> ## Documentation Index
> Fetch the complete documentation index at: https://docs.duvo.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# SAP S/4HANA
SAP S/4HANA is a core enterprise resource planning (ERP) system that manages finance, procurement, supply chain, and operations data. Connecting SAP S/4HANA to Duvo enables your agents to query and retrieve live enterprise data directly from your SAP environment, eliminating manual data extraction and SAP transactions.
SAP S/4HANA is **read-only** in Duvo. Agents can search and retrieve records but cannot create, update, or delete data in your SAP system.
## Setup
Connecting SAP S/4HANA to Duvo requires three setup steps in your SAP system — creating a technical user, activating the required OData services with OAuth enabled, and registering an OAuth 2.0 client. Once complete, enter the credentials in Duvo to enable the connection.
In your SAP system, run transaction `SU01` and create a technical user.
* Set **User Type** to **System**.
* Save the password — this becomes the `Client Secret` in Duvo.
* Assign authorizations:
* **Sandbox / testing:** `SAP_ALL` (validate connectivity only — never use in production).
* **Production:** `SAP_BC_OAUTH2_API` plus the SAP-delivered specialist role for each API you plan to use — for example, `SAP_BR_BUPA_MASTER_SPECIALIST` (Business Partner), `SAP_BR_PRODMASTER_SPECIALIST` (Product), `SAP_BR_PRICING_SPECIALIST` (Pricing), `SAP_EWM_*` (Warehouse).
Role names vary by S/4HANA release — check PFCG for your system's equivalents.
`SAP_ALL` is a highly privileged profile that grants full access to the SAP system. Use it only to validate connectivity in a sandbox, never in production. For production, assign least-privilege roles: `SAP_BC_OAUTH2_API` plus the SAP-delivered specialist role per activated API.
Run transaction `/IWFND/MAINT_SERVICE`. For each service below, add it with **System Alias** = `LOCAL` and check **Enable OAuth for Service**:
* `API_BUSINESS_PARTNER` — Business partner, customer, and vendor data
* `API_PRODUCT_SRV` — Product and material master data
* `API_SLSPRICINGCONDITIONRECORD_SRV` — Sales pricing conditions
* `API_WAREHOUSE` — Extended Warehouse Management (EWM) data
Run transaction `SOAUTH2` and register a new OAuth 2.0 client.
* **Client Type:** Confidential.
* **Client ID** must match the technical user's username from the first step.
* **Grant Type:** Client Credentials (uncheck all others).
* Assign scopes for every service activated in the previous step.
* After creating the client, edit it and check **Scope parameter may be omitted**.
* Copy the **Token Endpoint URL** — you'll enter this as the `Token URL` in Duvo.
On the [Connections page](https://app.duvo.ai/integrations), open SAP S/4HANA and fill in these fields:
Any name to help you identify this connection later.
Your SAP S/4HANA host URL (for example, `https://your-sap-host.com`). This is the base URL for all OData API calls.
The OAuth 2.0 token endpoint copied in the previous step (for example, `https://your-sap-host.com/sap/bc/sec/oauth2/token`).
Your technical user's username from the first step (for example, `MCP_DUVO`).
Your technical user's password from the first step.
SAP Client Number defaults to `100`. If your system uses a non-standard client number, contact your Duvo representative.
* [SAP Help Portal — Activate and Maintain Services](https://help.sap.com/docs/SAP_S4HANA_CLOUD) — Guide for `/IWFND/MAINT_SERVICE` and OData service activation.
* [SAP Help Portal — OAuth 2.0 configuration](https://help.sap.com/docs/SAP_NETWEAVER_AS_ABAP_752/916a7da9481e4265809f28010a113a6a/cdb122d5c82e4b4da48e7c6f18535dfa.html) — Setting up OAuth clients and scopes in `SOAUTH2`.
A step-by-step version of the setup above, with screenshots from a live SAP system. Use this if you're new to SAP administration or want to verify each screen before moving on.
#### Step 1 — Create the technical user
The technical user represents the Duvo connection in your SAP system. Already have one? Skip this step. If you don't know the password, reset it and note the new value.
1. Run transaction `SU01`.
2. Enter a username (e.g. `MCP_DUVO`) and click **Technical User**.
3. On the **Logon Data** tab, set **User Type** to **System**.
4. Generate or set a password. Save it securely — this is the `client_secret` you'll enter in Duvo.
5. On the **Profiles** (or **Roles**) tab, assign authorizations.
> Role and profile agents depend on your specific SAP system. Always prefer least-privilege roles.
>
> * **Sandbox / testing only:** you can temporarily use `SAP_ALL` to validate connectivity. `SAP_ALL` is a highly privileged profile that grants full access to the SAP system — never use it in production.
