SAP API Management

API Management is the capability inside SAP Integration Suite that controls how APIs are published, protected, and monitored. When a company exposes an SAP function as an API — for example, allowing a partner website to check product stock — API Management acts as the security guard and traffic controller standing between the outside world and that SAP function.

Imagine a popular restaurant. Customers call to make reservations. Without a receptionist, calls go directly to the kitchen where cooks are too busy to answer. The receptionist takes every call, checks the booking calendar, confirms availability, and never lets a random caller speak directly to the chef. API Management is that receptionist for your SAP APIs.

Why You Need API Management

Exposing an SAP system directly to external callers creates serious risks:

Anyone who knows the URL could send thousands of requests per second and crash the system
There is no record of who called what and when
A single bad actor could extract sensitive business data
If the SAP system changes its API, all external callers break immediately

API Management solves every one of these problems. It sits in front of the SAP system, intercepts every API call, applies rules, and only forwards approved, well-formed requests.

Key Components of API Management

API Proxy

An API proxy is a copy of an existing API that API Management creates and publishes. External callers never contact SAP directly. They call the proxy. The proxy applies all the rules and then forwards the request to SAP.

WITHOUT API Management:
[Partner App] ──────────────────────→ [SAP Backend]
               No security, no limits

WITH API Management:
[Partner App] → [API Proxy] → [Policies Applied] → [SAP Backend]
                 (Gateway)     (Auth, Rate Limit,     (Protected)
                               Logging, Transform)

API Policy

A policy is a rule that the API proxy enforces. Policies run automatically on every API call. Common policies include:

Verify API Key – Check that the caller has a valid key before allowing access
Rate Limit – Allow a caller to make only 100 requests per minute
Spike Arrest – Prevent sudden bursts of traffic from overwhelming the backend
OAuth Token Verification – Validate OAuth access tokens
JSON Threat Protection – Block malformed or malicious JSON payloads
Response Cache – Return a cached response for repeated identical requests

API Portal (Developer Portal)

The Developer Portal is a self-service website where developers discover and subscribe to APIs. It lists all available APIs, shows their documentation, and lets developers register and receive API keys. Think of it like an app store — but for APIs.

API Product

An API Product bundles one or more API proxies together and defines the access plan. For example, a "Basic Plan" product might include the product catalog API with a limit of 500 calls per day. A "Premium Plan" might include the same API plus the stock check API with no daily limits.

How API Management Works Step by Step

Step 1: DESIGN
   SAP developer creates an API proxy pointing to an SAP OData service

Step 2: PROTECT
   Policies attached: require OAuth token, limit to 1000 calls/hour

Step 3: PUBLISH
   API added to Developer Portal with documentation

Step 4: DISCOVER
   Partner developer logs in to Developer Portal, reads docs, subscribes

Step 5: CALL
   Partner app sends request with OAuth token to the proxy URL

Step 6: ENFORCE
   Proxy validates token, checks rate limit, forwards to SAP

Step 7: RESPOND
   SAP returns data, proxy returns it to partner app

Step 8: MONITOR
   API Management logs every call — who, what, when, how long

API Lifecycle Management

APIs change over time. A field gets added, a service moves to a new URL, or a better version gets built. API Management handles versioning so existing callers are not broken when changes happen.

Draft – API is being designed, not yet available
Published – API is live and accessible to approved callers
Deprecated – API still works but developers are warned to switch to a newer version
Retired – API no longer accepts calls

Running v1 and v2 of an API at the same time lets partners migrate at their own pace without urgent deadlines.

API Analytics

API Management records data about every call. The analytics dashboard shows:

Total call volume over time
Which APIs are called most frequently
Which callers generate the most traffic
Average response time
Error rate by API and by caller
Geographic origin of calls

This data helps product managers decide which APIs deserve investment, which are underused, and where performance needs improvement.

SAP Integration Suite API Management vs SAP Gateway

Older SAP landscapes use SAP Gateway to expose OData APIs from SAP ERP. API Management sits in front of SAP Gateway and adds the security and traffic management layer that Gateway itself does not provide.

[External App] → [API Management Proxy] → [SAP Gateway] → [SAP ERP]
                  (Security + Policies)    (OData Logic)   (Data)

In modern S/4HANA landscapes, OData services are built directly in the SAP system and exposed through API Management without needing a separate Gateway server.

When to Use API Management vs Cloud Integration

A common question for beginners: should I use API Management or CPI (Cloud Integration) for a given scenario?

Use API Management when you are exposing a synchronous API for external callers to query SAP data directly. The focus is on security, throttling, and discoverability.
Use Cloud Integration when you are building an automated data flow that transforms and routes messages between systems. The focus is on transformation, routing, and reliability.

In practice, many scenarios use both. CPI handles the internal transformation logic. API Management protects the endpoint that external systems call to trigger the CPI iFlow.

Previous lesson

Back to course

Next lesson