Getting '403' error accessing S/4 Public Cloud API from BTP

[#1]

Hi experts,

I have a SAP UI5 Freestyle application deployed on BTP, it uses several APIs published for SAP Public Cloud, including:

• API_BUSINESS_PARTNER (OK)
• API_SALES_ORDER_SRV (OK)
• API_MATERIAL_STOCK_SRV (403)
• API_PRODUCT_SRV (403) (OK) (Update: I found the role, it's BR_PRODMASTER_SPECIALIST)
• API_SALESORGANIZATION_SRV (403)

The first two APIs work well but not the other three. I kept getting 403 errors for them. 

Communications between BTP and Public Cloud

The destination on BTP is configured using SAML Assertion, and the communication system on the Public Cloud has also activated SAML Bearer Assertion Provider. Hence it's not using BASIC authentification, and no communication user is involved if I'm not mistaken.

Business Roles on Public Cloud

I initially also encountered 403 errors when accessing API_BUSINESS_PARTNER and API_SALES_ORDER_SRV. However, assigning BR_BUPA_MASTER_SPECIALIST and BR_SALES_MANAGER to my user on Public Cloud resolved the issue and granted access.

I assumed that assigning additional Business Roles would grant access to other APIs, but unfortunately, that was not the case. Below are the roles I assigned, expecting them to provide access to other APIs:

• BR_WAREHOUSE_CLERK
• BR_WAREHOUSE_CLERK_EWM 
• BR_INVENTORY_MANAGER
• BR_MATL_PLNR_EXT_PROC
• BR_MATL_PLNR_JIT_S_TO_C
• BR_INTERNAL_SALES_REP_PRSV
• BR_BILLING_CLERK
• BR_BPC_EXPERT
• BR_PRICING_SPECIALIST

Technical Detail of the UI5 Project

In manifest, I declare all APIs one by one as below:

      "API_SALES_ORDER": {
        "uri": "/sap/opu/odata/sap/API_SALES_ORDER_SRV/",
        "type": "OData",
        "settings": {
          "odataVersion": "2.0"
        }
      },
      "API_MATERIAL_STOCK": {
        "uri": "/sap/opu/odata/sap/API_MATERIAL_STOCK_SRV/",
        "type": "OData",
        "settings": {
          "odataVersion": "2.0"
        }
      },... etc.

In controller, they are consumed in a classic way:

const oModel = this.getOwnerComponent().getModel("myLocalJSONModel");
const oAPIModel = this.getOwnerComponent().getModel("API_MATERIAL_STOCK");
const oSelectedItem = oModel.getProperty("/selectedItem");
if (oSelectedItem) {
    try {
        const sPath = `/A_MaterialStock('${oSelectedItem.Material}')`;
        oAPIModel.read(sPath, {
            urlParameters: { 
                "$expand": "to_MatlStkInAcctMod"
            },
            success: (oData) => {
                // do something with oData
            },
            error: (oError) => {
                // do something with oError
            }
        });
    } catch (error) {
            // do something with error
    }
}

Note that the same syntax works well with sales order API and business partner API. And I'm only doing READ at the moment. 

However, I can access to metadata from the browser:

Can anyone provide some information on how to unblock the situation? 🙏🙏🙏

P.S. I know that it's suggested to use CAP or Cloud SDK to develop custom UI for Public Cloud, but at this moment I'm not deploying the app to Public Cloud but only BTP. So let's try to stay in the current tech stack (UI5 + standard APIs) unless it's really not possible.

Useful links that I already have:

• 3445942 - UI Development in SAP S/4HANA Cloud Public Edition - Frequently Asked Questions 
• Extend SAP S/4HANA Cloud on SAP Business Technology Platform 
• Create Communication System to Connect to SAP BTP, ABAP Environment 
• 3424818 - Restricted usage of S/4 released API services as found on the SAP Business Accelerator Hub... 

UPDATE:

I have created a custom role in Public Cloud that contains all the Business Catalogs available (1000+), and still no access to certain APIs. (Ex: API_PRODUCT_AVAILY_INFO_BASIC, API_SALESORGANIZATION_SRV)

[Chuma · Accepted solution]

Hello @diella 

Thanks for sharing the details of your setup, which helped a lot in narrowing down the issue. The 403 errors aren’t random; they usually indicate one of two things.s:

1. The API you’re calling doesn’t accept the authentication method you’re using (OAuth2SAMLBearerAssertion with user propagation),
2. Or the business user/communication arrangement doesn’t have the right authorisation or restrictions.

Here’s what applies to the specific services you mentioned:

• API_PRODUCT_SRV → Correct approach. Works with user propagation when you assign BR_PRODMASTER_SPECIALIST and maintain the communication arrangement SAP_COM_0009.
• API_MATERIAL_STOCK_SRV → Needs the communication arrangement SAP_COM_0164. Also, verify that your propagated user has the correct catalogues and that restrictions on Plants are maintained in IAM; otherwise, reads will still fail with a 403 error.
• API_SALESORGANIZATION_SRV → This one doesn’t support SAML bearer at all. Documentation shows only BasicAuthentication or ClientCertificateAuthentication. In practice, you’ll need to create a communication user and a second destination in BTP with Basic authentication to consume this API.

Why you can see $metadata in the browser but not from your UI5 app: your browser session runs under your full interactive login, while the app uses whatever is defined in the BTP destination. If the API doesn’t allow SAML bearer, or if the propagated user doesn’t meet the restriction checks, you’ll encounter a 403.

Recommended next steps:

1. Verify that you have active communication arrangements for each API’s scenario (0009, 0164, 0087).
2. For Material Stock, add the missing restriction values such as Plant in IAM for your business role.
3. For Sales Organisation, create a BasicAuth destination using a communication user — SAML bearer won’t work there.

That should unblock the services that are failing. 

Let me know if you need further support

Best regards,

Chuma

GenAI assistance content

SAP Usefull references

Verify that you have active communication arrangements for each API’s scenario 0009, 0164, 0087.
• Reference: Communication Arrangements – SAP Help Portal

For Material Stock, add the missing restriction values, such as  Plant, in IAM for your business role.
• Reference: IAM Information System – SAP Help Portal

For the Sales Organisation, create a BasicAuth destination with a communication user — SAML bearer authentication will not work there.

[deepu12345 · Accepted solution]

Hi Chuma , Thanks for guiding . Additionally I want to ask that Can I consume Custom API ( RAP-Based ) in CAPM for freestyle application through destination from Public HANA Cloud ?