SAP Integration — Overview

Velaro connects to three kinds of SAP system so the AI and your agents can answer questions from live SAP data — customer records, orders, invoices, stock, prices and quotes — in chat or IVR.

Your system	How Velaro connects
SAP Business One	Service Layer (username + password)
SAP S/4HANA (on-premise, private cloud or public cloud)	SAP's released OData APIs, with a technical user or OAuth
SAP ECC 6.0	Through a gateway you host (SAP CPI, MuleSoft, Boomi or an SAP Gateway service) that follows Velaro's gateway contract

What each connection can do depends on your product, edition and what is activated in your SAP system. Velaro's Diagnostics tab shows what works on your connection right now.

---

SAP Integration — Connect Business One

Requirements:

• Service Layer enabled and reachable over HTTPS (port 50000) — public IP, open firewall port, VPN or reverse proxy
• A dedicated service account (not a personal login) with the authorizations the AI tools need; write tools need write permission
• Self-signed certificates work: turn on "Allow self-signed certificate" in the wizard

Setup: Integrations → SAP → Connect SAP → SAP Business One. Enter the Service Layer URL, Company Database, username and password, then click Test connection.

Before connecting (on-premise): open https://your-sap-server:50000/b1s/v1/$metadata from a device outside your network. If it loads, Velaro can reach it.

---

SAP Integration — Connect S/4HANA

Choose SAP S/4HANA, then pick your Deployment and Sign-in method.

Deployment	What to know
On-premise / private cloud	Each API service must be activated in the SAP Gateway (/IWFND/MAINT_SERVICE). Enter the SAP client (mandant).
Public cloud	Only released APIs are available, each enabled by a Communication Arrangement for the matching scenario.

Sign-in: a technical user (Basic) or OAuth 2.0 client credentials. Use a dedicated user — a Communication User on the public cloud.

Sales area: enter your Sales organization, Distribution channel and Division. SAP prices per sales area, so customer pricing and quote creation need it.

The APIs Velaro reads include Business Partner, Product, Material Stock, Sales Order, Sales Quotation, Billing Document and Outbound Delivery.

---

SAP Integration — Connect ECC Through a Gateway

ECC has no released REST APIs, so Velaro never assumes OData exists on it. You host a gateway that calls the standard BAPIs and implements Velaro's ECC gateway contract.

1. Build or configure the gateway to the contract (an OpenAPI file your team can import).

2. Choose SAP ECC 6.0 in the wizard; enter the gateway URL, a Key ID and a Signing secret.

3. Click Test connection. The gateway answers with the operations it offers; Velaro only ever calls those.

Every request Velaro sends is signed (key id, timestamp, one-time nonce, request hash), and creates carry an idempotency key so a retry cannot create a second document. Prices are never sent — SAP's pricing decides.

---

SAP Integration — Which Sign-In to Use (Service Account or Service Principal)

Velaro signs in to SAP as a dedicated technical identity, never a person's login. Pick the one that matches your system:

Your system	Identity to create	What to enter in Velaro
Business One	A Service Layer user (a service account with the authorizations the tools need)	Service Layer URL, Company Database, username, password
S/4HANA public cloud	A Communication User plus a Communication Arrangement per API scenario	Deployment = Public cloud; Sign-in = Basic (the Communication User); or OAuth 2.0 if your tenant issues client credentials
S/4HANA on-premise / private cloud, technical user	A service user with the display authorizations (add create authorizations only for the Sales or Service packages)	Deployment; Sign-in = Basic; SAP client; API user and password
S/4HANA with an OAuth / API-management layer (the "service principal" pattern: an app registration with a client id and secret)	A client id and secret that your OAuth server accepts for the SAP APIs	Sign-in = OAuth 2.0 client credentials; Token URL, Client ID, Client Secret
ECC 6.0	A key id and signing secret agreed with your gateway	Gateway URL, Key ID, Signing secret

Secrets are stored encrypted and are never shown again after saving. Velaro supports OAuth 2.0 client credentials; it does not do a SAML bearer exchange, so if your system only offers that, put an API-management layer in front or use a Basic technical user. Click Test connection in the wizard, then open Diagnostics to see exactly what works.

---

SAP Integration — Pricing and Quotes

Prices come from SAP. When a customer is identified, price questions and quotes use SAP's own pricing for that customer (S/4HANA: SAP's sales-order simulation; Business One: the customer's price list; ECC: your gateway). Velaro does not recalculate SAP prices and never accepts a price typed in chat for an SAP-priced item.

Who sees customer prices: only a customer whose identity is verified. Everyone else sees your normal catalog prices, so nothing breaks while verification is pending.

Quotes: a customer-requested quote is saved as a Velaro quote for your team to review. When an agent names the customer, Velaro can create a real SAP quotation and records the SAP number on the Velaro quote. Retrying the same request returns the same quote instead of creating another.

---

SAP Integration — Customer Data Protection

SAP data is limited to the customer asking:

• A verified customer can only see their own orders, invoices, deliveries, quotes and payments — whichever account number or document the AI is asked about.
• Vendors, purchasing, production, internal activity logs and open-ended customer searches are agent-only.
• Customers cannot create sales orders directly through chat.
• Text that comes from SAP (names, comments) is cleaned before the AI sees it.

