3108814 - Authentication error with HTTP response code 401 and error code LGN0010 - OData API

When running API request to Successfactors OData API, below error is returned:

LGN0010 - "Basic Authentication is disabled for company <companyID> or your IP <IP address> is not authorized to access OData API. To enable Basic Authentication, grant the permission to your role at Manage Integration Tools Manage OData API Basic Authentication. To authorize your IP address for OData API access, go to API Center OData API IP Whitelisting.".

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

• SAP Successfactors HCM Suite
  
  • OData API

1. API User being used to execute the API request is lacking permissions OR
2. OData API is currently disabled for the SuccessFactors instance OR
3. IP or IP Range of the client where the API call is executed from is not included or listed in the API allowlisting under:
   
   1. "OData API IP Allowlisting" in API Center AND/OR
   2. "Password and Login Policy Settings"

Note:

• It can also be that the format of the IP allow-list is not correctly maintained. See #3 in Resolution section.
• Odata IP Allowlisting is called "OData API Basic Authentication Configuration" in Admin Center

For #1. Provide 'Manage Odata API Basic Authentication' Permission under 'Manage Integration Tools'

• Allow Admin to Access OData API through Basic Authentication
• Manage Odata API Basic Authentication

For #2. In Provisioning Backend for Successfactors Instance Affected. Go to Company Settings > Under 'Web Services'. Ensure that 'Disable Odata API' is not selcted

For #3

Please check to see that both 

3.1 in SF's Password and Login Policy Settings > Set API Login Exceptions. Ensure that the IP / IP Range is included in the Allow list. See below format.

> Sample Format for single IP : 10.20.30.41

> Sample Format for IP Range : 10.20.30.40-10.20.30.50

3.2 While for Odata IP Allowlisting > OData API Basic Authentication Configuration

IP range need to be listed in below format. For single IP allow list, format of single IP is same as with maintaining in 'Password and Login Policy Settings > Set API login Exception'

Sample :

To include IP Range '192.168.0.0 - 192.169.255.255', 

Place them following below format then hit 'Save' butotn

192.168.*.* to cover IP Range "192.168.0.0-192.168.255.255"

and 

192.169.*.* to cover IP Range "192.169.0.0-192.168.255.255"

SF Password and Login Policy Settings

SF Odata API Logon Error Codes

SF Odata API Basic Authentication Configuration or ODATA IP Allowlisting

LGN0010, HTTP 401, responseCode=401, OData API Basic Authentication Configuration, OData API IP Allowlisting, Manage OData API Basic Authentication, Authentication Failure 401  , KBA , LOD-SF-INT-ODATA , OData API Framework , LOD-SF-INT , Integrations , Problem