SAP Knowledge Base Article - Public

3782071 - How to Make API Calls to Compound Employee (CE) Using OIDC Authentication with Client Credentials in SAP SuccessFactors

Symptom

You need to query the Compound Employee (CE) API via the SuccessFactors SOAP API (/sfapi/v1/soap) using OIDC-based authentication (SAP Identity Authentication Service - IAS) with Client Credentials instead of basic authentication. You are unsure of the correct token exchange flow required before making the CE API call.

Environment

  • SAP SuccessFactors Employee Central
    • SOAP API
    • Compound Employee
  • SAP IAS

Resolution

The flow consists of four sequential steps. Each step depends on output from the previous one.

-----Postman collection & YAML file attached to the KBA-----

Step 1 – Obtain an IAS Assertion Token

Send a POST request to the IAS token endpoint using the Resource Owner Password Credentials (ROPC) grant to obtain an assertion (JWT).

  • URL: https://<your-ias-tenant>.accounts.ondemand.com/oauth2/token
  • Method: POST
  • Body (x-www-form-urlencoded):
KeyValue
client_idYour IAS application client ID
client_secretYour IAS application client secret
grant_typepassword
usernameThe technical user's username
passwordThe technical user's password

Save the returned access_token value, this is the assertion used in Step 2.

Step 2 – Exchange Assertion for an IAS Access Token

Send a POST request using the JWT Bearer grant to exchange the assertion from Step 1 for a scoped access token targeting the SuccessFactors API resource.

  • URL: https://<your-ias-tenant>.accounts.ondemand.com/oauth2/token
  • Method: POST
  • Headers: Accept: application/json, Content-Type: application/x-www-form-urlencoded
  • Body (x-www-form-urlencoded):
KeyValue
client_idYour IAS application client ID
client_secretYour IAS application client secret
grant_typeurn:ietf:params:oauth:grant-type:jwt-bearer
assertionThe access_token value from Step 1
resourceurn:sap:identity:application:provider:name:<<application_name>>

Save the returned access_token, this is the Bearer token used in Step 3.

Step 3 – Login to the SuccessFactors SOAP API

Use the Bearer token from Step 2 to authenticate against the SFAPI SOAP endpoint. This returns a JSESSIONID session cookie needed for subsequent API calls.

  • URL: https://<your-sf-api-host>/sfapi/v1/soap
  • Method: POST
  • Headers: Content-Type: text/xml, Authorization: Bearer <token_from_step_2>
  • Body (raw XML):

<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/">
  <Body>
    <login xmlns="urn:sfobject.sfapi.successfactors.com">
      <credential>
        <companyId>YOUR_COMPANY_ID</companyId>
        <username>YOUR_USERNAME</username>
        <password>YOUR_PASSWORD</password>
        <developerKey>YOUR_DEVELOPER_KEY</developerKey>
      </credential>
    </login>
  </Body>
</Envelope>

Extract the JSESSIONID from the response, this is used in Step 4.

Step 4 – Execute the Compound Employee API Query

Use the JSESSIONID from Step 3 to query the Compound Employee object via the SOAP API.

  • URL: https://<your-sf-api-host>/sfapi/v1/soap
  • Method: POST
  • Headers: Content-Type: text/xml, JSESSIONID: <JSESSIONID_from_step_3>
  • Body (raw XML):

<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/">
  <Body>
    <query xmlns="urn:sfobject.sfapi.successfactors.com">
      <queryString>
        SELECT person, personal_information, employment_information, job_information
        FROM CompoundEmployee
        WHERE person_id_external = 'sfadmin'
      </queryString>
    </query>
  </Body>
</Envelope>

Adjust the SELECT fields and WHERE clause as needed for your use case.

Notes

  • Replace <your-ias-tenant> with your actual IAS tenant subdomain (e.g., a9dokp7wr).
  • Replace <your-sf-api-host> with your actual SuccessFactors API host (e.g., api55preview.sapsf.eu).
  • The resource value in Step 2 (IAS_OIDC_SF_API) must match the application name configured in IAS for your SuccessFactors tenant.
  • The session established in Step 3 is time-limited. If calls fail with an authentication error, repeat Steps 1–3 to obtain a fresh session.

See Also

Compound Employee, CE API, OIDC, Client Credentials, IAS, Identity Authentication Service, JWT Bearer, SOAP API, SFAPI, SuccessFactors, jwt-bearer grant, token exchange, JSESSIONID, OData, authentication, access token, assertion, SAP SuccessFactors API, password grant

Keywords

KBA , LOD-SF-INT-CE , Compound Employee API , Problem

Product

SAP SuccessFactors HCM Suite all versions

Attachments

CE - OIDC.json
CE - OIDC.yml