Problem Statement: HTTP 403 Error in SAP CPI IFlow While Calling SAP Public Cloud OData API

[Pratibha_Salunke]

Hello SAP Community,

I have designed an SAP CPI IFlow to call the API_MANAGE_WORKFORCE_TIMESHEET OData service in SAP S/4HANA Public Cloud. However, I am receiving an HTTP 403 Forbidden error when invoking the API.

IFlow Overview:

Steps Implemented:

1. Get CSRF Token – Successfully fetched via a GET request.
2. Modify Headers – Added "x-csrf-token" and "Content-Type": "application/json".
3. Authentication – Using Basic Authentication with a Communication User.
4. Validated Payload – JSON format is correct as per API metadata.

Issue:

• The API responds with 403 Forbidden.

Observations:

1. 403 Forbidden Error – The request is reaching the API but is being denied access.
2. CSRF Token Retrieved Successfully – Indicates that token handling is correctly implemented.
3. Basic Authentication Used – The Communication User may lack required roles or permissions.
4. Headers Properly Set – "x-csrf-token" and "Content-Type": "application/json" are included.
5. Correct Payload Format – Ensured as per API metadata.
6. Tested in Postman – Working Fine – The same API call with the same credentials works in Postman but fails in SAP CPI.

Questions:

1. Are there any additional roles required for the Communication User in SAP S/4HANA Public Cloud?
2. Does this API require OAuth authentication instead of Basic Authentication when called from CPI?
3. Are there any specific CPI security settings or firewall restrictions that could be blocking the request?
4. Is there any difference in authentication behaviour between Postman and SAP CPI when calling this API?
5. Does CPI require any special configurations for calling public cloud OData APIs (e.g., certificates, destinations, or policies)?

[Vinyasha_V · Accepted solution]

Hi Prathiba, Can you check if the HTTP Session Reuse has been configured to On-exchange or On Integration flow for the configured i-flow ? If it is set to NONE you might have to check this and change this, you would find this option at Runtime Configuration of the Integration flow.

[Pratibha_Salunke · Accepted solution]

Thank you for your suggestion! I checked the HTTP Session Reuse setting in the Runtime Configuration of the Integration Flow, and it was set to NONE. After changing it to On Integration Flow, the issue was resolved successfully. Appreciate your help!