Setup for SAP Ariba

This page explains how to connect SAP Ariba to SAP Cloud ALM to enable monitoring.

Currently the following monitoring application are supported for SAP Ariba:

Setup Video

The following video demonstrates the setup steps to connect SAP Ariba to SAP Cloud ALM. 

Please note: Starting November 15th, 2021 the steps in SAP Ariba slightly differ from the steps shown in the video. Please see the documentation below for details. 

How to Set Up Integration & Exception Monitoring for SAP Ariba

  • Prerequisites for this video:
    • You need a user with access to the SAP Ariba API portal

Setup Steps in SAP Ariba

Create Client Application in SAP Ariba API Portal

To be able to collect messages from SAP Ariba you need to be on-boarded to the SAP Ariba API portal. In this portal a client application will be created which then allows you to collect information on SAP Ariba messages.

Most customers will already have at least one person in their organization that has access to the SAP Ariba API portal. 

If no-one in your company has access, or your company does not yet have an organization in the SAP Ariba API portal, please follow the FAQ How do I create a new organization in API Developer Portal?

Once you have access to the SAP Ariba API portal please proceed as described here:

  1. Log on to the SAP Ariba API portal (you find the correct URL for your data center in the table of section "Important URLs")
  2. In the navigation pane on the left side navigate to 'Manage'
  3. Click the "+" button on top of the application list
  4. Enter an application name and a description
  5. Click the "Submit" button
  6. Click on "Actions" > "Request API Access"
  7. Select the API Integration Event Monitoring Query API for Procurement this API will be used for all SAP Ariba applications.
  8. Check the box in front of the SAP Ariba applications (Procurement, Sourcing and/or Ariba Network) that you want to assign to this client application
    1. Select all realms that you want to assign from the respective drop-down box
    2. You can use the same application for multiple realms, e.g. for mycompany and mycompany-T, and multiple applications
      • The realm is part of the URL you use to access SAP Ariba:
        • SAP Ariba Buyer Example: https://s1.ariba.com/Buyer/Main/ad/loginPage/...&realm=mycompany
        • SAP Ariba Sourcing Example: https://mycompany.sourcing.ariba.com/
      • If you only use SAP Ariba Network you won't have a realm name to provide, instead you must link the API client ID to the AN-ID after the API is assigned (see documentation in section "Link API Client ID to AN-ID (SAP Ariba Network only)")
  9. Click the "Submit" button.
  10. Ariba will approve the API access request for your client application within 24h.
  11. Continue with the steps under "Create OAuth Secret for Client Application" after the API access request is approved.

Create OAuth Secret for Client Application

After the API access for the application is approved go back to the SAP Ariba API Portal and generate an OAuth secret for your application.

  1. Log on to the SAP Ariba API portal with a user that has the Organization Admin role
  2. Click "Manage" in the left-hand menu 
  3. Find your application for Integration Monitoring under "My Applications" and select it
  4. The application should now only have the step "Your admin needs to generate the OAuth Secret for your application" open
  5. Click on "Actions" > "Generate OAuth Secret". Please note that generating a new OAuth secret invalidates any old OAuth secrets!
  6. Click Submit
  7. Download the file in the next step. It contains the Application Key, the OAuth Client Id, and the OAuth Secret.
  8. Find your SAP Ariba API URL and the SAP Ariba OAuth URL in the table in section "Important URLs" and save them for later use.

Attention: Non-US Customers using SAP Ariba Network or SAP Ariba CIG

The following only applies to non-US customers using SAP Ariba Network or SAP Ariba Cloud Integration Gateway.

Unlike SAP Ariba Sourcing and SAP Ariba Procurement, SAP Ariba Network and SAP Ariba CIG are always hosted in US-based data centers. Hence, events in this applications are sent to the Integration Monitoring event database located in the US data center. 

The Integration Monitoring event database can only be accessed by a client application created in the SAP Ariba Developer Portal for its region.

To check in which region your SAP Ariba Sourcing and SAP Ariba Procurement tenants are hosted please perform the following steps:

  1. Log on to SAP Cloud ALM
  2. Open Administration > Landscape Management
  3. Find your SAP Ariba Sourcing or Procurement cloud service
  4. Click on the service name
  5. Go to the tab "Properties"
  6. Find the value for "Data Center Location"

Only if your SAP Ariba Sourcing or your SAP Ariba Procurement tenant are hosted in a non-US data center, you have to create two client applications.

  • One client application has to be created in the US SAP Ariba Developer Portal (https://developer.ariba.com/api/), this client application will be used to collect events from SAP Ariba Network and SAP Ariba CIG 
  • The second client application has to be created in the SAP Ariba Developer Portal for your region (see table in section 'Important URLs'), this client application will be used to collect events for SAP Ariba Sourcing and SAP Ariba Procurement

Please perform the steps described in the sections above for both client applications.

