# SAP connections in enmasse

SAP connections as YAML - the sap key, its fields, secrets through environment variables and exports.

Everything the Dashboard's SAP form configures can also be expressed as YAML and imported with [enmasse](https://zato.io/docs/admin/enmasse.html) - the same file moves connections between environments, keeps them in version control and feeds CI/CD pipelines.

## The sap key {#the-sap-key}

SAP connections live under the `sap` key (alias: `outgoing_sap`):

```yaml
sap:
  - name: SAP.Sample
    address: https://example.com/sap/opu/odata/sap/API_BUSINESS_PARTNER
    username: zato.technical.user
    secret: Zato_Enmasse_Env.SAP_Sample_Password

  - name: SAP.SuccessFactors
    address: https://apisalesdemo2.successfactors.eu/odata/v2
    auth_type: oauth2
    token_url: https://apisalesdemo2.successfactors.eu/oauth/token
    client_id: my-client-id
    client_secret: Zato_Enmasse_Env.SAP_SF_Client_Secret
    needs_csrf_token: false
```

## Fields {#fields}

| Name | Required | Description |
| --- | --- | --- |
| name | Yes | Unique name of the connection |
| address | Yes | Service root URL, e.g. `https://example.com/sap/opu/odata/sap/API_BUSINESS_PARTNER` |
| odata\_version | --- | OData version, `2.0` or `4.0` (default is `2.0`) |
| auth\_type | --- | Authentication type, one of `no-auth`, `basic`, `bearer` or `oauth2` (default is `basic`) |
| username | --- | Username, for [Basic Auth](https://zato.io/docs/security/basic-auth.html) |
| secret | --- | Password or [bearer token](https://zato.io/docs/security/bearer-tokens/index.html) - can be set via an environment variable |
| token\_url | --- | OAuth2 token URL |
| tenant\_id | --- | OAuth2 tenant ID - when given, it is substituted into the token URL |
| client\_id | --- | OAuth2 client ID |
| client\_secret | --- | OAuth2 client secret - can be set via an environment variable |
| scopes | --- | OAuth2 scopes |
| needs\_csrf\_token | --- | Whether to exchange X-CSRF-Token headers for write operations (default is `true`) |
| page\_size | --- | Server-driven page size requested via `Prefer: odata.maxpagesize` (default is `0`, meaning the server applies its own page size) |
| timeout | --- | Connection timeout in seconds (default is `60`) |
| pool\_size | --- | Connection pool size (default is `1`) |
| is\_active | --- | Whether the connection is active (default is `true`) |

The defaults match the Dashboard's SAP form - OData 2.0 and CSRF tokens enabled - so a minimal entry needs only a name, an address and credentials.

## Secrets through the environment {#secrets-through-the-environment}

Values prefixed with `Zato_Enmasse_Env.` are read from environment variables at import time - the YAML file itself never contains passwords or client secrets. Set the variables for the container, e.g. `SAP_Sample_Password`, and import the file in the Dashboard under `System → Config → Import enmasse`, or mount it under `/opt/hot-deploy/enmasse/enmasse.yaml` to have it imported on start.

## Exporting connections {#exporting-connections}

Connections created in the Dashboard export back to the same format, ready to be imported elsewhere - the `sap` key appears in the output whenever SAP connections exist. Export from the Dashboard under `System → Config → Export enmasse`.

## Learn more {#learn-more}

- [SAP integrations](https://zato.io/docs/dev/sap/) - Business entities as Python dicts, over OData V2 and V4
- [Querying SAP](https://zato.io/docs/dev/sap/query/) - Filters, paging, counting and related entities
- [S/4HANA and ECC](https://zato.io/docs/dev/sap/s4hana/) - Gateway services, their entity sets and what they expect
- [SuccessFactors](https://zato.io/docs/dev/sap/success-factors/) - The OData V2 API, its authentication and its quirks
- [SAP security](https://zato.io/docs/dev/sap/security/) - Basic Auth, API keys, bearer tokens and OAuth2 client credentials