Retrieve data from SAP datasphere using OData API (for system integration)

[Sandyk]

Hi,

I am trying to retrieve data from SAP datasphere using its OData API. My usecase is "I have an application ABC who wants to retrieve data from SAP data sphere views/models using OData API capability."

I am using postman for my POC/testing purpose. I have read through the below blog How to setup Postman for consuming SAP DATASPHERE ... - SAP Community and is successfully able to retrieve data by creating OAuth2 client for "Interactive Usage" purpose. But my issue with this approach is this token is able to access data from any OData API from any space. I want to restrict access to specific space only.

So I thought may be I should use "Technical User" while creating OAUth client. I have also created a scoped role, given access to required space and added this role to oauth client while creating it.

In postman, I used grant type as client credentials, used oauth2SAML token url of datasphere in !Access Token URL" below,  entered ID & secret and generated a toke, it was successful. But using this token as well I am able to retrieve data from any space. Looks like the scoped role didn't work. 

Can you please help me where I have gone wrong? is it even right way to do it when an application wants to integrate with DSP?

SAP Datasphere OData 

@Matthew_Shaw 

@Ian_Henry  @RichT @shubham521 

Thanks in advance.

Regards

Sandy

[oddmar_lid]

Hi Sandy,

I have also done the same as you and created a OAuth Client with Technical user, assigned scope roles to that new technical user.

When testing in Postman I'm not able to connect to Datasphere and get the following error message:

I have  used same setup as you Sandy in Postman for Grant Type, Access Token URL, Client ID and Client Secret I got from when I setup the technical user OAuth Client in Datasphere:

For the Scoped Role, it only gives access to one specific Space.
Within this role I have tried to Mark absolutely all checkboxes (Create, Read, Update, Delete, Execute, Maintain, Share, Manage) within the list of auth objects , but also tried to only mark the Checkboxes relevant for consumer (READ).

And I'm then able to Authenticate towards SAP Datasphere and generate the Token.

But when I try the GET statement I get the 403 error above.

I dont get any data out of SAP Datasphere.
You mention that you are able to retrieve data from any space.
But it is the GET Statement that indicates which Space in the end you try to extract data out of (the ODATA URL you get from your FACT/Analytical Model).
Do you mean that if you use different GET statements towards different FACT/AM in different Spaces, you get out data for all?

When I reported in the 403 error, I got feedback from SAP that there is a bug in the OAuth setup with technical user and it do not work yet.
It was supposed to be fixed in Wave 2025.18, but this was skipped for some reason.

Hopefully the fix will come in next Wave, 2025.19, that is scheduled to be released 16.09.

Fingers crossed !!

Regards
Oddmar

[Sandyk]

Hi @oddmar, thank you for the response. hope it works after the fix then, in a week's time!! Looking at your screenshots, you are getting 403 error. But I am getting the actual response from any space.

[cardoso]

Hi!

Indeed, wave 19 should fix it.
In case not, let me know so we follow up this internally.

Best regards

[vivek_kumar55]

Hi Sandy,

[vivek_kumar55]

Hi Sandy, We tried in postman with same properties and its working ok for us. We are only getting data from space for which role is specified. But we are not able to use this technical user type client id in CPI and getting authorization error when creating OAuth2 Client credential.

[vivek_kumar55]

Hi Sandy, We are able to setup in postman with same properties and able to get data based on assigned scoped role. For other role we can see authorization error which is expected. But we are not able to use this client id in CPI because its giving us authorization error with OAuth2 Client credential.