Prerequisites

Please carefully read the following to make sure you are able to complete the setup:

• You are an Admin of your SAP SuccessFactors instance. If you are not an admin, you won't even be able to search for and access the configuration pages that are described later on.
  • Alternatively: Please contact your SuccessFactors Admin and have them take over the integration setup process.
• The OData v2 API is available and enabled on your SuccessFactors instance (it is by default, so this is usually not something to worry about).

Overview 

Estimated, overall setup time: 30 minutes.

Fundamentally, there are 3 main steps you have to complete to set up the integration:

1. You have to create a new user and permission group for that user, 

2. You have to create a new permission role and then assign that to the newly-created permission group,

3. You have to generate the API credentials for that permission role. 

That's it! The rest of this document is a step-by-step walkthrough of everything you need to know and do to set up the integration.

Find your API domain

Your API domain will depend on which region you are based in. To find it, you have to:

1. Open the SuccessFactors API URLs list.
2. Filter for production environments (unless you're trying to connect a preview instance)
3. Once the filter is applied, find your location and select the API domain. If you are, for example, based in Germany, your production URL would be https://api012.successfactors.eu/
   Hint: The resulting “API Server” URL will often look quite similar to the SuccessFactors domain you log in on (the API for pmsalesdemo8.successfactors.com is, for example, located at apisalesdemo8.successfactors.com)

Please note that this is a workaround as there is no direct way to get the API domain via the SuccessFactors UI on your own. SAP shares in their help center that you should reach out to your SAP consultant to get the proper API domain.

Find your Company ID

1. Click on the profile picture in the top right and then on "Show version information":
   
2. Copy the value right next to Company ID:
   

Create a new user

1. In the admin center, go to the search console and type in "Import Employee Data"
   Click on the action that just appeared:
   
2. Click on "Import data" and then select "Download Template":
   
3. Click on the field next to "Select an entity" and then on "Basic Import":
   
4. Click on the "Generate Template" button
   
5. You will receive a .csv file to download. It likely contains two rows.
6. Add an additional row and fill out at least these fields
   - Status: active
   - User ID: SFAPI_INTEGRATION (for example, any value possible)
   - Username: SFAPI_INTEGRATION (for example, any value possible)
   - First name: API (for example, any value possible)
   - Last name: Integration (for example, any value possible)
   - Email: integration+user@example.com (any value possible - doesn't have to be a valid email)
   - Manager: NO_MANAGER
   - HR: NO_HR
   - Default locale: en_US
   
   Your CSV should now look something like this example CSV.
   
   
   
   It's important that you generate your own .csv template and don't download this example as your SuccessFactors instance will be configured differently
   
7. Now click on "Download Template" and then on "Import Data" to switch back
   
8. Click on the field next to "Select an entity" and then on "Basic Import"
   
9. Click on the "Browse" and select your .csv file to upload
10. Click on the "Validate Import File Data" button
    
11. If you see the "Validation Successful" dialog, click on the "Import" button
    
12. You should now see this success dialog
13. Please keep the .csv file open in the background, as you will need to reference it later.
14. You can ensure the creation succeeded by searching for the employee name (first name and last name) or username and seeing it under the "People" section. Don't be confused if the new user doesn't show up immediately, it can sometimes take a few minutes for the user to show up in the search!  
15. Once the user shows up as described in step 12, you can move on to creating the permissions group. 

Create a permissions group

1. Go to your search bar and enter "Manage Permission Groups"
   Click on the Action
   
2. On the new page, click the "Create New" button
   
3. Give the group a "name" and click on "Pick a category"
   Select the category option "Username"
   
4. Search for your user (to learn how to create a new one, click here) by entering its username and tick the box next to it
5. Click "Done"
   
6. You should now see your user in the people pool
7. Click "Done"
   

Create a permission role

1. Go to the search bar and enter "Manage Permission Roles" 
   Then click on the action with the same name
   
2. On the new page, click on "Create New"
   
3. Enter a name for the permission role
4. Click on the "Permission" button
   
5. Now you have to assign the correct permissions to the permission group. To do this, go through the following steps:
   1. See the needed permissions in the connection flow
      This is just an example. To see the scopes that are required for you, open the connection flow yourself.
      
      
   2. For each Bullet, find the permission category in the sidebar. I.e. for "Manage System Properties", find the corresponding permission group in the sidebar of the SF UI
      You can find these more easily by pressing STRG + F and pasting the permission there
      
   3. Now for each sub-bullet, click the right permission in the category
6. When you checked all necessary permissions, click "Done"
   
7. Now click on the "Add" button under section 3
8. In the new window, click on the "Select" button
9. Enter the name of your permission group (if you haven't created one yet, click here) and select it
10. Click "Done"
    
11. You should now see your permission group
12. Click "Done" again
    
13. At last, click "Save Changes"

Generate new OAuth2 client credentials

1. Go to your search bar and enter "Manage OAuth2 Client Applications"
   Click on the action
   
2. In the new window, click on "Register Client Application"
3. In the new window enter a name and a valid URL (this can be literally any URL, you can enter any value you want - it should start with ) for the application, then click the "Bind to Users" checkbox and click "OK"
   
4. Enter the USERID of the user that you created earlier   
5. Do not click "Generate X.509 Certificate" but instead, "Copy" the certificate from the connection flow:
   
   
6. Paste the certificate and click "Register"
   
7. Now click on "View" in the row at the very top
   
8. Get the API key
9. Now paste the API key and the name of the API user into the connection flow
10. Click on "Set up integration"