Up-level your SAP OData APIs with Azure API Management

[Martin-Pankraz]

🦄Featured GitHub repos SAP Cloud SDK on Azure App Service Quickstart

👉🏿Annoucement post on the Microsoft TechCommunity by my Engineering colleagues

🔍Find the Preview note here.

*Beforehand an API definition conversion to OpenAPI had been necessary. See this blog for more info.

Dear community,

As of yesterday, you may directly consume* SAP OData APIs via Azure API Management from any-premise no matter where they live from all Azure regions🎉: SAP Gateway, BTP ABAP environment, S/4HANA Cloud private or public edition in RISE or GROW, SuccessFactors, Ariba, Concur, Commerce Cloud, or SAP Business Technology Platform (BTP) etc.🤩

Azure API Management secures and simplifies the SAP API integration with popular Microsoft services like Power Platform, Azure Functions, Microsoft Entra ID (formerly Azure AD) and Microsoft Sentinel to name a few.

And of course, you get standard API Management features like fully private virtual network integration, multi-location deployment, hybrid and multi-cloud gateways, global presence (more regions that any other cloud provider), throttling, quota handling, request validation before it even hits SAP, and cloud native authentication flows in one central place🤘.

In case you favor SAP API Management on Azure, find your way to SAP Integration Suite on Azure here. See SAP Edge Integration Cell to run your iFlows on any-premise including any Azure region or Edge deployments.

Find your way around the highlighted Azure API Management features, SDKs, quickstart repos, deep-dive blog posts, and more from below.

API Creation, Design & blueprints

Enable modern GraphQL for your OData APIs.

See this ABAP Cloud scenario from my BTP ABAP environment (steampunk) blog series.

Spin up your SAP app extension powered by the SAP Cloud SDK on Azure with API Management with one command

The Azure Developer CLI handles the whole app lifecycle including the API create from schema and attaching policies.

Speed up your Azure API Management Policy design with GitHub Copilot and ChatGPT

Since there are many policies published out there the Large-Language-Model is quite good at creating APIM policies.

Try below prompt either in GitHub Copilot chat or ChatGPT to get started:

Create an azure apim policy handling csrf tokens with sap odata apis

Reason about and debug complex policies on Azure API Management using breakpoints from Visual Studio Code

Don’t forget to turn on tracing on APIM! Otherwise, there is no process attach 😉

Create an Azure API Management service including APIs using Terraform

Check out our SAP Cloud SDK quickstart repos for more details on injecting APIs into existing API Management instances.

Authentication & Security

Activate Defender for APIs in Azure API Management to automatically detect threats in your SAP APIs

Unused days, authentication type, classification of sensitive data in response, and detection of suspicious API traffic patterns, already go a long way in securing your API estate.

Apply our standard policy for SAP Principal Propagation to map Microsoft authenticated users to SAP backend users

Learn more from this blog post.

Take a deep dive on the involved SAP OAuth server from here:

Apply Azure API Management to lift the burden of X.509 client certificate handling for consumers apps integrating with BTP ABAP environment

 

Utilize Azure API Management Authorization Provider to streamline your auth setup and ease policy design

Use Azure API Management Authorizations🎥 with apps like Power Platform or SAP Build Process Automation to integrate with SAP faster.

Stay tuned for further simplifications in this space for SAP workloads specifically.

APIOps

UI-based API creation, modification, and deletion is doable for smaller API estates. However, enterprise scale requires API-as-Code and pipelining approaches with CD/CD.

Use Azure Developer CLI to handle the complete lifecycle of your SAP extension app, including the SAP OData API in Azure API Management

You may choose from Bicep or Terraform. See this repo for more details.

Apply the Azure API Management DevOps kit including GitHub Actions. Automate API deployments with APIOps and Azure DevOps

For the ABAP RAP part of the house have a look at combining the git-based flows via Git-enabled Change and Transport System (gCTS)

Either have Azure Developer CLI (AZD) trigger the gCTS workflow or receive the trigger from gCTS using AZD hooks.

Connectivity

Connect SAP BTP based apps like SAP CAP, Cloud Integration, Build Workzone Standard Edition, or SAP Build Apps with your APIs via SAP Private Link

Reach your private Azure API Management instance securely via the private link traversing the Azure Application Gateway and the its web application firewall. Learn more from this blog post.

Keep your SAP OData APIs fully private by injecting an internal Azure API Management instance into the private Azure virtual network

You may customize this approach to securely expose the private SAP APIs via Azure API Management to the Internet using the external mode.

Use the Self-hosted Gateway of Azure API Management for hybrid deployments

The use cases span from multi-cloud, any-premise (your local data center etc.) to the Edge (think factories, oil-rigs, etc.).

Export APIs from Azure API Management to the Power Platform

Final Words

Only thing left to say: happy integrating everyone 😎

Start your Azure Journey regarding your SAP integration here for free. See the Azure API Management serverless and developer tier for cloud credit effective use. For SAP API Management on Azure see FREE tier and trial plans.

Find the announcement blog post by my Azure APIM colleagues on the Microsoft TechCommunity here.

Discover additional Microsoft integration scenarios from our aggregator article.

 

Reach out to me for a deep dive into SAP integration with APIs 🤝

 

Cheers

Martin