SAP Knowledge Base Article - Public

3068812 - Error executing the user/group operation response when trying to retrieve a list of Users or Groups via the SCIM API in SAP Analytics Cloud (SAC) & SAP Digital Boardroom


The following error message occurs in SAP Analytics Cloud (SAC):

  • { "status": 500, "message": "Error executing the user/group operation." }


  • SAP Analytics Cloud (Enterprise) 2021.12.0
  • Postman

Reproducing the Issue

  1. Open the Authorization tab and select the type as Basic Auth.
  2. Create a POST request to the token URL to retrieve an Access Token.
  3. Create a GET request to <tenantURL>/api/v1/scim/Users/Groups and include the following headers:
    • Access Token: Bearer<String>
    • x-sap-sac-custom-auth: true
    • x-csrf-token: fetch
  4. After trying to retrieve the list, the operation fails with the error response described in the symptom.


The OAuth Client purpose has been configured for the incorrect authorization flow.


The Open Authorization (OAuth) standard involves the following three parties:

  • Client Application
  • Authorization Server
  • Resource Owner

There are two authorization flows:

  • Two Legged - Client Application and Authorization Server
  • Three Legged - Client Application, Authorization Sever and Resource Owner

In SAP Analytics Cloud Administration Console (App Integration) there are two types of OAuth Client purposes you can create:

  • API Access - Supported for Two Legged Authorization flows.
  • Interactive Usage - Supported for Three Legged Authorization flows.

Resolution 1

Two legged

In your SAC tenant, go to System, Administration, App Integration. Scroll down to the OAuth Client and create/edit the OAuth Client with the purpose selected to API access.

Resolution 2

Three Legged

In Postman click on the Authorization tab and change the Authorization Type from Basic Auth to OAuth 2.0. Fill out all the fields and then scroll to the bottom and click the orange button called Get New Access Token. This will result in a pop up to your SAC tenant which you will then need to sign in to retrieve the access token. 
You must generate the access token from the orange button described below instead of clicking the blue button called send next to the URL.

See Also

Your feedback is important to help us improve our knowledge base.


SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics,Error, Issue, System, Data, User, Unable, Access, Connection, Sac, Connector, Live, Acquisition, Up, Set, setup, Model, BW, Connect, Story, Tenant, Import, Failed, Using, Working, SAML, SSO, sapanalyticscloud, sap analytical cloud, sap analytical cloud, SAC, sap analyst cloud, connected, failure, stoppedm api, scim, oauth , KBA , LOD-ANA-ADM , SAC Administration , Problem


SAP Analytics Cloud 1.0