Section A · Systems of record

ERP — SAP (ECC, S/4HANA)

The 800-pound gorilla. Most large enterprises run it. Customizations, legacy interfaces, and political gatekeeping make SAP integration the longest pole of many deployments.

What it is

SAP is the canonical enterprise resource planning system — finance, procurement, supply chain, HR — for most Fortune 500 companies. Two generations matter today:

ECC (ERP Central Component): the prior generation, on-premises, running on traditional SAP NetWeaver. Many customers still run it, sometimes for another decade.
S/4HANA: the current generation. Cloud-capable, in-memory database, modern REST APIs available. SAP's migration target — but migrations take years.

For contract intelligence: SAP is where the customer's supplier master, purchase orders, GL postings, and accounts-payable data live.

Who owns it

SAP center of excellence / SAP team — a dedicated team that operates the SAP environment. Often 20+ people at large enterprises. They gatekeep changes aggressively.
Finance IT — owns the finance modules.
Procurement IT — owns the procurement and supplier-master modules.
Change Advisory Board (CAB) — approves changes; meets weekly or biweekly; production deploys require formal CAB ticket.

The political reality: SAP teams move on their own schedule. Production access requires their explicit approval. Plan accordingly.

How to integrate

BAPI (Business APIs)

Function-call-style APIs inside SAP. Each BAPI handles a specific operation (read supplier, post invoice, get PO). Invoked via RFC (Remote Function Call) using a connector library.

Examples: BAPI_VENDOR_GETLIST, BAPI_PO_GETDETAIL, BAPI_INCOMINGINVOICE_CREATE1.

IDocs (Intermediate Documents)

Document-based async messaging. SAP generates an IDoc on a trigger (PO created, invoice posted); the integration platform consumes it. Common for high-volume async use cases.

OData services

S/4HANA and modern SAP exposes OData (REST-like with $-query syntax). Cleaner than BAPI; less customization overhead. /sap/opu/odata/sap/API_SUPPLIER_SRV/A_Supplier-style endpoints.

Connectors / middleware

Many customers use middleware: SAP CPI (Cloud Platform Integration), Boomi, MuleSoft, webMethods. The connector pre-translates BAPI/IDoc/OData into something easier to consume.

BAPI call via pyrfc (Python NetWeaver RFC SDK)

from pyrfc import Connection

conn = Connection(
    ashost="sap.example.com", sysnr="00", client="100",
    user="ci_integration", passwd=settings.sap_password,
)
result = conn.call("BAPI_VENDOR_GETLIST", MAXROWS=1000)
vendors = result.get("VENDOR_LIST", [])

OData call (S/4HANA)

import httpx

async with httpx.AsyncClient() as client:
    resp = await client.get(
        "https://my-tenant.s4hana.cloud.sap/sap/opu/odata/sap/API_SUPPLIER_SRV/A_Supplier",
        params={"$top": 100, "$filter": "Country eq 'US'"},
        auth=(settings.sap_user, settings.sap_password),
    )
    suppliers = resp.json()["d"]["results"]

Auth patterns

Service account + Basic auth: still common in ECC environments. Plain username/password over TLS.
OAuth2 / SAML: in S/4HANA Cloud, OAuth2 client-credentials flow. Set up a "Communication Arrangement" in SAP.
X.509 certificates: mutual TLS for higher-security integrations.
SAP Identity Authentication Service (IAS): IdP for S/4HANA Cloud; integrates with the customer's Entra ID or Okta.

Service accounts require approval; provisioning takes 2–4 weeks at most enterprises. File the request in deployment week 1.

Gotchas

Custom Z-tables. Every SAP shop has them. Custom fields named ZACME_VENDOR_TIER; tables named ZACME_CONTRACT_LINK. They're not in standard BAPIs. You need the customer's SAP team to tell you they exist.
Custom flexfields. Fields added to standard tables. The customer's data may live in these.
Schema variance. "Supplier master" looks different at every customer. Don't assume standard SAP fields are populated consistently.
Slow approvals. SAP team's queue is multi-week. Their critical-path projects always win.
Heavy customizations. Many SAP shops have so much custom code that "standard" integrations don't work without modification.
Network access. ECC is often on-premises behind a corporate VPN. Integration platforms need a network path — VPN, ExpressRoute, or a customer-side gateway.
Data freshness. Batch-driven by default. "Real-time" usually means hourly.
Multi-system landscape. Many enterprises have multiple SAP systems (one per business unit). Each has its own integration setup.

