SAP S/4HANA On-Premise Integration Research

Date: 2026-03-31 Status: Research complete Scope: Licensing & access requirements + alternative (non-API) integration channels

Topic 1: Licensing & Access Requirements

1.1 Is API Access Included in the Base License?

Partially. The SAP S/4HANA On-Premise base license includes the technical capability to expose and consume OData/REST/SOAP APIs. The software ships with hundreds of pre-built APIs. However, using those APIs from a third-party system triggers additional licensing obligations under SAP's "Digital Access" model. The distinction is:

• Technical access: included (the APIs exist in the system and can be activated)
• Commercial entitlement: depends on who or what is creating documents in SAP

1.2 Communication Users & Technical User Types

SAP S/4HANA On-Premise uses several user types relevant to API integration:

For API integration, you typically create a System User (type B) or Communication User with:

• Authorization object S_RFCACL for RFC access
• Appropriate business role assignments for the APIs being consumed
• The user is configured in transaction SM59 (RFC destinations) or in communication arrangements

There is no separate "API user license" to purchase. The licensing exposure comes from the documents created, not the user type itself.

1.3 Digital Access / Indirect Access Licensing (CRITICAL)

This is the most important licensing consideration for any third-party integration with SAP.

Background

Historically, SAP licensed based on Named Users. When third-party systems (e-commerce platforms, IoT devices, RPA bots, integration middleware) started creating documents in SAP without a human user logging in, SAP introduced the concept of "Indirect Access" — later rebranded as "Digital Access" in 2018.

How It Works

When an external system (like Orcha) creates, reads, or updates certain document types in SAP via API, each qualifying document counts against a Digital Access license block.

The Nine Document Types

SAP defines nine document categories that count toward Digital Access:

For Orcha's use case (AP invoice processing): Creating financial postings (type 8) and potentially purchase-order-related documents (type 3) would trigger Digital Access document counts.

Pricing Model

• No public price list. SAP quotes per-customer based on volume and strategic importance.
• Licenses are sold as document volume packs (commonly 1,000 documents = 1 block).
• Tiered pricing: larger committed volumes get lower per-document rates.
• DAAP (Digital Access Adoption Program): SAP offers steep discounts (reportedly up to 90% off list price) as an incentive program. As of 2025, DAAP has been extended with no fixed end date.
• Read-only access may or may not trigger Digital Access, depending on interpretation and contract negotiation. SAP's official position has evolved, but creating/updating documents clearly triggers it.

Risk for Orcha

If Orcha posts invoice data, payment information, or financial documents into SAP via API, the customer's Digital Access document count increases. This means:

1. The customer must have Digital Access licenses (or equivalent coverage) in their SAP contract
2. The customer bears the licensing cost, not Orcha, but customers will want clarity on volume impact
3. Audit risk: SAP conducts license audits and can retroactively charge for undeclared Digital Access usage

1.4 Admin Setup Required (SAP Basis Tasks)

The customer's SAP Basis administrator must perform these steps to enable API access:

Step 1: Activate OData/ICF Services

• Transaction /IWFND/MAINT_SERVICE — Register and activate OData services from the backend
• Transaction SICF — Activate the underlying ICF (Internet Communication Framework) nodes
  • OData V2: each service has its own SICF node under /sap/opu/odata/sap/
  • OData V4: single SICF node at /sap/opu/odata4/
• Click "Add Service" > search by External Service Name > "Get Services" > "Activate Service"

Step 2: Create Technical/Communication User

• Transaction SU01 — Create a user of type B (System) or C (Communication)
• Assign appropriate authorization roles (e.g., SAP_BC_WEBSERVICE_ADMIN, plus business-specific roles)
• Assign authorization object S_RFCACL if RFC is used

Step 3: Configure RFC Destination (if using RFC/BAPI)

• Transaction SM59 — Create RFC destination of type 3 (ABAP) or T (TCP/IP for external)
• Configure target host, system number, client, username/password

Step 4: Configure Communication Arrangement (if using On-Premise with BTP/Cloud Connector)

• Set up a Communication System (host, port, authentication)
• Create a Communication Arrangement linking a Communication Scenario to the system
• Select authentication method (Basic Auth or Client Certificate)

Step 5: Network/Firewall

• Open firewall ports (typically HTTPS 443, or SAP gateway port 8000/8443)
• If using SAP Cloud Connector: install and configure the connector agent on-premise

1.5 Tier-Based Feature Gates

SAP S/4HANA On-Premise does not have API feature gating per se (unlike SaaS tiers). All APIs ship with the software. However:

• SAP S/4HANA editions (Foundation vs. full) may limit available business functionality, which indirectly limits useful APIs
• SAP BTP (Business Technology Platform) services like Event Mesh, Integration Suite, or API Management require separate BTP subscriptions
• SAP Gateway is included in S/4HANA (embedded gateway since 1610)

Topic 2: Alternative Integration Channels

2.1 IDocs (Intermediate Documents)

Availability: Fully available on S/4HANA On-Premise (not available on S/4HANA Cloud Public Edition).

Pros:

• Battle-tested, decades of SAP ecosystem support
• Excellent for batch/bulk document exchange
• Built-in error handling and reprocessing
• Many SAP consultants know IDoc configuration well

Cons:

• Complex setup (partner profiles, port config, message types, process codes)
• Proprietary format — requires IDoc parsing/generation
• Asynchronous only — no immediate response
• Still triggers Digital Access licensing when documents are created

2.2 RFC/BAPI (Remote Function Calls / Business Application Programming Interfaces)

Availability: Fully available on S/4HANA On-Premise.

