SAP SuccessFactors HCM

This page explains how to connect SAP SuccessFactors to SAP Focused Run. For the setup of the supported monitoring applications, please click on the monitoring application below.

Currently, the following monitoring application is supported for SAP SuccessFactors:

Integration & Exception Monitoring

Prerequisites

Update: Switch to Certificate-based Authentication for Endpoints

SAP SuccessFactors will delete the access to APIs based on HTTP Basic Authentication on November 20, 2026. (SAP Help(opens in new tab))

Hence, SAP Focused Run 5.0 since FP02 supports the usage of certificate-based authentication for monitoring endpoints to SAP SuccessFactors.

Please adjust your existing endpoints accordingly before November 20, 2026.

  • To enable the exception monitoring (via metric pull) for SAP SuccessFactors you need to enable the SFAPI usage:
    • In order to use the SFAPI, SAP SuccessFactors must enable the API for your company instance. This is usually done during the initial implementation. If this was not done, please contact your SAP SuccessFactors support representative to enable the SFAPI for your instance.
  • *New* With SAP Focused Run 3.0 FP03, we now support the monitoring of SAP SuccessFactors messages. To enable the message monitoring (via metric push) for SAP SuccessFactors you need:

Setup Steps in SAP SuccessFactors HCM

Create SFAPI User
  1. Add a new user to SAP SuccessFactors
  2. Assign the required permissions to the user:

To assign the required permissions to the SFAPI user please first create a new permission group and add your SFAPI user to the group:

  1. Go to Admin Center → Manage Permission Groups
  2. Create a new permission group using the "Create New..." button
  3. Enter a group name (e.g. SFAPI_ALM_USERS)
  4. Under "Choose Group Members" → "People Pool" choose "Username" 
    1. Search for your SFAPI user and add it by clicking the check box in front of it
    2. Click Done
  5. Click Done

Then create a new permission role:

  1. Go to Admin Center → Manage Permission Roles
  2. Create a new permission role using the "Create New..." button
  3. Enter a role name (e.g. SFAPI_ALM)
  4. Under "Permission Settings" click the "Permission..." button
    1. Add the following permissions:
    • General User Permission
      • User Login
      • SFAPI User Login
    • Manage Integration Tools
      • Allow Admin to Access OData API through Basic Authentication
      • Access to Integration Center
      • Access to Data Replication Monitor
    • Admin Center Permissions
      • Read Execution Manager Events
      • Read Execution Manager Event Payload or Event Report
      • Monitor Scheduled Jobs
  5. Under "Grant this role to..." click the "Add..." button
    1. Select "Grant role to: Permission Group"
    2. Click the "Select..." button
    3. Search for your SFAPI permission group and check the box in front of it
    4. Click Done
  6. Save your new permission role
Disable Password Expiration for SFAPI User

To avoid that the password for the user expires, please create a login exception for the SFAPI user.

  1. Go to Admin Center → Password & Login Policy Settings 
  2. Click on "Set API Login Exceptions"
    1. Click the "Add" button
    2. Enter the username of the SFAPI user
    3. Set the parameter 'Maximum password age(days)' = -1
    4. Enter the IP address of your SAP Focused Run system. 
      1. You can look for the IP range of your SAP Cloud ALM tenant here.
      2. You can also enter the range 1.1.1.1-255.255.255.255 to cover any possible IP address.

For more information refer to SAP note 2161909(opens in new tab) - How to enable SFAPI in SuccessFactors

Activate Monitoring PUSH

With SAP Focused Run 3.0 FP03 we now also support the monitoring of messages sent for certain scenarios in SAP SuccessFactors (more). The monitoring information is pushed from SAP SuccessFactors via SAP Cloud ALM, which acts as a reverse proxy in this scenario.

This step is only needed if you plan to monitor one of the integration scenarios for which message monitoring is supported. 

  1. Go to "Admin Center"
  2. In the "Tools Search", search for Integration Service Registration Center
  3. In the following screen select "SAP Cloud ALM"
  4. Enter the following values:
    1. System Type: Enter the role of the SAP SuccessFactors system as DEV, TEST or PROD
    2. Description: Enter a description, e.g. "SAP SuccessFactors tenant XXX"
    3. Endpoint: Enter the reverse proxy URL copied from SAP Cloud ALM for your FRun PROXY
    4. OAuth URL: SAP Cloud ALM service key parameter "url" + /oauth/token
    5. Client ID: SAP Cloud ALM service key parameter "clientid"
    6. Client Secret: SAP Cloud ALM service key parameter "clientsecret"
  5. Click "Register"
  6. Click "OK"

Note: To deactivate your instance, click "Deregister".

The registration will create an entry for this SAP SuccessFactors instance in the LMDB application of SAP Focused Run, if it doesn't already exist.

Setup Steps in SAP Focused Run

  • Section 'Global':
    • API Root URL: Enter the Production System API URL for your datacenter. You can find the URL in SAP note 2215682 - Successfactors API URLs for different Data Centers
    • Description: A meaningful description
    • Use Case: Select Exception Monitoring
  • Section 'Authentication':
    • Up to SAP Focused Run 5.0 FP01    
      • Type: BASICAUTH
      • User: <SFAPI user>
      • Password: Password of the user
    • From SAP Focused Run 5.0 FP02
      • Please follow the documentation below to set up certificate-based authentication
  • Section 'Proxy':
    • If necessary add proxy information to connect to the cloud service

Setting Up Certificate-based Authentication

Prerequisites

  • Please make sure that your user has the role SAP_FRN_CSM_MTLS. This role provides sensitive authorizations (STRUST privileges) at the SAP Focused Run level.
  • Before creating the certificate, you need to ensure that SAP Focused Run can connect to SAP Cloud ALM for the certificate signing. Please follow this documentation to set up the SAP Focused Run OTEL Proxy to establish a connection from SAP Focused Run to SAP Cloud ALM (please note this is not the SAP Focused Run Reverse Proxy via SAP Cloud ALM, which establishes a connection from SAP Cloud ALM to SAP Focused Run)

Create  and Download Certificate

  1. Create a new endpoint and enter the root URL, description, and use case
  2. Change the authentication method of the endpoint to 'Client Certificate'
  3. Select your Cloud ALM destination
  4. Save the endpoint! This will trigger the certificate creation.
  5. Open the new endpoint in edit mode and download the certificate using the 'Export' button
  6. Click 'Save to File'  

Map SAP Cloud ALM Certificate in SAP SuccessFactors

  1. Log on to SAP SuccessFactors
  2. Go to Security Center > X.509 Public Certificate Mapping
  3. Click 'Add'
  4. Enter the following values:
    1. Configuration Name: e.g. FRUN Certificate Mapping
    2. Integration Name: Business Technology Platform
    3. Certificate File: Upload the certificate .cer file you downloaded from SAP Focused Run
    4. Login Name: Enter the previously created user for the SFAPI