SBPA Rules Runtime API returns 403 "bpm.rulesruntime.error" despite valid API key — CAP remote

[#1]

Hi, 

I'm calling the SAP Build Process Automation (SBPA) Rules Runtime API from a CAP (Node.js) backend using cds.connect.to() and getting a 403 error even though I'm passing an API key generated from the SBPA Lobby.

{ "code": "bpm.rulesruntime.error", "message": "User does not have sufficient privileges to access the environment." }

const spa = await cds.connect.to("baseline-spa-cc");
const response = await spa.send({
method: "POST",
path: `public/rule/runtime/rest/v2/rule-services?environmentId=shared`,
headers: {
"Content-Type": "application/json",
"Irpa-api-key": "****"
},
body: payload
});

#SPBA 

[pcf_pt · Accepted solution]

Hi,

On the path, make sure you have the correct Shared Environment ID. The URL should be "/public/rule/runtime/rest/v2/rule-services?environmentId=<SBPAEnvironmentID>" and that the rule is deployed to the specified Environment.

Additionally, create an API trigger for the Decision. You can find the details in the documentation

Regarding the header content, it should be "api-key" and not "Irpa-api-key". As one should not have secrets in the code, see also the documentation on setting up things to use the API key from a CAP application.

Hope it helps.