SAP Datasphere exposes business-ready data through a set of Consumption APIs that make it easy for BI tools and applications to query governed data without copying it. The Consumption APIs endpoints generated from Analytical Datasets and Analytic Models offer a metadata-rich, RESTful interface that applications can call for filtered, paged results, which have been available since early 2021.
To allow all this richness of data and the benefits of federation capabilities, the SAP Dataspshere Consumption APIs always relied on business users for authentication and authorizations, which is based OAuth 2.0 with Authorization Code grant type. Such scenario ensured the same behaviour the user sees in the SAP Datasphere or SAP Analytics applications would be the one be the same when integrating via APIs, including Data Access Controls and Model Privileges.
However such authorization method is not the most adequate to be used when integration in backend application, in a service-to-service manner. As in most cases the backend application does not have an current user session or ability to access a browser context as required by Authorization Code grant type 3-lagged approach.
With that we heard our users requests and pleased to release the "Technical User" support for the SAP Datasphere Consumption APIs which is based on OAuth 2.0 with Client Credentials grant type (2-legged). This allows the access token generation to happen without any manual user interaction.
This blog post cover details on how to create the "Technical User" OAuth Client in SAP Datasphere, how to setup the client credentiral authorization in Postman and the support for it on Power BI Custom Connector.
Technical User OAuth Client
The Technical User OAuth client work just like the other OAuth clients existing in SAP Datasphere. To define the authorizations for the technical user at least one scoped role needs to be assigned to it, this will determine which spaces the technical user will have access and the privileges it will have in them. Also, to identify the requests made and to apply data access restrictions a "Username" must be provided, this technical user name needs to be unique across the entire SAP Datasphere tenant.
For creating a Technical User OAuth client, go to System > Administration > App Integration and provide the following information
- Purpose: Technical User
- User ID: <unique username>
- Roles: <Select at least one scoped role>
After creating it generates a "Client ID" and a "Client Secret", just like the other OAuth client types.
Integrating with Consumption APIs in Postman
Integrating with SAP Datasphere Consumption APIs using a Technical User OAuth client is straightforward because it uses the Client Credentials grant type. Using the client_id and client_secret created in the previous section, along with the SAP Datasphere token URL available on the App Integration page, you can use any HTTP client (e.g., Postman) to generate an access token and call the Consumption APIs.
Access Token Generation
Postman Automated OAuth Setup
Postman’s automated authorization handles all the necessary OAuth 2.0 calls to retrieve and apply the token. To set this up, create a new request and open the Authorization tab. For Type, select OAuth 2.0 and fill in the following information:
- Header Prefix: Bearer
- Grant type: Client Credentials
- Access Token URL: <SAP Datasphere Token URL available the App Integration page>
- Client ID: <client_id - created on previous step>
- Client Secret: <client_secret - created on previous step>
After you complete the fields, click Get New Access Token. Postman will generate an access token for SAP Datasphere.
Postman Manual OAuth Setup
Postman’s approach in the previous section automates the OAuth protocol, which is helpful for testing and speeding up debugging, but less practical for real integrations. This section explains how to craft the OAuth token request required by the Client Credentials flow for use with a SAP Datasphere Technical User.
Create a request in Postman and configure:
- Method: POST
- Request URL: <token_url> (the SAP Datasphere token URL available on the App Integration page)
Headers:
- Authorization: Basic <base64 encoded client_id:client_secret>
- Content-Type: application/x-www-form-urlencoded
Body (x-www-form-urlencoded):
- grant_type: client_credentials
Send the request to retrieve the access token, which you will use later.
Changes on SAP Datasphere Consumption APIs
The SAP Datasphere Consumption APIs let you retrieve data via OData version 4. Starting with release 2025.19, the standard API path has been updated to align with proper service naming following the 2023 transition from SAP Data Warehouse Cloud to SAP Datasphere and its continued role within the SAP Business Data Cloud strategy.
- New path: /api/v1/datasphere/consumption/*
The catalog service for consumption artifacts, which lists and queries all accessible spaces and entities, has moved to /api/v1/datasphere/consumption/catalog/* to better reflect its purpose. All other semantics for accessing spaces and assets remain unchanged.
The relational and analytical consumption endpoints retain exactly the same behavior, with only the path prefix changed, for example:
- /api/v1/datasphere/consumption/(relational | analytical)/*
The previous path, /api/v1/dwc/(catalog|consumption), is deprecated. It will continue to be supported for 18 months, until March 2027.
Consuming with Technical User
You can use the Technical User with both the old and new API paths. Once you switch to Technical User authorization, it is recommended to move to the new standard endpoints.
When you make requests to the Consumption APIs with Technical User authorization, the privileges and space memberships applied to the request are determined by the scoped roles assigned to the OAuth client used to generate the access token.
For example, consider spaces A, B, and C. If the OAuth client has roles that grant consumption permissions for spaces A and C, then:
- In catalog queries, only assets from spaces A and C are returned.
- For data consumption, only models belonging to or shared with spaces A and C are accessible.
An example request is shown in the image below, which requests data from a view in relational format, use the generated access token from previous step as Bearer Authorization.
Important notice: Consuming data from assets protected by Data Access Controls is not supported at this time. The API will return an empty result.
Integration with Power BI via Custom Connector
Back in 2022, olaf_fischer and I worked on easing the integration between Power BI and the SAP Datasphere Consumption APIs by releasing an open source sample Power BI Custom Connector that supports SSO, making it easy to authenticate and consume the OData APIs in Power BI.
Although the custom connector has its limitations and active development has ceased, the introduction of a new authorization type is a significant improvement. Since the connector is used by many, it deserved an update to align with the latest features. I am happy to share that version 1.90 of the open source custom connector now supports authorization via OAuth 2.0 with client credentials.
More details on the custom connector can be found at original blog post or on the GitHub Repository
How to Use It in Power BI
- In the connector sign-in dialog, choose Authentication Method → “OAuth Client Credentials.”
- Enter the Client ID and Client Secret generated when you registered the app.
- Leave the existing Access Token URL in the system settings (connections.json file); no additional user details are required.
Backward-Compatibility Notes
- Existing connections that use the Authorization Code flow continue to work unchanged.
- You can reuse the same system configuration (Access Token URL) if you switch to the new Client Credentials flow later.
Summary
SAP Datasphere now supports Technical User access to the Consumption APIs with OAuth 2.0 client credentials, enabling service-to-service integrations without user interaction and thereby easing integration across multiple services and enabling many new use cases.
I’d be happy to hear your thoughts and comments on this topic. Let me know in the comments
Bluesky
