# API Creation Process in SAP S/4HANA: From CDS View to OData Service

> Source: https://netray.co/erp-help/api-creation-process-in-sap-s4-hana-cds-odata-service-binding
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: ERP Help

## Short answer

The modern process to create an API in SAP S/4HANA is to model data in a CDS view entity in ABAP Development Tools (ADT), expose it with a service definition, publish it with a service binding (OData V4 Web API or V2), activate it, and secure it with an access control and role authorizations. Always check the SAP Business Accelerator Hub first, since a released standard API may already exist.

## Kind

advanced

## System

sap

## Erp

SAP S/4HANA

## Module

ABAP RESTful Application Programming / OData / CDS

## Query

api creation process in sap s4 hana

## Alternate Queries

- create custom odata service s4hana
- sap cds view odata service binding
- create api in sap s4hana
- sap rap service definition binding

## Applies To

SAP S/4HANA on-premise (recent releases) and the ABAP environment. Older systems use SEGW for OData V2; names of the V4 admin tools vary by release.

## Steps

### How to create a custom OData API from a CDS view

**Items:**

- Search the SAP Business Accelerator Hub (formerly API Business Hub) for a released API. Use a standard one if it covers your need.
- In ADT (Eclipse), create a CDS view entity over the tables or released CDS views you need, with the fields and associations the API should expose.
- Create an access control (DCL) so the view returns only data the caller is authorized to see.
- Create a service definition that lists the CDS entities to expose.
- Create a service binding with the right type (OData V4 Web API for system integration, or OData V2 where consumers require it) and activate it.
- Register and test the service: for V2 use /IWFND/MAINT_SERVICE, for V4 use the V4 service administration tool; then call the service document and entity set in a browser or API tool.
- Assign authorization for the service to the technical user or role, and secure transport (HTTPS) with the right authentication.
- Transport the objects with your change request and document the API contract.

## Sections

### Which approach to use

**Body:**

For new development, the ABAP RESTful Application Programming Model (RAP) with CDS is the recommended path. It gives you read-only query APIs from a CDS view, or full create, update and delete with a behavior definition. For older landscapes, SEGW (Gateway Service Builder) still builds OData V2 services but is not the strategic direction.

Where SAP offers a released API, use it. Released APIs carry stability promises across upgrades, while custom APIs over internal tables can break when SAP changes structures, particularly in S/4HANA where tables are replaced by compatibility views.

### Security and operations

**Body:**

An exposed API is an attack surface. Use a dedicated technical user with the minimum role, enforce DCL access control, enable CSRF protection for writes, and rate limit at the gateway. Avoid basic authentication with a dialog user. Prefer OAuth or certificate authentication where your gateway supports it.

Monitor usage through the gateway logs and error log (for example /IWFND/ERROR_LOG), and version the API when contracts change so consumers are not broken.

**Code:**

- @AccessControl.authorizationCheck: #CHECK
- define view entity ZI_OpenPO as select from I_PurchaseOrderAPI01 {
-   key PurchaseOrder,
-   Supplier,
-   PurchaseOrderDate,
-   DocumentCurrency
- }

### Calling the API

**Body:**

Once active, consumers call the OData endpoint with a GET for reads and standard OData query options such as $filter, $select and $top. Writes require the behavior definition and a CSRF token fetch before POST or PATCH.

For integration patterns from Python or middleware, see the page on calling SAP OData with authentication and pagination. For on-premise landscapes, route calls through SAP Cloud Connector or your own API gateway rather than exposing the system directly.

## Pitfalls

- Building a custom API over a table SAP later changes, instead of a released CDS view.
- Skipping access control, so every caller sees every row.
- Exposing the service with a powerful dialog user for convenience.
- Forgetting to activate the binding in the gateway, so the URL returns 404.
- Returning large unfiltered entity sets without server-side paging.

## Ai Angle

Once APIs exist, a grounded AI layer can use them as governed tools: read-only by default, running under the user's role, with the call shown. Netray's ERPray and custom builds connect to S/4HANA OData and CDS services this way, and can run with open-weight models on-prem so ERP payloads never reach a public API.

## Faq

### How do I create an OData service in S/4HANA?

**Answer:** Model a CDS view entity in ADT, create a service definition that exposes it, create and activate a service binding (V4 or V2), then test the service. Add an access control and assign service authorization to the calling user or role.

### Should I use SEGW or RAP?

**Answer:** Use RAP with CDS for new work, since it is SAP's strategic model and works across on-premise and cloud ABAP. SEGW is still available for OData V2 on older landscapes, but it is not where new features land.

### Where do I find standard SAP APIs?

**Answer:** In the SAP Business Accelerator Hub, which lists released APIs with their documentation and sandbox. Using a released API is safer than building your own over internal tables.

### How do I secure a custom S/4HANA API?

**Answer:** Use HTTPS, a technical user with minimal roles, DCL access control on the CDS view, service-level authorization, CSRF handling for writes, and gateway-level rate limiting. Prefer OAuth or certificates over shared passwords.

## Search terms

api creation process in sap s4 hana, create odata service s4hana, sap cds view odata, sap rap service binding, sap service definition, custom api sap s4hana, sap business accelerator hub, sap segw vs rap

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json