Connect SAP To Velaro
4 min read
Overview
Velaro connects to three kinds of SAP system so the AI and your agents can answer questions from live SAP data — customer records, orders, invoices, stock, prices and quotes — in chat or IVR.
| Your system | How Velaro connects |
|---|---|
| SAP Business One | Service Layer (username + password) |
| SAP S/4HANA (on-premise, private cloud or public cloud) | SAP's released OData APIs, with a technical user or OAuth |
| SAP ECC 6.0 | Through a gateway you host (SAP CPI, MuleSoft, Boomi or an SAP Gateway service) that follows Velaro's gateway contract |
What each connection can do depends on your product, edition and what is activated in your SAP system. Velaro's Diagnostics tab shows what works on your connection right now.
Connect Business One
Requirements:
- Service Layer enabled and reachable over HTTPS (port 50000) — public IP, open firewall port, VPN or reverse proxy
- A dedicated service account (not a personal login) with the authorizations the AI tools need; write tools need write permission
- Self-signed certificates work: turn on "Allow self-signed certificate" in the wizard
Setup: Integrations → SAP → Connect SAP → SAP Business One. Enter the Service Layer URL, Company Database, username and password, then click Test connection.
Before connecting (on-premise): open https://your-sap-server:50000/b1s/v1/$metadata from a device outside your network. If it loads, Velaro can reach it.
Connect S/4HANA
Choose SAP S/4HANA, then pick your Deployment and Sign-in method.
| Deployment | What to know |
|---|---|
| On-premise / private cloud | Each API service must be activated in the SAP Gateway (/IWFND/MAINT_SERVICE). Enter the SAP client (mandant). |
| Public cloud | Only released APIs are available, each enabled by a Communication Arrangement for the matching scenario. |
Sign-in: a technical user (Basic) or OAuth 2.0 client credentials. Use a dedicated user — a Communication User on the public cloud.
Sales area: enter your Sales organization, Distribution channel and Division. SAP prices per sales area, so customer pricing and quote creation need it.
The APIs Velaro reads include Business Partner, Product, Material Stock, Sales Order, Sales Quotation, Billing Document and Outbound Delivery.
Connect ECC Through a Gateway
ECC has no released REST APIs, so Velaro never assumes OData exists on it. You host a gateway that calls the standard BAPIs and implements Velaro's ECC gateway contract.
- Build or configure the gateway to the contract (an OpenAPI file your team can import).
- Choose SAP ECC 6.0 in the wizard; enter the gateway URL, a Key ID and a Signing secret.
- Click Test connection. The gateway answers with the operations it offers; Velaro only ever calls those.
Every request Velaro sends is signed (key id, timestamp, one-time nonce, request hash), and creates carry an idempotency key so a retry cannot create a second document. Prices are never sent — SAP's pricing decides.
Which Sign-In to Use (Service Account or Service Principal)
Velaro signs in to SAP as a dedicated technical identity, never a person's login. Pick the one that matches your system:
| Your system | Identity to create | What to enter in Velaro |
|---|---|---|
| Business One | A Service Layer user (a service account with the authorizations the tools need) | Service Layer URL, Company Database, username, password |
| S/4HANA public cloud | A Communication User plus a Communication Arrangement per API scenario | Deployment = Public cloud; Sign-in = Basic (the Communication User); or OAuth 2.0 if your tenant issues client credentials |
| S/4HANA on-premise / private cloud, technical user | A service user with the display authorizations (add create authorizations only for the Sales or Service packages) | Deployment; Sign-in = Basic; SAP client; API user and password |
| S/4HANA with an OAuth / API-management layer (the "service principal" pattern: an app registration with a client id and secret) | A client id and secret that your OAuth server accepts for the SAP APIs | Sign-in = OAuth 2.0 client credentials; Token URL, Client ID, Client Secret |
| ECC 6.0 | A key id and signing secret agreed with your gateway | Gateway URL, Key ID, Signing secret |
Secrets are stored encrypted and are never shown again after saving. Velaro supports OAuth 2.0 client credentials; it does not do a SAML bearer exchange, so if your system only offers that, put an API-management layer in front or use a Basic technical user. Click Test connection in the wizard, then open Diagnostics to see exactly what works.
Email
Was this article helpful?
SAP Packages And AI Skills