Integrations → SAP → Diagnostics runs a read-only check: configuration, sign-in, and a probe of each capability. It shows what SAP's documentation says should work and what a live probe proved. It never creates or changes anything in SAP.

A failure comes with a fix, for example:

• Service not found — activate the service in /IWFND/MAINT_SERVICE or add the Communication Arrangement
• Not authorized — check the technical user's SAP authorizations
• Not advertised by the gateway (ECC) — add that operation to your gateway

Agents can also ask the AI "is SAP connected?" (tool sap_run_diagnostic, agents only).

Troubleshooting

Run Diagnostics first (Integrations → SAP → Diagnostics) — it names the failing step and the fix.

401 Unauthorized: check the username/password, client credentials or ECC signing secret in Integrations → SAP → Edit.

404 or "service not found" (S/4HANA): the API is not activated (/IWFND/MAINT_SERVICE) or has no Communication Arrangement.

Connection refused / timeout: the SAP URL must be reachable from Velaro (public IP, VPN or Cloud Connector). Business One uses port 50000 (HTTPS).

Customer sees catalog prices, not SAP prices: the customer is not verified yet, no single SAP customer matches their email or phone, the sales area is missing, or (ECC) the gateway does not offer pricing.

Empty results: confirm the Company Database (Business One) or SAP client (S/4HANA) points at production data.

A quote shows "may have been submitted": SAP did not confirm the creation. Check SAP before retrying — Velaro will not blindly re-send.