3462403 - Testing OAuth 2.0 Authentication for SuccessFactors APIs

You need to validate that OAuth 2.0 authentication is working correctly in your SuccessFactors tenant before configuring it in the client system (e.g., CPI, Boomi, ECP, third-party).

The OAuth 2.0 SAML Bearer Assertion flow is shared across all SuccessFactors API protocols. The steps below use an API testing tool (e.g., Postman) to isolate and validate the authentication independently from the client system.

If OAuth works in the API testing tool but fails in the client system, the issue is in the client system's configuration — not in the SuccessFactors OAuth setup.

OAuth Authentication flow schema

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

SAP SuccessFactors HCM Suite

• OData V2/V4
• SFAPI (CompoundEmployee)
• REST API
• SCIM API

Implementation

1. Register your OAuth2 Client Application

Register a client application in SuccessFactors and exchange an X.509 certificate to obtain an API Key (Client ID).

Complete details on: Registering Your OAuth2 Client Application 


       

2. Generate a SAML Assertion

Obtain a signed SAML 2.0 assertion based on the API Key (Client ID) using one of these methods:

• (Recommended) Use a trusted IdP (e.g. Microsoft Entra ID).
• If your client system can automatically generate SAML assertions (e.g., CPI, BTP), you can skip this step and use the assertion provided by the client. You can also let the client handle it internally, depending on its capabilities.
• Use the SAP-provided offline tool. See SAP Note 3031657.

Complete details on: Generating a SAML Assertion 

Testing

3) Request the Access Token

Once you have the SAML assertion and API Key (Client ID) configure your API testing tool (e.g. Postman, Hopscotch) as follows:

Complete details on: Requesting an Access Token

• HTTP Method	POST
  URI	https://<API-Server>/oauth/token
  Authentication	No Auth
  Headers	Content-Type: application/x-www-form-urlencoded
  Request Body	Enter the following values in the format of x-www.-form-urlencoded: company_id: Required. Your company ID.   client_id: Required. API key generated in Registering Your OAuth2 Client Application.   grant_type: Required. Set the value to "urn:ietf:params:oauth:grant-type:saml2-bearer".    assertion: Required. Enter the Base64-encoded assertion obtained from Generating a SAML Assertion.    new_token: (Optional) If you have already requested an access token with the same SAML assertion and the token hasn't expired yet, your request returns the same token by default with the remaining time indicated in the expire_in field. You can use parameter new_token=true to force the server to generate a new access token valid for 24 hours.

  
  
  What this looks like in practice from a REST Client is shown below:
   
  
  • HTTP Method, URI & Authentication:
     
    
      
  • Headers:
    
    
      
  • Request Body:
    
    
      
    
    
• The response to this request will contain the OAuth Bearer Token and will look be presented as shown below:
    
  
  
  

4. Call the API endpoint

Use the token to make a test call. The way you pass the token depends on the API protocol:

Example using OData V2

Choose "Bearer Token" as the authentication method and enter the token returned in the response of previous step:

5. (Optional) Validate Token Expiry

The access token is valid for up to 24 hours. You can check remaining validity:

Complete details on: Viewing the Validity of an Access Token

3532791 - How to authenticate for SuccessFactors using OIDC in IAS - SAP for Me

3031657 - How to generate SAML assertion using SAP-provided offline tool - SAP SuccessFactors

odata, api, oauth, authentication, token, bearer, access_token, assertion, client_id, grant_type, assertion, saml, OAuth, OAuth 2.0, SAML, SAML assertion, access token, bearer token, Postman, API testing, OData, SFAPI, SCIM, client_id, company_id, grant_type, X.509, certificate, Manage OAuth2 Client Applications, API Key, /oauth/token, /oauth/validate, authentication, token expired, SAML2 bearer, integration, CPI, Boomi  , KBA , LOD-SF-INT-ODATA-OAU , ODATA OAUTH Authentication , How To