Error 403 when Create Sales Order using API_SALES_ORDER_SRV

[#1]

Hi everyone, I need help. I face issues creating Sales Orders using API_SALES_ORDER_SRV from an External Application (in this case, Dynamics 365 Business Central).

I am trying to create a new sales order from an external application built in Microsoft Dynamics Business Central. I successfully retrieve sales order data using the GET method using the same service

endpoint (/A_SalesOrder). However, when I attempt to create a new sales order, I receive a "403 Forbidden" error message.

I have verified that the username and password for Basic Authorization are correct, and I have included the X-CSRF-Token in the header of my request. What confuses me is that I can successfully create a new sales order using Postman.

Could you help me understand why this might be happening?

Here is my payload to Create new Sales Order:

{
    "SalesOrderType": "OR",
    "SalesOrganization": "SBY", 
    "DistributionChannel": "SL", 
    "OrganizationDivision": "SL", 
    "PriceDetnExchangeRate": "1.00000",
    "SoldToParty": "1000347", 
    "TotalNetAmount": "500.00",
    "PurchaseOrderByCustomer": "Test SO (Integration)",
    "TransactionCurrency": "USD", 
    "IncotermsClassification": "EXW", 
    "IncotermsTransferLocation": "Palo Alto", 
    "CustomerAccountAssignmentGroup": "01",
    "CustomerGroup": "01",
    "CustomerPaymentTerms": "0004", 
    "to_Item": {
        "results": [
            {
                "SalesOrderItem": "10",
                "SalesOrderItemCategory": "TAN",
                "SalesOrderItemText": "Barang Ariel",
                "PurchaseOrderByCustomer": "Test so",
                "Material": "CAU0099",
                "RequestedQuantity": "20",
                "RequestedQuantityUnit": "PC",
                "ConfdDelivQtyInOrderQtyUnit": "2",
                "NetAmount": "500.00",
                "MaterialGroup": "L004",
                "ProductionPlant": "GON",
                "StorageLocation": "GON1",
                "ShippingPoint": "GOSP",
                "DeliveryPriority": "1",
                "DeliveryDateQuantityIsFixed": false,
                "IncotermsClassification": "EXW",
                "IncotermsTransferLocation": "Palo Alto",
                "IncotermsLocation1": "Palo Alto",
                "MatlAccountAssignmentGroup": "03",
                "CustomerPaymentTerms": "0004",
                "CustomerGroup": "01",
                "ProfitCenter": "MJK",
                "Subtotal1Amount": "500.00",
                "Subtotal2Amount": "500.00",
                "Subtotal3Amount": "500.00",
                "to_PricingElement": {
                    "results": [
                        {
                            "ConditionType": "PPR0",
                            "ConditionRateValue": "500.00",
                            "ConditionCurrency": "USD",
                            "ConditionQuantity": "20",
                            "ConditionQuantityUnit": "PC"
                        }
                    ]
                }
            }
        ]
    }
}

Here is my request using Postman

[MAVR · Accepted solution]

Hi @WG23 

The reason it works on your Postman and fails on your system is that Postman automatically forwards the session cookies, but your system is not reusing the session.

You can solve this by forwarding all the cookies.

Note: I recommend using SAP Cloud Integration to integrate your systems. Cloud Integration handles all of these connections to SAP with out-of-the-box functionality.

Best regards 🖖🏻

Ricardo

[WG23 · Accepted solution]

Hi, @MAVR  thank you for the answer, I'm considering using SAP Cloud Integration.

[JG_LEE · Accepted solution]

@MAVRI am facing this problem in SAP Build Apps. I made an web application that creates Sales Order in S/4HANA Public Cloud System. Destination for S/4HANA Public Cloud System is successfully set, and by testing it in SAP Build Apps - Integration - SAP Systems, creation was successful. However, after deploying this application in my CF(web app is running by Work Zone app router), this apps does not work and there's error message tells me

"POST request to /my application destination/ completed with status 403 The request contains an invalid x-csrf-token."

How can I fix this issue?

[MAVR · Accepted solution]

Hi @WG23 That would simplify your work as Cloud Integration can help you integrate both systems and you can avoid unnecessary enhancements.

[MAVR · Accepted solution]

Hi @JG_LEE, I am no pro in SAP Build Apps; I know a few years back I solved it with a workaround (at the time of transition from AppGyver to SAP), but these days, I believe the destination and connectivity service support GET/POST/HEAD operations. Please open a new query and tag it under SAP Build Apps so my colleagues can support it. But you understand the problem, right? The issue is that you need to re-use the same session (cookies). It is not enough to pass the correct x-csrf value.

[Ivan_Farafonov]

Hi,

First, even if your username and password are correct, check the user roles. The user needs proper permissions to create sales orders. They might be able to get information, but not create it. Look at the user’s roles in SAP S/4HANA to see if they can create sales orders.

Another thing to check is the CSRF Token. You mentioned using X-CSRF-Token for POST requests. This token is important for security and expires after a while. If it’s old, that could cause the 403 Forbidden error. Make sure to get a new CSRF token from the initial GET request and use it right away in your POST request. If you're making this request from a web app, you might face CORS issues. Postman can get around this, but a web app often can't. Make sure your SAP system is set up to allow cross-origin requests.

Also, double-check the headers in your request. The Content-Type should be application/json, and the Accept header needs to match the response format. Sometimes, missing or wrong headers can lead to authorization errors. Lastly, check the API logs in SAP S/4HANA. They can give you more info on the 403 Forbidden error and whether it’s a permission problem or something else. Asked Business Central consultants https://www.hiredynamicsdevelopers.com/hire-microsoft-dynamics-business-central-consultants/ from my company and gathered some tips that might help you fix the issue.