Sales Order Created via Client Certificate Authentication Classified as Digital Access

[hemanth_shetty]

Customer is using SAP Business Process Automation (BPA) to create a Sales Order in SAP S/4HANA Cloud (Public Edition) by calling OData API.

The API call is made using a client certificate authentication destination in SAP BTP, where the keystore is created from the service key of the SAP Build Process Automation subscription.

Given this setup, the created Sales Order is classified as a Digital Access document.

• Is it expected that Sales Orders created via client certificate authentication are counted under Digital Access?
• Would using a Named User with Basic Authentication or Oauth2 User token exchange authentication instead of a service key avoid the Digital Access classification?

Thanks.

[DequanXu]

Hello,

When it comes to SAP S/4HANA Cloud, any document creation that occurs through automation and integration processes often falls under the Digital Access model. Digital Access accounting is based on the way documents are created in the system, rather than the authentication method used. Therefore, whether you use client certificate authentication, basic authentication, or OAuth2, the classification as Digital Access remains primarily dependent on how the document is generated.

**Is it expected that Sales Orders created via client certificate authentication are counted under Digital Access?**
Yes, it is expected that when Sales Orders are created via automated processes such as through SAP Business Process Automation using OData API, they are classified under the Digital Access model. This classification is not determined by the type of authentication but rather by the automated nature of the document creation.

**Would using a Named User with Basic Authentication or Oauth2 User token exchange authentication instead of a service key avoid the Digital Access classification?**
Switching the authentication method from a service key to a Named User with Basic Authentication or OAuth2 User token exchange will not avoid the classification under Digital Access. The key determining factor for Digital Access is the automation driving the document creation, not the type of authentication used.

Best regards,

Dequan Xu

[hemanth_shetty]

Hi Dequan, I found that using the sap-passport header in the request can help prevent the document from being classified as digital access. Do you have any insights on this?