> * **Production:** ask your administrator to assign least-privilege roles. At minimum, this should include:
> * `SAP_BC_OAUTH2_API` — OAuth plumbing (always required)
> * The SAP-delivered role per activated API, for example `SAP_BR_BUPA_MASTER_SPECIALIST` (Business Partner), `SAP_BR_PRODMASTER_SPECIALIST` (Product), `SAP_BR_PRICING_SPECIALIST` (Pricing), `SAP_EWM_*` (Warehouse).
>
> Role names vary by S/4HANA release — check PFCG for your system's equivalents.
6. Save (`Ctrl+S`).
#### Step 2 — Activate the OData services
Four services need to be active with OAuth enabled:
* `API_BUSINESS_PARTNER`
* `API_PRODUCT_SRV`
* `API_SLSPRICINGCONDITIONRECORD_SRV`
* `API_WAREHOUSE`
If they are already activated, skip this step. If a service is active but OAuth is not enabled, select it in the list and click the **OAuth** button in the toolbar.
Repeat the steps below for each service.
1. Run transaction `/IWFND/MAINT_SERVICE`.
2. Click **Add Service**.
3. Enter **System Alias** = `LOCAL` and the **Technical Service Name** (for example `API_BUSINESS_PARTNER`). Click **Get Services** (or press Enter).
4. Select the service from the results and click **Add Selected Services**.
5. In the **Add Service** dialog:
* **Package Agent:** click **Local Object** for `$TMP` (sandbox), or enter a transport request (production).
* Check **Enable OAuth for Service**.
* Leave **ICF Node** and **System Alias** at their defaults.
* Click **Continue**.
6. Verify the service appears in the list with OAuth enabled (checkbox column on the right).
#### Step 3 — Register the OAuth 2.0 client
Create an OAuth 2.0 client bound to the technical user from Step 1, with Client Credentials grant and the scopes from Step 2.
1. Run transaction `SOAUTH2`.
2. In **OAuth 2.0 Administration**, click **Create**.
3. **Client ID** (wizard step 1):
* **Client Type:** Confidential
* **OAuth 2.0 Client ID:** must match your technical user's username (for example `MCP_DUVO`)
* **Description:** any description
* Keep **Token Lifetime** at `3600`.
* Click **Next**.
4. **Client Authentication** (wizard step 2): leave defaults. Click **Next**.
5. **Grant Type Settings** (wizard step 3): check **Grant Type Client Credentials Active**, uncheck all others. Click **Next**.
6. **Scope Agent** (wizard step 4): add all the scopes for the OData services activated in Step 2. You can also assign scopes after creating the client.
7. **Summary** (wizard step 5): review and click **Finish**.
8. Select the new client from the list, click **Edit** and check **Scope parameter may be omitted**, then click **Save**.
9. Copy the **Token Endpoint URL** — you'll need it for Duvo.
You now have everything you need to enable S/4HANA in Duvo. Return to the top of this page and fill out the **Connection Fields** with the values you collected.
## Capabilities
* **Business partner management** — Search, filter, and retrieve detailed records for customers, vendors, and organizations, including addresses, bank accounts, tax numbers, and roles.
* **Product and material lookup** — Query the product master for materials, finished goods, services, and raw materials with descriptions, plant-level data, and inventory valuations.
* **Sales pricing analysis** — Look up base prices, discounts, and surcharges for products, filter by customer or sales organization, and review pricing validity periods.
* **Warehouse visibility** — List EWM warehouses and inspect storage types and warehouse details.
* **Flexible OData queries** — Run advanced queries across the Business Partner, Product, Pricing, and Warehouse OData APIs when standard searches are not sufficient.
## Key Benefits
* **Live enterprise data** — Agents read directly from your SAP system, so reports and decisions reflect current data without manual exports.
* **Secure OAuth authentication** — Uses the standard OAuth 2.0 Client Credentials flow with automatic token caching and refresh, keeping credentials safe and minimizing token endpoint calls.
* **Cross-functional coverage** — A single connection spans finance, procurement, supply chain, pricing, and warehouse data across four SAP APIs.
* **No SAP expertise required after setup** — Once your administrator completes the initial setup, agents translate natural-language questions into the correct OData queries, so business users do not need to know SAP transaction codes or API structures.
## Works Well With
Pull SAP business partner lists, pricing tables, or inventory valuations into spreadsheets for analysis and stakeholder reporting.
Pull SAP business partner lists, pricing tables, or inventory valuations into workbooks for analysis and stakeholder reporting.
Retrieve SAP records and include them in automated notification or compliance reporting emails.
Retrieve SAP records and include them in automated notification or compliance reporting emails.
Query SAP data and post operational summaries, procurement alerts, or pricing updates to team channels.
Query SAP data and post operational summaries, procurement alerts, or pricing updates to team channels.