SAP restricted third party API access. The buyer side guide to v.4.2026.

SAP indirect access is the most contested licensing dimension across the enterprise SAP estate. The framework changed materially in 2018 with the introduction of digital access licensing. This guide is the buyer side framework for the third party API access posture.

Third party API access to SAP is a routine integration pattern. The publisher's commercial framework is anything but routine. The pre 2018 named user framework and the post 2018 digital access framework operate in parallel, and most enterprises are caught between them.

This guide draws on more than one hundred SAP indirect access engagements at our SAP advisory practice. Read the related SAP audit defence guide and the SAP indirect access framework.

Two commercial frameworks running in parallel

SAP operates two principal commercial frameworks for indirect access. The pre 2018 named user framework charges per human user with backend access. The post 2018 digital access framework charges per document created via third party API.

Digital access licensing in detail

Digital access licensing charges per document created through third party API. Nine principal document types carry distinct rates.

When digital access is the right framework

• High document volume relative to user count. Mature integration estates with predictable document patterns.
• Broad indirect user population. Sales, service, and procurement functions where the named user count would exceed the digital access cost.
• SAP S/4HANA migration in progress. The S/4 commercial framework defaults to digital access, so the transition aligns with the broader S/4 cycle.

API access control choke points

Four principal choke points control the API access posture. The buyer side framework runs the access control through one or two of the four rather than allowing direct RFC traffic.

“Our SAP audit identified eleven thousand named users behind a Salesforce integration. We transitioned to digital access licensing on a hybrid commercial framework. The audit settled at one third of the publisher's initial claim.

Audit posture framework

SAP audits routinely include the indirect access dimension. The publisher's preferred audit posture relies on the SAP managed logs and the RFC trace. The buyer side audit posture relies on the customer maintained access control log.

Three audit posture moves

1. Customer maintained access control log. Independent evidence of every API call, every document, and every user mapping.
2. Integration inventory. Documented map of every third party API consumer, the integration pattern, and the access control choke point.
3. Document classification framework. Pre-categorized document creation source field for every third party integration.

What to do next

1. Inventory all third party integrations. Map every API consumer, the integration pattern, and the access control choke point.
2. Classify each integration. Named user, digital access, or hybrid framework.
3. Validate the audit posture. Run the RFC trace, the Cloud Connector log, and the document creation source field.
4. Evaluate the digital access transition. Compare the cost framework against the current named user exposure.
5. Negotiate the digital access conversion package. SAP offers a conversion discount that is typically materially below the publisher's first quote.
6. Implement the customer maintained audit log. Provides independent evidence in any audit conversation.
7. Engage independent buyer side support. Contact our SAP advisory practice for the indirect access scoping.

Frequently asked questions

What is SAP indirect access?

Indirect access is human use of SAP backend data or functions through a non SAP front end. RFC calls, BAPI calls, and document creation via API all count. SAP enforces licensing on the indirect use under both the pre 2018 named user framework and the post 2018 digital access framework.

Do I need to transition to digital access licensing?

Not automatically. The transition is contractual not technical. Most enterprises stay on the pre 2018 named user framework while operating modern integration patterns, which creates the audit exposure. The transition is favorable for customers with high document volume and broad indirect user populations.

How does SAP audit indirect access?

SAP runs the RFC trace against the customer's production system, reviews the SAP Cloud Connector logs, and queries the document creation source field across the principal document types. The audit posture is heavy and the publisher's interpretation drives the licensing claim unless the customer maintains an independent access control log.

What is the typical indirect access claim size?

Highly variable. Audit claims commonly run from two to thirty million for enterprises with broad third party integration estates. The eventual settlement is typically one third to one half of the initial claim with a structured buyer side posture.

Can the audit risk be eliminated?

Not eliminated, but materially reduced. The combination of the digital access transition, the customer maintained audit log, and the structured integration inventory typically reduces the exposure by 60 to 80 percent against the publisher's first audit claim.

How long does the digital access transition take?

Three to six months for the commercial framework. The technical implementation is shorter, typically four to eight weeks across the principal integration patterns. The transition includes the document classification, the conversion discount negotiation, and the audit log implementation.

The framework is set out in the SAP advisory practice. Read the related SAP audit defence guide and the SAP indirect access framework.