What you get
- Agents that read from and, with approval, write to SAP through its published APIs
- The same governance as any other tool: approvals, audit ledger, vault-held credentials
- No code in the agent. The connection is configuration you can review
How it works in EDDI
- Pick the route. Use OpenAPI import if the SAP service publishes an OpenAPI description. Use HTTP calls to declare individual OData or REST requests. Use MCP if you already run an MCP server in front of SAP.
- Store the SAP credential or token in the Secrets Vault and reference it as
${vault:...}. - Declare only the read operations the agent needs first, such as listing or reading business objects.
- Gate every write with
http.post:*,http.put:*,http.patch:*,http.delete:*and exempt reads withhttp.get:*. Approvers decide in the Manager or in Slack. - Check the audit ledger for each call before you widen what the agent may do.
Configuration
Taken from the EDDI documentation. Placeholders such as your-agent-id are yours to replace.
{
"targetServerUrl": "https://sap.example.com/sap/opu/odata/sap/API_SALES_ORDER_SRV",
"httpCalls": [
{
"name": "list-sales-orders",
"saveResponse": true,
"responseObjectName": "salesOrders",
"request": {
"method": "GET",
"path": "/A_SalesOrder",
"queryParams": { "$top": "10", "$format": "json" },
"headers": { "Authorization": "Bearer ${vault:sap-api-token}" }
}
}
]
}{
"hitlConfig": {
"toolApprovals": {
"requireApproval": [
"http.post:*",
"http.put:*",
"http.patch:*",
"http.delete:*"
],
"exempt": [
"http.get:*"
],
"approvalTimeout": "PT30M",
"timeoutPolicy": "AUTO_REJECT"
}
}
}Governance
- Writes are held for approval, with the decision recorded in the HMAC-signed, append-only audit ledger.
- Credentials stay in the vault and never appear in the agent configuration or in exports.
- The endpoint allow-list means an undeclared SAP operation cannot be called, whatever a user types.
Good to know
- This is an integration pattern, not a certified SAP connector. How you authenticate to SAP, and which APIs it exposes, depends on your landscape.
- EDDI Solutions can build and maintain the connection for you, including custom MCP tools, and run it in your cloud or on-premises.
Need it built and run for you?
EDDI Solutions builds and maintains connectors, runs EDDI as a managed or co-operated instance, and supports you in your own cloud or on-premises.
Talk to EDDI Solutions ↗Related integrations
Configuration and behavior on this page follow the EDDI documentation, checked on 2026-10-14. Field names and defaults can change between releases, so confirm them in the docs for your version.