Notifications from SAP Build Apps to Work Zone

[kazistov_v]

Hi,

I am trying to send notifications from my SAP Build Apps application to my Work Zone site, but I can't understand how to do it right. I am using SAP Mobile Start app, that is why I want to have in-app notifications on my Work Zone site under the bell icon. I generated credentials for my Work Zone ANS, but can't understand what I need to do next. I was trying to create a destination and send the notification using action from Marketplace called "HTTP destination request". Important thing that I am using SAP Build Apps (no-code) which is under Front End section. 
That is how it looks:

But when I am trying to send, I got such an error:{"status":401,"message":"Unauthorized","timestamp":1755098300,"path":"/v1/alerts","error":"Unauthorized"}
Of course, because there is no any API-key or something else. 

I was trying to use ANS notifications, because that is the only thing that I could enable on my Work Zone settings, but maybe there is something else? 

I would really appreciate any instructions about that or any other workarounds.

Best regards,
Vladyslav

[kazistov_v]

Hi! 

I have got an update on that case.
I found and was following this documentation: https://help.sap.com/docs/build-work-zone-standard-edition/sap-build-work-zone-standard-edition/deve... 
It’s more adaptive for the code solutions, but I understood how to implement it through SAP Build Apps (no-code).

First of all, I turned on and generated credentials for the notifications in Work Zone. The first thing that was strange for me that it generated url for ANS, when in documentation there is cloud notifications url. So I was trying to do it with that url, but didn’t get succeed. So, I used the same url for my destination as in the documentation: https://help.sap.com/docs/build-work-zone-standard-edition/sap-build-work-zone-standard-edition/enab... (https://notifications.cfapps.sap.hana.ondemand.com), but with my credentials (clientId, clientSecret, Endpoint Token). It was much better, because I got 200 status code for POST Call to get access token, then with this token I was trying to do the GET call to get CSRF Token from header and cookies, but I always get 307 error (redirect). I was doing by the instructions from the documentation (Endpoint: /v2/NotificationType.svc). But the strange thing is that in Postman I get 200 and get all the cookies and CSRF Token. 

GET Call details:
url: https://notifications.cfapps.<time-zone>.hana.ondemand.com/v2/NotificationType.svc
Header: x-csrf-token: fetch
                Authorization: Bearer <access_token from the previous call>

If somebody has an experience with that case, I would appreciate any help and instructions.

Best regards, 
Vladyslav

[kazistov_v]

Hello,

NEW UPDATE.
I successfully found the issue. The error was pretty simple, but took a lot of time to find it. 
It was needed to add the forward slash in the end of the endpoint: "https://notifications.cfapps.<time-zone>.hana.ondemand.com/v2/NotificationType.svc/". The strange thing is that it's not mentioned in the documentation that I was following to. Probably, it works only for the SAP Build Apps (no-code builder). 

After that every POST endpoints was configured due to the documentation. I hope this post will help somebody in the future.

Best regards,
Vladyslav

[Vanina]

Thank you very much for sharing all the details and the solution you found. This topic will be quite helpful in case anyone experiences the same behavior. We will look into the documentation and consider improvements and additions if such are needed.

[thomas-bruckner]

@kazistov_v From a security point of view, it would discouraged to do it with the approach that you are attempting. Why? The logic you are implementing in SAP Build Apps is executed on the front-end. This means, with your approach you are effectively allowing each and every authenticated user to trigger notifications to any arbitrary receiver of your tenant.

The credentials for the notification service (e.g. via a BTP destination), should not be exposed as a dynamic destination to front-end clients (like your Build Apps application deployed to the HTML5 Repository & SAP Build Work Zone). Instead, the logic for creating notifications and interacting with the notification API should only be done from a "backend" application you deploy to SAP BTP to stay in control of which notifications are sent to which user. Unfortunately this would rather fall under the "pro-code" category. One fairly easy approach would be to leverage CAP (SAP Cloud Application Programming Model), which has a plugin that simplifies sending notifications: https://cap.cloud.sap/docs/plugins/#notifications