CPI: Exploring the hiden and hideous /Operations url

Intro

During this year (2018), SAP launched an API to handle some CPI components. This year also saw the development shift from Eclipse to the Webui. However, some operation features have not yet been migrated to the WebUI or to the oData API and remain available exclusively for the eclipse addon. In this post, I will show some undocumented features hosted under the /Operations URL. Some of these features overlap with the officially  provided tools. More than a few have clicked on the url to simply find a blank web page after the authentication. I will explain how to use this endpoint. Before we start, I am obliged to include a disclaimer.

Disclaimer

The following information is based solely on my research and as such, is not based on official information and may (most likely) contain inaccuracies or errors. Using this, some-how undocumented APIs carries risks and therefore should not be used in production environments or for purposes other than educational or research. I don’t know if using this tool breaks any terms or conditions or any type of SAP license. Please, investigate and use it at your own risk. You’ve been warned!

The “Operation” URL

The Operation URL is nothing else than an endpoint of an API that receives commands to interact with core functionalities of CPI. I’ve started investigating the Operations API, as with the standard API, it is not -yet- possible (Aug 18) to extract the endpoints of an iFlow (or I might be looking at the wrong place!)

Both, the eclipse addon and the webUi, use this API extensively for reading information and for executing some tasks. My feeling is that SAP also uses this API to perform support and maintenance tasks, since many of the available commands are not used by the WebUI or the Eclipse addon. Also, it should be noted that some of the available commands are extremely delicate (just by looking at the name you can understand what I’m saying) so it makes a lot of sense that they are not directly exposed using the tools available. In this post I will not discuss those operations that are available through the WebUi (you can easily review them through the developer console of your internet browser). I will not discuss them all either, as there are so many of them… Otherwise, the post would be endless! Finally, and as I’ve already mentioned, be aware that a few of this operations functionality overlap with the standard oData API (they even share the same payloads).

Basics 1: Preparing the requests

The URL is protected against cross site request forgery. Therefore, you will need to request the X-CSRF token by using the header: X-CSRF-Token=fetch

The response will provide you the token, plus the session cookie. Using postman, you just need to save the token and use it in the subsequent requests.

Getting the token:

HEAD /Operations/ HTTP/1.1
Host: ********-tmn.hci.***.hana.ondemand.com
X-CSRF-Token: fetch
Cache-Control: no-cache

Basics 2: Obtaining the tenant information and calling a command

Once you have your authentication and token in place, you will need to obtain some basic information about your CPI account. The operation: com.sap.it.op.srv.commands.dashboard.ParticipantListCommand provides you that information. Among others, it returns the CPI account id, the assigned nodes (tenant manager -tnm- and runtime -iflmap-) and a list of deployed artefacts on each node.

Create your request payload, by wrapping the parameters in an xml:

<root withActiveTenants="false">
  <onlyHeader>false</onlyHeader>
  <withAdminNodes>true</withAdminNodes>
  <withNodes>true</withNodes>
</root>

Execute the query: (body content-type: application/xml)

With the obtained information in this request, you would be able to explore most of the available commands.

Overview of some commands and their parameters

I think that each command name is self-explainatory, so I will only include some remarks in a few of them. Most of these commands require some roles to be assigned to your user. The API will let you know wheter you are missing an authorization or not.

In an ideal world I would be attaching the xsd of the request and response… but this is not an ideal world. I will try to get some time to prepare a postman collection (I have mine, but cleaning personal information is time consuming)

(I’m sorry about the horizontal scroll in the tables, is an issue with the blog platform)

“Safe” operations: