Skip to Content

SAP API Management – Connecting on-prem made simple

Up until now connecting to your on-premise system from SAP HANA Cloud Platform, API management was a little complicated. Either you were using a “classic” Reverse Proxy / DMZ setup (with all it pros and cons) or you had to do a somewhat complicated workaround (

Over the last few months we have already been testing another option in several customer projects. Since it was quite successful we also decided to release it as part of the product — and that’s what you can see now! When you log on to your API management portal (be it your productive instance or the one on HCP trial) you will see  — in addition to some great UI enhancements — a new checkbox when creating an API Provider. This will now allow you to connect to your on-premise system.

But lets take a step back.

Obviously the first thing that you need to do is install and configure your cloud connector on-prem. This is explained already in several blogs ( ) so I will only show the result in my configuration:

You can see that I have configured a Virtual Host MyOnPremSystem with port 500 which points to my on-prem system (which happens to run on the same machine, so): localhost:50001

With this configuration I can switch to my SAP HANA Cloud Platform Cockpit from where I can see under Connectivity – Cloud Connectors the successful connection to the on-prem system:

That’s all that you need (just remember [copy] the host name displayed here). Let’s go to the SAP API Management Portal and from the “Develop” (Pencil) icon on the left select “API Provider”. Next click on “Create” to create a new provider:

Now you enter the information (as you would have done previously), but make sure to check the box next to On-Premise.

In my case (since I am connecting to a SAP Gateway system), before you click on Save, click on the “Catalog Service Settings” and enter the information to the CatalogService, e.g. /sap/opu/odata/IWFND/CATALOGSERVICE/ServiceCollection. Under the Authentication Tab you might also want to fill in authentication details to connect to the Catalog service.

Now that’s it and you can click on Save.

To test the new connectivity, just create a new API Proxy:

From the drop-down select the API Provider you just created and click on Discover:

You should see a list of all the OData service from your on-premise SAP Gateway system. Just continue as you have before:

After saving the new API Proxy you are ready to test it!

And with these few steps you have now exposed your on-prem OData service via SAP HCP, API management to the internet!

You must be Logged on to comment or reply to a post.
  • Thanks Holger!

    It works very well with an Odata service. However I have struggled to do the same thing with an existing SOAP Enterprise Service. However when I am adding a resource(operation) I can’t save the API without getting an error:

    “Unable to register API” and [Request ID: 0ef2d71f-cf76-4818-a1bb-c543d1235f0e]
    String index out of range: 0

    It seems it’s related to the adding of the resource since I have no problem saving it without a resource but then I get the service unavailable respone when testing of course.

    What could possibly be wrong?


  • Hello Holger,

    Very useful Blog !!

    I was able to create the API provider in API portal and also the catalog link works fine.

    However, when i try to create an API using the API provider, I get the below message

    Request ID: a21f59e2-c0e0-439f-9f75-3ea1a5bb51c8] Unable to fetch data from the catalog due to incorrect credential of selected API Provider. Check the credential and try again.

    I have checked the credentials maintained in the destination created for the API provided in API management. It looks fine.

    Is it that the oDATA service catalogue link points to some default client ? how do we know which client it is pointing to? I'm unable to maintain the property 'sap-client' in the destination of API management. Is this a bug ?

    Appreciate your inputs.






    • Hi Christina,


      what happens if you open the full Catalog URL in a new browser window (so that you have to enter your credentials again?) Is the authentication working then? You should be able to change the default SAP client, by adding


      to the URL.

      Hope this helps,





      • Hello Holger,

        Thank you for the hint on the 'sap-client' addition. The issue is resolved now!!

        I made two changes

        1. In the cloud connector configuration, I deleted and recreated the access control settings of my on-prem system. This time the virual host name was different to the actual host name
        2. In the API provider, I checked the 'Trust All'  checkbox in the service catalogue settings

        Thank you again for the blog and your response :).





  • Tried that with my own systems and it worked pretty well until today.

    Without any changes in the settings I get the following error:



            "faultstring":"Unable to identify proxy for host: and url: \/sxxxtrial\/ZVBAK_SRV\/vbakSet",


    What might be wrong here ?

    Any help is appreciated !

  • /
  • Hi Holger,

    I followed your Steps to add my on-premise Gateway as an API Provider in API Management but the discovering of services ends with an Error while opening catalog URL in a Browser works fine.

    The Catalog also works well in the WebIde when selecting a Service for a Projekt.


    What could be wrong?




      • Hi Abi,

        Yesssss ! I could resolve the issue. A little thing after a long investigation 😉

        The reason is the order of the logon methods SAP runs through to check the credentials. After you

        configure your SAP Cloud Connector with System Certificat in order to allow pricipale propagation, it changes the way SAP trys to connect the user even for basic authentication.

        Basicaly SAP walks sequentially through the list of Methods stored in the "logon data" tab and stop at first faile.


        You can change this sequence or simply set the Checkbox "Use All Logon Procedures" in "logon data" tab of SICF Transaction (See screenshot below).
        The new configuration can be done individually on a path or an entire Tree.

        Kind Regards




      • /
  • Hi Guys,


    Did anyone get the error below while trying to create the API?


    The server encountered a temporary error and could not complete your request. [Request ID: fc097aff-f178-4af5-b612-9208ce5670fa]