Sign in Subscribe
SAP SuccessFactors ⇄ SAC & Datasphere – End-to-End Integration Guide

SAP SuccessFactors ⇄ SAP Analytics Cloud & SAP Datasphere

The definitive, up-to-date, end-to-end integration guide — from API setup to business content onboarding.

SuccessFactors Analytics Cloud Datasphere OData V2

1 Prerequisites & Landscape Overview

This guide covers two independent integration paths that share the same SuccessFactors OData API foundation:

Path A — SAC (Direct)

  • SAC tenant with admin / BI role
  • Access to Connections and Content Network
  • SAC outbound IP ranges known (for SFSF allowlisting)

Path B — Datasphere

  • Datasphere subscription active on BTP
  • DW Administrator role collection
  • Space provisioned for HR/People analytics
  • Datasphere outbound IP ranges known

SuccessFactors Admin Center Access Required

  • OData API Data Dictionary
  • Manage OAuth2 Client Applications
  • Manage Permission Roles / Manage Users
  • IP Restriction Management
  • Company System and Logo Settings
Pre-flight info to collect: SFSF Company ID, API host (e.g., https://api4.successfactors.com), SAC/Datasphere tenant URLs, and the list of SFSF modules in scope (EC, Recruiting, Talent, Comp, LMS, etc.).

2 Shared SFSF API & Security Foundation

Both SAC and Datasphere consume the same SFSF OData V2 API. Configure this foundation once.

2.1 Enable OData API & Identify Service URL

  1. Admin Center → Company System and Logo Settings → enable OData API + V2.
  2. Admin Center → OData API Data Dictionary → note the Service Root URL:
https://apiX.successfactors.com/odata/v2

Confirm entities are visible: PerPerson, EmpEmployment, EmpJob, FODepartment, FOLocation.

2.2 Create the Technical User

  1. Admin Center → Manage Users → create TECH_SF_API.
  2. Assign email; disable interactive logon if allowed.
  3. Manage password expiry via your IAM/PAM policy.

2.3 Create Permission Role & Group

  1. Create role SAC_DS_API_ROLE with:
    • General User → User Login
    • Manage Integration Tools → Allow Admin to Access OData API
    • Employee Central data (Personal, Employment, Job, Comp, Org)
    • Module-specific read permissions (Recruiting, Talent, LMS)
  2. Create group API_TECH_GROUP containing TECH_SF_API.
  3. Assign role → group → target population.

2.4 IP Allowlisting

In IP Restriction Management, add both SAC and Datasphere outbound IP ranges for your region.

Common failure: Missing IP entries silently break connectivity for both SAC and Datasphere.

3 Path A — SAP Analytics Cloud → SuccessFactors (Direct)

3.1 Register OAuth2 Client in SFSF

  1. Admin Center → Manage OAuth2 Client Applications → Register Client Application.
  2. Fill in:
    • Application Name: SAC_Analytics
    • Application URL: SAC tenant URL
    • Confidential Client: Yes
    • Upload X.509 certificate (from SAC, for SAML bearer)
  3. Save and record: Client ID, Secret/Cert, Token URL.

3.2 Create the SAC → SFSF Connection

  1. SAC → Main Menu → Connections → Add Connection.
  2. Under Acquire Data, pick SAP SuccessFactors.
  3. Fill:
    • Name: SFSF_EC_Import
    • Server URL: https://apiX.successfactors.com
    • Company ID
    • Auth: OAuth2 SAML Bearer
    • Client ID / Token URL from step 3.1
    • Technical User: TECH_SF_API
  4. Test → Save.
A green “test successful” message confirms IP, OAuth, and role are correctly aligned.

4 Onboard SuccessFactors Business Content in SAC

SAC content is onboarded from the Content Network and repointed to your direct SFSF connection — no dependency on Datasphere.

