Connecting SAP
ZeitMind can connect to S/4HANA, Business One, Datasphere, BW and ECC. The exact route depends on your exact setup (product, database license, your NetWeaver release).
Every route answers two independent questions:
- Which SAP interface do we read from? OData services, a database, or an existing staging layer. This depends on your SAP product and release, covered on this page.
- How do we reach it? The ZeitMind connector, a site-to-site VPN, or a direct connection. This is the same for SAP as for any other source, see IT Architecture: Connectivity Options.
Which route fits your system
S/4HANA on-prem or RISE
S/4HANA Public Cloud or ByDesign
ECC 6.0
Business One
Datasphere and BW
Routes
| Route | SAP products | Your SAP team provides |
|---|---|---|
| Standard OData APIs | S/4HANA (all editions), ByDesign | On-prem/RISE: activate the services (/IWFND/MAINT_SERVICE). Cloud: a communication arrangement and user |
| Business One Service Layer | Business One | A B1 user and the Service Layer URL |
| Built-in MSSQL / IBM i connector | ECC, Business One | A read-only database user; for ECC, a database licensed for full use |
| Datasphere OData API | Datasphere | An OAuth client and the views exposed for consumption |
| Custom CDS views as OData | S/4HANA | ABAP developers build and publish the views |
| ODP via OData | ECC and S/4HANA on NetWeaver 7.50+ | Publish each extractor as an OData service (SEGW) |
| BW queries as OData | BW, BW/4HANA; the main route for ECC below NetWeaver 7.50 | Publish each query as OData |
| File export | Any on-prem system | A scheduled export to SFTP or Azure Blob Storage |
| Oracle or DB2 (LUW) direct read | ECC | A database licensed for full use |
| Direct HANA read | ECC on HANA, S/4HANA on-prem, BW | A HANA full-use license and SAP's JDBC driver |
| Released BAPIs (RFC) | ECC, S/4HANA on-prem, BW | A user with RFC rights, network access to the SAP gateway, and SAP's NW RFC SDK |
ZeitMind does not use the ODP RFC API, which SAP Note 3255746 does not permit for third-party tools, or the unreleased RFC_READ_TABLE.
Custom Z tables and fields are not part of SAP's standard APIs. Expose them through custom CDS views or ODP extractors.
ECC cluster tables such as BSEG and KONV cannot be read with SQL on a non-HANA database; read them through ODP or BW instead. On ECC on HANA, the migration converted them to regular tables, so SQL reads work.
What your team prepares
For every route:
- A technical user for ZeitMind (e.g. created in
SU01), with display-only authorizations for the data in scope. Sync jobs run per project, not per person, so no individual logins are involved. - A network path from ZeitMind to the endpoint: the connector or a VPN for on-prem and RISE systems, or firewall rules for a public endpoint. See Connectivity Options. On RISE, SAP Enterprise Cloud Services manages the network: opening the path takes a service request to SAP, which is usually the longest lead time.
- The interface itself: activated services, published extractors or queries, or an export job, depending on the route above.
Adding a table later is a permissions change on the technical user (or one more published service), not a new pipeline.
Authorizations
| Route | Typical authorizations for the technical user |
|---|---|
| OData APIs, CDS views | S_SERVICE for each activated service, plus display authorizations for the business data it returns |
| ODP via OData | S_SERVICE for the published service and S_RO_OSOA for the extractors |
| BW queries as OData | S_SERVICE, S_RS_COMP for the queries, and the matching analysis authorizations |
| Released BAPIs (RFC) | S_RFC for the function groups in scope, plus display authorizations for the business data |
| Database routes | A database user with SELECT on the tables in scope |
How syncs behave
- Read-only. ZeitMind only reads from SAP. The technical user needs no create or change authorizations.
- You control the load. Each table syncs on its own schedule in your time zone, e.g. hourly for transactional data and nightly for master data, or only outside business hours. Reads are paged, so no single request pulls a whole table.
- Incremental loads. After the first load, large tables sync incrementally, through ODP deltas or by a change date or document number, so only new and changed rows are read.
- Credentials stay server-side. The technical user's password or OAuth secret is stored in a database schema no user or API can read. It is used only when ZeitMind reads from your system: syncs, listing tables, and previewing rows.
Direct database access and licensing
Whether a third-party tool may read an SAP database depends on how the database was licensed, not on the SAP product. A runtime license (HANA runtime, or Oracle ASFU) allows access only through SAP's own software; a full-use license allows ZeitMind direct access.
| Your setup | Usual database license | Direct read allowed? |
|---|---|---|
| ECC on Oracle, MSSQL or DB2, database bought from the vendor | Full use | Yes |
| ECC on Oracle, database bought through SAP | Runtime (ASFU) | No |
| ECC on MSSQL or DB2, database bought through SAP | Often runtime; check your contract | Only if your contract allows it |
| ECC on HANA, S/4HANA on-prem, BW/4HANA | Usually HANA runtime | Only with a HANA full-use license |
| S/4HANA Private Cloud (RISE) | HANA runtime, included in RISE | No |
| S/4HANA Public Cloud, ByDesign | SaaS | No database access |
The application-layer routes need the technical user to be licensed, usually as a technical or communication user. How your SAP contract treats indirect or digital access is worth confirming with your SAP licensing contact.
Using an existing staging layer
If your SAP data already lands in a governed layer you maintain, such as SAP Datasphere or an Azure SQL database, ZeitMind can read from there instead of from SAP itself.
- Works well when the layer already exists, is populated, and is kept up to date: it reuses your extraction and keeps it within SAP-native tooling.
- Costs more coordination when it has to be built first: each new table needs your team to extend the extraction before ZeitMind can use it, and the two refresh schedules run independently, so freshness is harder to trace.