Accessing SAP Cloud Integration (SAP CI) information programmatically has become quite common today.
Whether it’s iFlows, message processing logs, or deployed artifacts, SAP CI OData APIs make this information easily available, all we need is a technical user with the right roles.
This convenience often raises a natural question:
Can we do the same for SAP BTP as well?
Can we programmatically access:
- SAP BTP account details ?
- Subaccounts and entitlements ?
- Services and runtime information ?
The answer is Yes, but unlike SAP CI, the authentication and access model for SAP BTP Core Services is fundamentally different.
Why SAP BTP Is Different from SAP CI?
When accessing SAP CI OData APIs, authentication is straightforward:
- Use an SAP CI technical user
- Assign the required roles
- Call the OData endpoint
However, SAP BTP Core Services APIs (Accounts, Entitlements, Directories, etc.) do not work this way.
One cannot:
- Use SAP CI technical users
- Use basic authentication
- Directly call these APIs without a management service
Introducing SAP Cloud Management Service (CIS)
To access SAP BTP Core Services APIs, SAP mandates the use of: SAP Cloud Management Service – CIS plan
CIS acts as:
- An authorized OAuth client
- A secure gateway to SAP BTP management APIs
- The mechanism through which access tokens are issued for Core Services
Once CIS is configured, SAP Cloud Integration can securely access SAP BTP Core Services APIs.
Create SAP Cloud Management Service Instance
Step 1: BTP Cockpit –> Subaccount –> Service Marketplace –> Search “CIS”
Step 2: Create an instance of CIS using the three dots present on the top right of the tile.
Pick “central-viewer” as the plan and click on create
Step 3: Now create a Service key for this instance.
As soon as service key is created ServiceKey cis.json file is ready for the download.
The JSON looks like this :
Among the endpoints in the above picture, our focus is on the endpoint, which will give us the details related to SAP BTP Account.
“accounts_service_url”: “https://accounts-service.cfapps.eu10.hana.ondemand.com“
Now to access this URL, we need to setup OAuth 2.0 Credentials on SAP CI using the details provided in this JSON file.
Setting up OAuth 2.0 Credentials on SAP CI
Refer the JSON file and configure the security artifact as shown below.
SAP CI Iflow:
We have all the configuration in place, now the most interesting part, lets deploy and test the flow.
HTTP Adapter Configurations:
Address: https://accounts-service.cfapps.eu10.hana.ondemand.com/accounts/v1/globalAccount
Other resources of this API can be found here https://api.sap.com/package/SAPCloudPlatformCoreServices/rest
Credentails Name: As created above
Demo:
Lets deploy and execute the flow now:
Response: The information of the SAP BTP Global Account is seen in the response.
Conclusion:
SAP BTP Core Services APIs follow a different and more secure access model. These APIs are protected using OAuth 2.0 and require the SAP Cloud Management Service (CIS) as the authorized gateway.
Once CIS is configured, consuming SAP BTP Core Services APIs from SAP Cloud Integration becomes seamless, enabling automation, governance, and platform-level insights. Understanding this distinction is essential for designing robust and future-ready integration scenarios on SAP BTP.
Hope this helps!
Cheers,
Punith
#abap