ERP — SAP (ECC, S/4HANA)

What it is

SAP is the canonical enterprise resource planning system — finance, procurement, supply chain, HR — for most Fortune 500 companies. Two generations matter today:

• ECC (ERP Central Component): the prior generation, on-premises, running on traditional SAP NetWeaver. Many customers still run it, sometimes for another decade.
• S/4HANA: the current generation. Cloud-capable, in-memory database, modern REST APIs available. SAP's migration target — but migrations take years.

For contract intelligence: SAP is where the customer's supplier master, purchase orders, GL postings, and accounts-payable data live.

Who owns it

• SAP center of excellence / SAP team — a dedicated team that operates the SAP environment. Often 20+ people at large enterprises. They gatekeep changes aggressively.
• Finance IT — owns the finance modules.
• Procurement IT — owns the procurement and supplier-master modules.
• Change Advisory Board (CAB) — approves changes; meets weekly or biweekly; production deploys require formal CAB ticket.

The political reality: SAP teams move on their own schedule. Production access requires their explicit approval. Plan accordingly.

How to integrate

BAPI (Business APIs)

Function-call-style APIs inside SAP. Each BAPI handles a specific operation (read supplier, post invoice, get PO). Invoked via RFC (Remote Function Call) using a connector library.

Examples: BAPI_VENDOR_GETLIST, BAPI_PO_GETDETAIL, BAPI_INCOMINGINVOICE_CREATE1.

IDocs (Intermediate Documents)

Document-based async messaging. SAP generates an IDoc on a trigger (PO created, invoice posted); the integration platform consumes it. Common for high-volume async use cases.

OData services

S/4HANA and modern SAP exposes OData (REST-like with $-query syntax). Cleaner than BAPI; less customization overhead. /sap/opu/odata/sap/API_SUPPLIER_SRV/A_Supplier-style endpoints.

Connectors / middleware

Many customers use middleware: SAP CPI (Cloud Platform Integration), Boomi, MuleSoft, webMethods. The connector pre-translates BAPI/IDoc/OData into something easier to consume.

from pyrfc import Connection

conn = Connection(
    ashost="sap.example.com", sysnr="00", client="100",
    user="ci_integration", passwd=settings.sap_password,
)
result = conn.call("BAPI_VENDOR_GETLIST", MAXROWS=1000)
vendors = result.get("VENDOR_LIST", [])

import httpx

async with httpx.AsyncClient() as client:
    resp = await client.get(
        "https://my-tenant.s4hana.cloud.sap/sap/opu/odata/sap/API_SUPPLIER_SRV/A_Supplier",
        params={"$top": 100, "$filter": "Country eq 'US'"},
        auth=(settings.sap_user, settings.sap_password),
    )
    suppliers = resp.json()["d"]["results"]

Auth patterns

• Service account + Basic auth: still common in ECC environments. Plain username/password over TLS.
• OAuth2 / SAML: in S/4HANA Cloud, OAuth2 client-credentials flow. Set up a "Communication Arrangement" in SAP.
• X.509 certificates: mutual TLS for higher-security integrations.
• SAP Identity Authentication Service (IAS): IdP for S/4HANA Cloud; integrates with the customer's Entra ID or Okta.

Service accounts require approval; provisioning takes 2–4 weeks at most enterprises. File the request in deployment week 1.

Gotchas

• Custom Z-tables. Every SAP shop has them. Custom fields named ZACME_VENDOR_TIER; tables named ZACME_CONTRACT_LINK. They're not in standard BAPIs. You need the customer's SAP team to tell you they exist.
• Custom flexfields. Fields added to standard tables. The customer's data may live in these.
• Schema variance. "Supplier master" looks different at every customer. Don't assume standard SAP fields are populated consistently.
• Slow approvals. SAP team's queue is multi-week. Their critical-path projects always win.
• Heavy customizations. Many SAP shops have so much custom code that "standard" integrations don't work without modification.
• Network access. ECC is often on-premises behind a corporate VPN. Integration platforms need a network path — VPN, ExpressRoute, or a customer-side gateway.
• Data freshness. Batch-driven by default. "Real-time" usually means hourly.
• Multi-system landscape. Many enterprises have multiple SAP systems (one per business unit). Each has its own integration setup.

Escalation routes

When SAP-side blockers slow the deployment:

• First: customer's SAP integration lead. Often a director within Finance IT.
• Next: customer's Head of Finance IT or VP of Procurement.
• For commercial impact: customer's CFO (rare; for serious deployments).
• Through SAP themselves: SAP support channels — usually only useful for genuine product bugs, not for slow customer-side teams.

Practical rule: SAP is the long pole. Plan deployment timelines with explicit SAP-readiness gates; don't promise outcomes that depend on SAP integration before the SAP team has formally committed.