Important URLs

The following table contains the data centers with the respective SAP Ariba API URL and SAP Ariba OAuth URL:

Data CenterSAP Ariba API Portal URLSAP Ariba API URLSAP Ariba OAuth URL
US PRODhttps://developer.ariba.com/api/https://openapi.ariba.com/https://api.ariba.com/
EU PRODhttps://eu.developer.ariba.com/api/https://eu.openapi.ariba.com/https://api-eu.ariba.com/
RU PRODhttps://ru.developer.ariba.com/api/https://ru.openapi.ariba.com/https://api-ru.ariba.com/
CN PRODhttps://developer.ariba.cn/api/https://openapi.ariba.cn/https://api.ariba.cn/
UAE PRODhttps://mn1.developer.ariba.com/api/https://mn1.openapi.ariba.com/https://api.mn1.ariba.com/
KSA PRODhttps://mn2.developer.ariba.com/api/https://mn2.openapi.ariba.com/https://api.mn2.ariba.com/
AU PRODhttps://developer.au.cloud.ariba.com/api/https://openapi.au.cloud.ariba.com/https://api.au.cloud.ariba.com/

Link API Client ID to AN-ID (SAP Ariba Network only)

The following steps only apply to the following customers:

  • Customers who are using an SAP Ariba Network only scenario, like e.g. "Setting Up Automation of Source-to-Pay with Ariba Network (42K)" and do neither use SAP Ariba Sourcing nor SAP Ariba Procurement.
  • Non-US customers for which SAP Ariba Sourcing and SAP Ariba Procurement are located in a non-US data center and that use SAP Ariba Network located in a US data center

Those customers will not have a realm to assign to the client application for SAP Ariba Network. Instead they have to link the API Client ID (Oauth Client Id) to the AN-ID in SAP Ariba Network.

To do this:

  1. Log on to the SAP Ariba Developer portal after the access to the API has been approved for your client application
  2. Copy the value in the field "Oauth Client Id"
  3. Log on to SAP Ariba Network
  4. Click on your user name in the upper right corner and navigate to "Manage Profile"
  5. Click on the option "Open API Client ID Config"
  6. Click the "Add" button
  7. Enter the Oauth Client Id you copied earlier
  8. Save your changes.

After finishing all steps you should have the following information available for the next steps in SAP Cloud ALM:

  • SAP Ariba API URL
  • SAP Ariba OAuth URL
  • OAuth client ID
  • OAuth secret
  • Application key

Create SAP Ariba CIG Service in Landscape Management

Currently SAP Ariba Cloud Integration Gateway cannot be collected automatically from the System Landscape Information Service (SLIS). Hence if you use SAP Ariba CIG you have to create the cloud service manually in the Landscape Management Service.

The other three SAP Ariba products will be discovered automatically from SLIS. You can use one of those services to find the Root URL that you need to use for the SAP Ariba CIG service.

  1. Open the "Landscape Management" application from the launchpad
  2. Click the "Add" button to create a new service
    1. Name: Enter a name for the service
    2. Tenant ID: Enter the AN-ID or the realm
    3. Cloud Service Type: Select "SAP Ariba Cloud Integration Gateway"
    4. Tenant Type: Select the appropriate type from the list
    5. Root URL: Enter SAP Ariba API URL
    6. External ID: Enter the AN-ID (you find the AN-ID next to the realm name in the client application your created for SAP Ariba Sourcing or Procurement in the SAP Ariba API portal)
  3. Save your service

Create HTTP Endpoint

You have to create one end-point for each of the SAP Ariba products in your SAP Cloud ALM. The end-point creation is similar for each of the products.

  1. Open the Landscape Management application from the launchpad
  2. Select your SAP Ariba service
  3. Click on the service name or press the ">" button at the end of the line
  4. On the tab "Endpoints" press the "Add" button to create a new endpoint
  5. Enter a description
  6. Choose the use-case "Integration Monitoring"
  7. Root URL: Replace the automatically filled value with the SAP Ariba API URL 
  8. Choose OAuth authentication enter the OAuth credentials retrieved from the SAP Ariba API Portal:
    • Client ID: OAuth client ID
    • Client Secret: OAuth secret
    • Token Service URL: Extend your SAP Ariba OAuth URL with /v2/oauth/token
    • API Key: Enter the Application key

Connection Error with Cloud ALM 2011

Please note that with SAP Cloud ALM Release 2011 there might be an error if you perform a connection test. This doesn't influence the Interface Monitoring data collection and this error can be ignored.

Error message when clicking "Ping Connection"

  • [401] Connection to <Ariba endpoint> cannot be established. Ensure that the URL and the login credentials, which are maintained for the endpoint, are correct.

When clicking "Check Connection" during the end-point creation you will see the following error message

  • Connection to <Ariba endpoint> cannot be established - [Failed to obtain OAuth access token]. Ensure that the URL and the login credentials, which are maintained for the endpoint, are correct. - return code 401