Error connecting to SuccessFactors OData API from SAP API Management

[faisaljamal1]

Hello Everyone,

I am trying to connect to OData API (FODepartment) in SuccessFactors(SF) from SAP API Management. While making the calls to SF, I am getting HTTP 400 Error:

Error: We are sorry but the request could not be understood by the server (error code 400).

I am using OAuth authentication to connect to the SF system. I am able to get the token using the SAML bearer assertion, I checked this in POSTMAN by making direct calls to SF using the same token from debug logs from SAP APIM and it works fine there without any issues. But it fails in SAP APIM. It is a GET request that I am making and I have checked the target URL for any discrepencies. Spaces in the URL are replaced by '%20' as suggested in this OSS Note.
Can anyone please advise what am I doing wrong here?

Given below are the screenshots from the API Proxy I have configured:

Regards,

Faisal

[faisaljamal1 · Accepted solution]

Hi vijaykonam

As you pointed you, the issue was indeed caused by empty Content-Type header. I have removed the code from policy which was adding the header so that it is taken dynamicaly. The issue is resolved now. Thanks!

[mastanvalim]

Hi Faisal,

kindly provide screenshot of Odata configuration.

Mastan

[faisaljamal1]

Hi Mastan,

I have added the screenshots. Please take a look. Thanks!

[VijayKonam]

Which system is going to be the consumer from APIM? If it is CPI, why do you even have to mediate through APIM?

Having said, that 400 bad request is a payload issue. Your request is not understood by SF API. You need to check the payload structure, HTTP headers

[faisaljamal1]

Hi Vijay,

I am connecting directly to the /odata/v2 API in SuccessFactors without going through SAP CPI. Also, the API Proxy from SAP APIM will be exposed to some external users. I am taking care of the OAuth authentication between SAP APIM and SuccessFactors and not leaving this to the consumers of the API Proxy.

And I am doing a GET request so there is no payload. Are there any specific headers I should include?

Thanks!

[VijayKonam]

On provider side, you must use authentication that is accepted by SF. I see you have it as noauth.

[faisaljamal1]

Hi Vijay,

I have selected None as I am using OAuth via Bearer assertion in policies. Besides, I am not sure that authentication is the problem here as I can see status as connected in Debug logs.

Any other suggestions..?

[VijayKonam]

Then it is purely to do with HTTP headers or payload. You may have to do side by side comparision with working API calls from POSTMAN and APIM and match APIM to that.