4.1 Import Business Content Packages
  1. SAC → Files → Content Network → Business Content.
  2. Search "SAP SuccessFactors" and import:
    • Employee Central – Core HR
    • Workforce Analytics – Headcount / Turnover
    • Recruiting
    • Talent / Performance & Goals
  3. Select all objects → Import to a public folder.
4.2 Repoint Placeholder Connection

The imported package includes a placeholder connection. Edit it and enter your SFSF details — or repoint each model’s data source to SFSF_EC_Import.

4.3 Initial Import & Scheduling
  1. Open each model → Data Management → Data Source → Import Data.
  2. Validate row counts and query errors.
  3. Configure Schedule Settings: daily delta or full refresh.
4.4 Validate Stories & Dashboards

Cross-check totals against SFSF Ad Hoc Reports. Adjust role-based access to expose stories to end-user groups.

5 Path B — SAP Datasphere → SuccessFactors

5.1 Space Setup

  1. Launch Datasphere from BTP → confirm DW Administrator role collection.
  2. Navigate to System → Spaces → create HR_ANALYTICS.
  3. Assign your user (and any data modelers) as members.

5.2 Create SFSF Connection in Datasphere

  1. Open Connections → select space HR_ANALYTICS.
  2. Go to the Local Connections tab → Create.
  3. Search SuccessFactors → select the tile.
  4. Connection details:
    • URL: https://apiX.successfactors.com/odata/v2
    • Version: OData V2 (auto)
    • Auth Type: User Name and Password
    • User Name: APIUSER@COMPANYID — e.g. TECH_SF_API@HXM2345
    • Password: technical user password
  5. Click Next Step, provide Business Name SFSF_HR_DS, then Create Connection → Validate.
Key format: Datasphere requires the username as USER@COMPANYID — different from SAC. This is the most frequent connection error.

5.3 Consuming SFSF Data

  • Browse entities in Data Builder → Sources.
  • Build Replication Flows for snapshot or delta loads.
  • Build Data Flows for transformations.
  • Model Analytic Models (Dimensions: org, location, job family; Measures: Headcount, FTE, Turnover).
  • Optionally expose Analytic Models to SAC as live connections.

6 Datasphere SSL Certificate Handling

If validation fails at the SSL layer, Datasphere may not yet trust the SFSF certificate chain. Export and upload it manually.

6.1 Export the SFSF Certificate

  1. Open your SFSF URL (e.g. https://salesdemo.successfactors.eu) in a browser.
  2. Log in with a normal SFSF user.
  3. Click the 🔒 padlock → Connection is secure → Certificate is valid → Show certificate.
  4. Open the Details tab → Export → save as sf_cert.cer.

6.2 Upload Certificate to Datasphere

  1. Datasphere → System → Configuration → Security.
  2. Click Add Certificate → browse to sf_cert.cer.
  3. Add description (e.g. "SFSF EU Prod SSL") → Upload.
  4. Verify creation and expiry dates in the Security overview.

6.3 Re-validate the Connection

  1. Return to Connections → Local Connections in space HR_ANALYTICS.
  2. Select SFSF_HR_DS → click Validate.
  3. Expected: Connection is valid
Successful re-validation confirms the SSL trust chain and OData authentication are both operational.

7 Authentication Strategy: Username/Password vs OAuth2/X.509

Username & Password (Datasphere)

  • Simplest, fully supported
  • Format: USER@COMPANYID
  • Works well for initial setup / POCs
  • Requires password rotation strategy

OAuth2 / SAML Bearer with X.509 (SAC & optional for DS)

  • Certificate-based, no shared password
  • Preferred for production
  • Requires registration of X.509 in SFSF OAuth client
  • Longer-lived — rotate before certificate expiry
You can start Datasphere on Username/Password and migrate to OAuth2 later without breaking downstream models.

8 End-to-End Verification Checklists

Track your progress — state is saved locally in your browser.

0 of 0 tasks complete

SuccessFactors

SAP Analytics Cloud

SAP Datasphere

Guide compiled from SAP SuccessFactors, SAC, and Datasphere official documentation and community best practices.

SFSF Connection to SAC