Identity is verified with a one-time code sent to the contact's email or phone on file. If a contact's email or phone matches more than one SAP customer, Velaro does not guess — an agent is needed.

---

SAP Integration — Diagnostics

Integrations → SAP → Diagnostics runs a read-only check: configuration, sign-in, and a probe of each capability. It shows what SAP's documentation says should work and what a live probe proved. It never creates or changes anything in SAP.

A failure comes with a fix, for example:

• Service not found — activate the service in /IWFND/MAINT_SERVICE or add the Communication Arrangement
• Not authorized — check the technical user's SAP authorizations
• Not advertised by the gateway (ECC) — add that operation to your gateway

Agents can also ask the AI "is SAP connected?" (tool sap_run_diagnostic, agents only).

---

SAP AI Tools — Packages

Every SAP AI skill belongs to exactly one package. Core comes with the SAP integration; Sales, Service, Finance and Supply Chain are add-ons. A skill from a package your account does not have is not offered to the AI and is shown as locked in Integrations → SAP → AI Skills. Write skills (create or update in SAP) also need Pro tier or higher.

Package	Skills	What it covers
Core (14)	sap_search_business_partners, sap_get_business_partner, sap_get_contact_persons, sap_search_items, sap_get_item, sap_get_stock, sap_get_sales_order, sap_search_sales_orders, sap_get_orders_by_partner, sap_get_quotation, sap_get_quotations, sap_get_deliveries, sap_get_delivery, sap_run_diagnostic	Read-only lookups and the connection diagnostic
Sales (5)	sap_create_quotation, sap_create_sales_order, sap_create_activity, sap_get_activities, sap_add_contact_person	Create quotes and orders, log activities, add contacts
Service (5)	sap_get_service_calls, sap_create_service_call, sap_update_service_call, sap_add_service_call_note, sap_get_returns	Service calls and return orders
Finance (5)	sap_get_open_invoices, sap_get_invoice, sap_get_incoming_payments, sap_get_credit_notes, sap_get_ap_invoices	Invoices, payments, credit notes, AP
Supply Chain (5)	sap_search_vendors, sap_get_purchase_orders, sap_get_goods_receipts, sap_get_production_orders, sap_get_production_order	Vendors, purchasing, goods receipts, production

That is 34 SAP skills. Two shared tools also use your SAP when the customer is verified: Get Customer Pricing (via get_pricing_details) and Create Quote (via create_quote). Create Quote creates a real SAP quotation only when the Sales package is active, an agent (or API/background run) names the customer, and the account is on Pro tier or higher; otherwise the quote stays a Velaro quote for your team to review. Customer pricing works with Core.

Some tools are agent-only (vendor, purchasing, production, activity logs, open-ended customer search, adding contact persons, sales-order creation, service-call updates and notes, sap_run_diagnostic). A verified customer only ever sees their own records.

To add a package: ask your Velaro account manager, or (Velaro staff) comp the matching feature on the account: EnableSapSales, EnableSapService, EnableSapFinance or EnableSapSupplyChain.

---

SAP Conversation Sidebar Panel

When an agent opens a conversation, Velaro looks up the visitor by email or phone in SAP and shows a live panel in the right sidebar: the business partner card, plus Service Calls and Orders tabs when records exist. Agents can search manually by name, phone or account number. The panel is read-only.

---

SAP — Screen Pop and Workflow Node

Screen pop: when a customer calls through IVR, Velaro searches SAP by phone number and shows the matching record in the agent's screen pop. It activates automatically once SAP is connected.

Workflow node: add the SAP AI node from the workflow canvas → Action Nodes → SAP AI to let a bot answer SAP questions with your connected system and chosen AI model.

---

SAP — Business Action Workflow Node

Add Business Action (Action Nodes → Business actions) to run Get Customer Pricing or Create Quote from a workflow. It is the same action the AI and your agents use, answered by your SAP when the customer is verified and by your Velaro catalog otherwise.

1. Choose the action; the request starts as a valid example.

2. Use <<variableName>> to insert workflow variables. A value a visitor typed can never change the shape of the request.

3. Pick a name for the result. Later nodes can use <<result.success>>, <<result.error>>, <<result.source>> and each field, such as <<result.quoteNumber>>.

The workflow always continues, so add a condition on result.success to handle a failed lookup. The node runs as the customer in the conversation — it cannot look up another customer's SAP data.

---

SAP — Troubleshooting

Run Diagnostics first (Integrations → SAP → Diagnostics) — it names the failing step and the fix.

401 Unauthorized: check the username/password, client credentials or ECC signing secret in Integrations → SAP → Edit.

404 or "service not found" (S/4HANA): the API is not activated (/IWFND/MAINT_SERVICE) or has no Communication Arrangement.

Connection refused / timeout: the SAP URL must be reachable from Velaro (public IP, VPN or Cloud Connector). Business One uses port 50000 (HTTPS).

Customer sees catalog prices, not SAP prices: the customer is not verified yet, no single SAP customer matches their email or phone, the sales area is missing, or (ECC) the gateway does not offer pricing.

Empty results: confirm the Company Database (Business One) or SAP client (S/4HANA) points at production data.

A quote shows "may have been submitted": SAP did not confirm the creation. Check SAP before retrying — Velaro will not blindly re-send.