Pros:

• Synchronous — immediate response with document numbers or error messages
• Rich business logic built into BAPIs
• Well-documented via BAPI Explorer (transaction BAPI)
• Direct access to SAP business objects

Cons:

• Requires SAP RFC SDK or SAP JCo/NCo connector library on the client side
• SAP proprietary protocol (not HTTP-based) — harder to integrate from non-SAP systems
• Firewall considerations (non-standard ports)
• Still triggers Digital Access licensing

2.3 SFTP / File-Based Integration

Availability: Supported via SAP standard tools and middleware.

Typical flow for Orcha:

1. Orcha writes CSV/XML to a shared SFTP directory
2. SAP scheduled job picks up files at defined intervals
3. SAP processes files via Batch Input or custom ABAP program
4. SAP writes response/acknowledgment files back to SFTP

Pros:

• Simple, well-understood pattern
• No direct network connectivity to SAP required (SFTP server acts as buffer)
• Works even with heavily locked-down SAP environments
• Lower technical barrier for SAP admin setup

Cons:

• Not real-time (batch processing, typically scheduled intervals)
• No immediate error feedback
• File format must match exactly what SAP expects
• Requires custom ABAP development on the SAP side for non-standard scenarios
• Still triggers Digital Access licensing if documents are created

2.4 SAP Cloud Connector

What it is: A lightweight agent installed on-premise that creates a secure TLS tunnel between the customer's network and SAP BTP (Business Technology Platform) cloud services.

Relevance for Orcha: If Orcha runs as a cloud service and needs to reach a customer's on-premise S/4HANA, the Cloud Connector is the SAP-recommended approach. However:

• The customer must have an SAP BTP subscription
• The customer's IT team must install and maintain the Cloud Connector agent
• This adds a dependency on SAP BTP infrastructure

2.5 SAP Event Mesh / Advanced Event Mesh (Webhooks/Events)

Availability: Requires SAP BTP subscription + Event Mesh service.

Relevance for Orcha:

• Could enable real-time notifications when invoices are posted or payment runs complete
• Requires additional SAP BTP licensing (Event Mesh is a paid BTP service)
• Relatively new for on-premise — many customers may not have this set up yet
• Best suited for outbound event notification rather than inbound document creation

2.6 EBICS / Banking Protocols

Availability: Native in SAP S/4HANA via Multi-Bank Connectivity (MBC) or direct EBICS configuration.

Relevance for Orcha:

• EBICS is relevant only for the payment leg, not for invoice ingestion
• If Orcha needs to trigger payments or import bank statements, this channel exists
• Most customers will already have EBICS configured for their house bank — Orcha would not typically interact with this layer directly

Summary & Recommendations for Orcha

Licensing Impact Assessment

Key takeaway: The integration channel (API, IDoc, RFC, file) does not matter for Digital Access licensing. What matters is whether qualifying documents are created in SAP. Any Orcha integration that posts invoices or financial documents into SAP will require the customer to have Digital Access licenses.

Recommended Integration Approach

1. Primary: OData REST APIs — Modern, HTTP-based, well-documented on SAP API Business Hub. Easiest for Orcha to implement. Customer needs to activate services via /IWFND/MAINT_SERVICE and SICF.

2. Fallback: RFC/BAPI — For customers with locked-down environments or where specific BAPIs (e.g., BAPI_INCOMINGINVOICE_CREATE) provide better functionality than available OData APIs.

3. File-based as last resort — For customers who refuse direct API connectivity. Higher latency, more fragile, but works in the most restrictive environments.

Customer Prerequisites Checklist

Before Orcha can integrate with a customer's SAP S/4HANA On-Premise:

• Customer confirms SAP S/4HANA version (ideally 1909+)
• Customer has Digital Access licenses covering expected document volume
• SAP Basis admin activates required OData services (/IWFND/MAINT_SERVICE, SICF)
• Technical/communication user created with appropriate authorizations (SU01)
• Network connectivity established (direct HTTPS, VPN, or SAP Cloud Connector)
• RFC destination configured if using BAPI approach (SM59)
• Authentication method agreed (Basic Auth, Client Certificate, or OAuth2 via SAP BTP)
• Test/sandbox system available for integration development

Sources

• SAP S/4HANA Licensing Overview (SAP SE)
• SAP S/4HANA Licensing in 2025 (Redress Compliance)
• SAP Indirect Access & Digital Licensing 2026 Guide
• SAP Digital Access Licensing in 2025 (SAP Licensing Experts)
• SAP Digital Access Pricing in 2025
• SAP Digital Access Document Types Explained
• The Nine SAP Digital Access Document Types
• SAP Indirect Access 2026: Rules, Costs & Risk
• How to Enable OData Services in SAP S/4HANA (SAP Help)
• Five Steps to Configure OData Services in S/4HANA On-Premise
• SAP Interfaces Overview: IDoc, RFC, BAPI, REST, SOAP
• SAP S/4HANA Integration Technologies (SEEBURGER)
• Connecting S/4HANA On-Prem to Advanced Event Mesh via Cloud Connector
• SAP Multi-Bank Connectivity
• Corporate-to-Bank Connectivity in SAP
• Communication Arrangement in SAP S/4HANA On-Premise (SAP Help)
• Licensing User Types in SAP S/4HANA
• SAP S/4HANA On-Premise Licensing Explained (SOA People)
• Comprehensive Guide to SAP Digital Access 2026