communication connection. Nexus does not provide a service catalog for automatically selecting sources in this Public Cloud scenario.

Prerequisites

Verify the SAP system

Confirm the product, edition, release, and target tenant using Identify SAP System. Do not determine the operating model from the hostname or Fiori launchpad alone.

SAP ECC, S/4HANA On-Premise, Private Cloud, and Public Edition use different connection and administration models. Mark unknown values as unconfirmed and verify them with the SAP administrator.

Verify the Nexus environment

• Check the installed version under Settings → Licence & Support. Confirm that OData Communication is available.
• Ensure that it can reach the SAP API host over HTTPS on TCP port 443 and validate its TLS certificate.

Enable the service catalog

Communication scenario SAP_COM_0181 is required because it enables access to the SAP service catalog used by Nexus.

Create and maintain a Communication Arrangement for:

SAP_COM_0181

Assign the Communication System and Communication User intended for the Nexus integration.

important

SAP_COM_0181 is a hard requirement for the Nexus OData V4 connection because it enables the service catalog. It does not replace the communication scenario required by the actual data source. For example, a CDI_CDS source additionally requires SAP_COM_0531 and a corresponding Communication Arrangement.

Process overview

1. Select the source and communication scenario.
2. For CDI_CDS, configure the CDS allowlist and authorization group.
3. Create the Communication User and Communication System.
4. Create the Communication Arrangement.
5. Determine the entity-set path.
6. Create, test, and register the Nexus connection.
7. Create a package for the added source in Package Studio and run a test extraction.

1. Select the source and communication scenario

Obtain a known reference record with its complete key and expected field values. Use it to validate the connection and extraction.

Source	Verification	Communication scenario
CDI_CDS	Find the source in View Browser. Verify its fields, keys, extraction support, and delta capability for the target release.	SAP_COM_0531
Business API	Find a released OData V4 API for Public Edition in SAP Business Accelerator Hub. Verify the required entities, fields, and API version.	Scenario ID specified in the API documentation

danger

A service used by a Fiori application is not automatically released for external integration.

For Business APIs:

• The CDI allowlist does not apply.
• SAP_COM_0531 is not automatically the correct scenario.
• SAP_COM_0532 does not replace the CDI OData access described here.
• The source-specific Communication Arrangement is required in addition to the service-catalog arrangement for SAP_COM_0181.

Custom Key User CDS views

Confirm that the view is published for Data Extraction. SAP KBA 2884410 documents full extraction without delta for this source type. This restriction does not automatically apply to SAP standard extractors.

2. Configure the CDS allowlist and authorization group

Perform this section only for CDI_CDS. For a Business API, continue with 3. Create the Communication User.

If you cannot access the configuration activity, the responsible SAP Cloud configuration owner must complete this setup.

2.1 Open the configuration activity

Find Define Allowlists for CDS View Extraction by using one of the following paths.

Manage Your Solution

1. Open Manage Your Solution → Configure Your Solution.
2. Apply these filters:
   • Application Area: Application Platform and Infrastructure
   • Sub Application Area: Data Extraction
3. Open the matching result.
4. Select Configure for the configuration step.

SAP Central Business Configuration

Search for the activity name under:

Configuration Activities
  → General Settings
  → Further Settings

Depending on the interface, the activity may appear directly under Configuration.

2.2 Create the authorization group and allowlist

1. Select New Entries.
2. Enter a unique Authorization Group ID.
3. Enter a meaningful description.
4. Select Explicit allow list as the type.
5. Add the required CDS sources to the group's allowlist.
6. Save the configuration.
7. Select the required Customizing transport.
8. Record the Authorization Group ID for the source-specific Communication Arrangement.
9. If the target tenant is separate, verify that the group and its entries are also available there.

2.3 Missing allowlist activity

If the activity is missing, ask the configuration owner to check whether scope item Data Protection and Privacy (5LE) is active. SAP KBA 3781796 describes missing activation of this scope item as a cause. After activation, search for the activity again.

3. Create the Communication User

1. Open Maintain Communication Users.
2. Create a dedicated communication user for Nexus, or open the existing user intended for this integration.
3. Configure the authentication method required by the service.

Username and password

• Set the password for the Communication User.
• Transfer it only through the approved secret-management process.
• Store it later in the Nexus connection.

Client certificate

• Assign the public client certificate to the Communication User.
• Nexus will also require the associated private key.
• Provide Nexus with a .p12 file containing the client certificate and private key.
• Store and transfer the file password separately from the certificate file.

4. Save the user.
5. Record its identity for the Communication System.

note

The Communication User is not the personal account used to sign in to the Fiori launchpad. Your Fiori user configures the integration, while Nexus calls the service with the Communication User or its certificate. A successful Fiori login therefore does not validate Nexus authentication.

