SAP restricted API access, the policy that reprices integration
In April 2026 SAP published API Policy v.4.2026: non published APIs closed to third parties, autonomous and generative AI agents blocked, and bulk extraction forced onto SAP endorsed routes. The policy lands on estates already caught between two commercial frameworks, and the audit exposure compounds where they overlap.
Prepared by Redress Compliance · August 6, 2026 · SAP advisory. Based on 55 to 65 indirect access engagements led 2024 to 2025.
Executive summary
The policy narrows the sanctioned surface. v.4.2026 anchors third party access on the SAP Business Accelerator Hub as the only endorsed API surface: non published APIs are closed, autonomous and generative AI agents are blocked.
And bulk data extraction is forced onto SAP endorsed routes. Every integration path outside the sanctioned surface is now a document the auditor counts.
Two frameworks run in parallel, and most estates are caught between them. The pre 2018 named user framework charges per human touching the backend; the post 2018 Digital Access framework charges per document created via API across nine document types.
In our engagements, eight of every ten estates ran modern integration patterns while still contracted on the pre 2018 framework, which doubles the audit surface: SAP can name the users and claim the documents.
The claims are large and the settlements are not.
Publisher opening claims averaged $4 million to $12 million per estate across our 55 to 65 engagements, and settlements landed at 30 to 50 percent of the opening claim, a 38 percent median, wherever the customer maintained an independent access control log.
The log is the whole difference between negotiating the claim and receiving it.
The conversion negotiates hard, if it is not taken whole. Digital Access conversion discounts moved between 60 and 80 percent off list, 72 percent at the median, once a credible alternative architecture was on the table.
The trap is the uniform swap: converting all nine document types at a blanket rate overbought the estate by roughly a factor of three, because the real document volume concentrates in two or three types.
The two frameworks, and the gap between them
| Framework | Pricing basis | When it favors the buyer |
|---|---|---|
| Named user, pre 2018 | Per human user with backend access, RFC and BAPI traffic counted | Few users, heavy document volume |
| Digital Access, post 2018 | Per document created via third party API, nine document types | Many users, predictable document volume |
| Hybrid transition | Named users plus documents, layered during the conversion | Estates converting the concentrated document types only |
| Outcome based | A pre negotiated annual cap on the indirect estate | Mature integration estates that can document their volume |
The gap is the exposure. An estate contracted on named users but integrating over REST, OData, and IDoc gives SAP both audit dimensions at once: name every user behind the Salesforce integration, then claim Digital Access fees on the document volume besides.
The transition is contractual, not technical, which is why eight in ten estates had not made it, and why the audit letter is usually what forces the decision at the worst possible moment.
The nine documents, and where the money concentrates
Digital Access charges per document created through third party API, across nine types with distinct rate bands: sales orders at the top, purchase orders and financial documents close behind, then material documents and service entry sheets, with quality, manufacturing, maintenance.
And time documents in the low bands.
The Digital Access complete guide works the rate structure in full, and the practical finding across our estates was concentration: two or three document types carried nearly all the real volume, which is exactly why the blanket conversion overbuys.
Convert the sales order and financial document exposure you can document at volume, carve the rest out under named users, and lock each rate band individually for the term.
The SAP API restrictions negotiation playbook
The eight move negotiation framework against v.4.2026: the BTP integration mandate, the document carve outs, the third party tool positions, and the contract amendment patterns.
Get the white paper →The choke points, and the audit posture they decide
Four choke points control the access posture: the Business Accelerator Hub for published REST and OData APIs, the Cloud Connector for on premises to cloud traffic, the RFC Gateway for direct backend calls, and the IDoc framework for asynchronous document exchange.
The audit reads SAP's side of each, the RFC trace, the Cloud Connector log, the document creation source field, and the defense is the customer maintained mirror: an independent access control log, a documented integration inventory, and precategorized document sources.
Built before the letter arrives.
The API and Digital Access changes analysis maps how v.4.2026 shifts each choke point, and the third party tools guide works the Celonis, Boomi, MuleSoft, and Snowflake carve outs specifically.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across indirect access engagements, 2024 to 2025
Across roughly 55 to 65 SAP indirect access engagements Fredrik Filipsson led between 2024 and 2025, the pattern was consistent:
Against the publisher opening claim, under a structured buyer side posture with the independent log.
What blanket nine document conversions cost against a carve out limited to the concentrated types.
The v.4.2026 policy raises the stakes on the same mechanics: the narrowed sanctioned surface converts previously gray integration paths into countable documents, and the AI agent block lands directly on the automation roadmaps most estates are now building.
The combination of the Digital Access transition on carved out terms, the customer maintained log, and the structured inventory reduced exposure 60 to 80 percent against the first audit claim, and every element of that defense is cheaper before the audit than during it.
The indirect access framework carries the liability arithmetic in detail.
Your first five moves
- Inventory every third party integration now: each API consumer, its pattern, and its choke point, because the inventory is both the defense and the negotiation map.
- Stand up the independent access control log, your evidence against SAP's interpretation, worth the gap between 38 percent and the full claim.
- Classify the document volume by type and convert only the two or three types that carry it, each rate band locked individually.
- Position the AI agent roadmap against the policy early, because v.4.2026 blocks the integration pattern your automation program assumes.
- Negotiate the conversion with an alternative architecture tabled, where the 60 to 80 percent discounts live. The SAP practice runs the defense with you.
Frequently asked questions
What is SAP API Policy v.4.2026?
The API policy SAP published in April 2026: third party access restricted to published APIs on the SAP Business Accelerator Hub, autonomous and generative AI agents blocked, and bulk data extraction forced onto SAP endorsed routes.
It narrows the sanctioned integration surface and converts paths outside it into auditable Digital Access exposure.
What is SAP indirect access?
Human use of SAP backend data or functions through a non SAP front end: RFC calls, BAPI calls, and documents created via third party API all count.
SAP enforces it under two parallel frameworks, the pre 2018 named user model and the post 2018 Digital Access model, and estates caught between them carry both audit dimensions.
How large are SAP indirect access claims?
Publisher opening claims averaged $4 million to $12 million per estate across our 55 to 65 engagements, with broad integration estates seeing more.
Settlements landed at 30 to 50 percent of the opening claim, a 38 percent median, wherever the customer maintained an independent access control log and a structured integration inventory.
Should we convert to SAP Digital Access licensing?
Selectively, not uniformly. Real document volume concentrates in two or three of the nine types, so blanket conversions overbought by roughly a factor of three in our estates.
Convert the types you can document at volume, carve the rest out under named users, and lock each rate band individually for the term.
How much discount is available on the Digital Access conversion?
Conversion discounts moved between 60 and 80 percent off list in our engagements, 72 percent at the median, once the customer tabled a credible alternative integration architecture.
The internal SAP calculator anchors the first quote; the buyer side counter anchors from the carved out document volume.
How does SAP audit indirect access?
Through the RFC trace on production, the Cloud Connector logs, and the document creation source field across the principal document types.
The publisher's interpretation drives the claim unless the customer holds an independent access control log, which is the single control most correlated with settling at a third of the opening number.