Escalation routes

When SAP-side blockers slow the deployment:

First: customer's SAP integration lead. Often a director within Finance IT.
Next: customer's Head of Finance IT or VP of Procurement.
For commercial impact: customer's CFO (rare; for serious deployments).
Through SAP themselves: SAP support channels — usually only useful for genuine product bugs, not for slow customer-side teams.

Practical rule: SAP is the long pole. Plan deployment timelines with explicit SAP-readiness gates; don't promise outcomes that depend on SAP integration before the SAP team has formally committed.

✓ Check yourself

Answer from memory before opening each one.

The customer wants every new purchase order from SAP in your platform within minutes of creation. The SAP team offers either a BAPI you call on a schedule or an IDoc they emit. Which do you ask for, and what do you confirm before you promise the latency?

Show answer
Ask for the IDoc. SAP generates it on the trigger, such as a PO being created, so you consume events instead of polling a function call. Then confirm what the trigger and the outbound job really are, because "real-time" in SAP often means a batch that runs hourly. See how to integrate and gotchas.
You read the supplier master through a standard BAPI. The "vendor tier" field the procurement lead keeps mentioning is not in the result. What is the likely cause, and who do you ask for what?

Show answer
The field is probably a custom Z-field or a flexfield added to a standard table, and standard BAPIs do not return it. Ask the customer's SAP team for the list of custom tables and fields, since they are the only ones who know it exists. See gotchas.
Your OData call for US suppliers uses $top=100 and returns exactly 100 rows on every run. The tenant holds about 4,000. What is happening and what do you change?

Show answer
$top caps the page and nothing more. The call never asks for the rest. Page with $skip and a stable $orderby, or follow the next link when the service sends one, until a page comes back short. See how to integrate.
One customer runs S/4HANA Cloud and another runs ECC on premises. What auth and network setup do you plan for each, and what do both have in common?

Show answer
S/4HANA Cloud: OAuth2 client credentials set up through a Communication Arrangement. ECC: usually a service account with Basic auth over TLS, plus a network path such as a VPN or a customer-side gateway. Both need a service account approved by the customer, which takes 2 to 4 weeks, so you file it in week 1. See auth patterns.
The customer already runs middleware such as SAP Cloud Platform Integration or MuleSoft that turns IDocs into something simpler. Do you connect to SAP directly or consume from the middleware?

Show answer
It depends on who has to approve what. The middleware route often avoids a new SAP-side change and gives you a cleaner shape, but you inherit another team's mapping and its release schedule. Direct access reaches custom fields the middleware drops, but it needs the SAP team's formal approval and a CAB ticket. Ask what the middleware already exposes before you choose. See how to integrate.
Your plan promises a pilot on SAP supplier data in week 4. In week 2 the SAP team has not committed to a date. What do you do?

Show answer
Move the SAP-dependent milestone behind an explicit readiness gate and stop promising outcomes that rest on it. Escalate in order: the SAP integration lead, then the Head of Finance IT or the VP of Procurement. Their queue runs on its own schedule, and critical-path projects win it. See escalation routes.

Takeaway

SAP gives you three doors. BAPI is a function call over RFC, an IDoc is an asynchronous document SAP emits on a trigger, and OData is the REST-style route on S/4HANA.
The supplier master you meet is never the standard one. Z-tables, Z-fields and flexfields sit outside the standard BAPIs, and only the customer's SAP team can list them.
"Real-time" from SAP usually means a batch job that runs hourly, so confirm the trigger and the schedule before you quote a latency.
ECC often sits behind a VPN and needs a service account that takes 2 to 4 weeks to approve. Both requests belong in week 1.
If the customer runs middleware, consuming from it can save an SAP approval, at the price of depending on another team's mapping.
SAP is the long pole, so put readiness gates in the plan and promise nothing that depends on SAP until its team commits.

SAP is the heaviest ERP, but it is rarely the only one; the others change the style, not the questions. → The other ERPs