4. Create the Communication System for Nexus

1. Open Communication Systems.
2. Create a system for the relevant Nexus environment.
3. Assign a unique system ID and meaningful name, for example: DAB_NEXUS_PROD
4. In Host Name, enter the hostname of the relevant Nexus installation or Managed App.
5. Enter only the hostname, without a scheme or URL path.
6. Under Users for Inbound Communication, add the Communication User created in 3. Create the Communication User.
7. Select its authentication method.
8. Save the Communication System and verify the user assignment.

In this context, inbound means that Nexus sends a request to SAP.

danger

The Communication System represents Nexus as the communication partner. Its Host Name is not the SAP API hostname used as the Nexus Base URL. Obtain the SAP API URL from the Inbound Services of the Communication Arrangement.

Use separate Communication Systems if DEV, QA, and PROD use different Nexus runtimes or technical identities.

5. Create the Communication Arrangements

At least two Communication Arrangements can be required. Create the following Communication Arrangements:

1. A service-catalog arrangement for SAP_COM_0181.
2. A source-specific arrangement for SAP_COM_0531 or the communication scenario documented for the selected Business API.

5.1 Create the service-catalog arrangement

1. Open Communication Arrangements.
2. Select New.
3. Select communication scenario:

   SAP_COM_0181

4. Enter a meaningful name for the arrangement.
5. Select the Nexus Communication System created in 4. Create the Communication System for Nexus.
6. Under Inbound Communication, verify:
   • the assigned Communication User,
   • the configured authentication method.
7. Save the arrangement.
8. Open Inbound Services and verify the offered service-catalog access.

important

The SAP_COM_0181 arrangement enables the service catalog. It does not authorize access to the entities of the selected data source.

5.2 Create the source-specific arrangement

1. Open Communication Arrangements.
2. Select New.
3. Select the scenario identified in 1. Select the source and communication scenario:
   • for CDI: SAP_COM_0531,
   • for a Business API: its documented Communication Scenario ID.
4. Enter a name for the arrangement.
5. Select the Nexus Communication System created in 4. Create the Communication System for Nexus.
6. Under Inbound Communication, verify:
   • the assigned Communication User,
   • the configured authentication method.
7. For CDI, enter the Authorization Group ID created in 2.2 Create the authorization group and allowlist under Additional Properties → Authorization Group ID.
8. Save the arrangement.
9. Open Inbound Services.
10. Copy the URLs displayed for the target tenant.

Common configuration errors

Authorization Group must be maintained

Verify that:

• the Authorization Group ID was entered exactly,
• the group exists in the target tenant,
• the required CDS sources are included in its allowlist.

SAP KBA 3118974 describes this error.

Service catalog is unavailable

Verify that:

• a Communication Arrangement exists for SAP_COM_0181,
• the correct Communication System is assigned,
• the required Communication User is assigned,
• the configured authentication method matches the Nexus connection.

Do not treat the source-specific arrangement as a replacement for SAP_COM_0181.

Required service is not offered

Compare:

• the selected communication scenario,
• the API version,
• the SAP Cloud release,
• the release-specific SAP documentation.

Do not substitute an unrelated scenario merely because it contains a similarly named service.

6. Determine the specific entity-set path

6.1 CDI_CDS

Query the provider directory

Use the Communication User to call the CDI provider directory through the CDI endpoint from the arrangement. SAP documents this pattern:

https://<SAP-API-Host>/sap/opu/odata4/sap/cdi/default/sap/cdi/0001/Providers

1. Search for the technical CDS entity name identified in 1. Select the source and communication scenario.
2. Do not use the SQL view name or only a business description.
3. Follow every returned @odata.nextLink page.
4. Copy the provider URL offered by the target tenant.
5. Do not construct a CDI_CDS path from the view name alone.

Check the service and metadata

Call:

• the service document at the service root, including the trailing /,
• the metadata document at service root + /$metadata.

Verify:

• the Facts entity set,
• the required fields,
• the complete key,
• field types, currencies, and units.

A provider offered by the target tenant can, for example, return these paths:

Service root: /sap/opu/odata4/sap/cdi_cds/cdi_cds/sap/c_billingdocitembasicdex_1/0001/
Metadata:     /sap/opu/odata4/sap/cdi_cds/cdi_cds/sap/c_billingdocitembasicdex_1/0001/$metadata
Entity set:   /sap/opu/odata4/sap/cdi_cds/cdi_cds/sap/c_billingdocitembasicdex_1/0001/Facts

Replace this example with the provider URL returned by the target tenant. Providers is used for source discovery. The provider URL returned by the target tenant must be added in the Nexus settings during setup.

6.2 Business API

1. Copy the service root from Inbound Services in the relevant Communication Arrangement.
2. Call the service document.
3. Call /$metadata.
4. Identify the required entity set, fields, and complete key.
5. Use the published entity-set name with the documented capitalization.

note

Facts is not a generic suffix for Business APIs. Use the entity-set name declared in the metadata of the specific API.