{"ref":"instrument:sap-api-policy-v4-2026a","page":"/instruments/sap-api-policy-v4-2026a","json":"/instruments/sap-api-policy-v4-2026a.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"sap-api-policy-v4-2026a","name":"SAP API Policy","instrument_type":"policy","publisher":"actor:sap","family":"sap-api-policy","version":"4.2026a","summary":"SAP's policy for API availability, documented use and controls, including special limits for autonomous or generative AI call sequences and systematic or large-scale data extraction.","url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","sections":[{"id":"1.1","title":"Published APIs","summary":"Published APIs are made available for the documented purposes identified by SAP, including integration, extensions and data exchange.","source":{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16","quote":"Published APIs are made available for the purposes described in that Documentation"}},{"id":"1.2","title":"Non-Published APIs","summary":"Customer and third-party applications must not access non-published APIs except where documentation permits it or SAP otherwise authorizes it.","source":{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16","quote":"Customers and partners are required to verify that each endpoint for Documented Use is a Published API."}},{"id":"2.2.2","title":"AI call sequences and data extraction","summary":"Outside SAP-endorsed architectures, data services or expressly identified pathways, the policy prohibits specified agentic API use and systematic or large-scale extraction.","source":{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16","quote":"SAP prohibits API use for: (a) interaction or integration with (semi-) autonomous or generative AI systems"}},{"id":"3","title":"Monitoring and remedies","summary":"SAP states that it may monitor API use and take enforcement actions when use does not comply with the documentation and policy.","source":{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16","quote":"SAP may monitor API usage and take reasonable enforcement actions"}},{"id":"FAQ 12","title":"Outbound interfaces","summary":"The accompanying FAQ distinguishes external consumption of SAP-provided services from outbound notifications or callbacks sent by an SAP system, which it places outside this policy's scope.","source":{"url":"https://www.sap.com/docs/download/2026/04/e2a0665e-4c7f-0010-bca6-c68f7e60039b.pdf","title":"Frequently Asked Questions on SAP API Policy v1.3","checked":"2026-09-16","quote":"Outbound interfaces ... are out of scope"}},{"id":"FAQ 27","title":"Custom-developed APIs","summary":"Customer-namespace ABAP interfaces are not prohibited merely because they are custom, but their underlying SAP dependencies and usage pattern still determine whether the use aligns with the policy.","source":{"url":"https://www.sap.com/docs/download/2026/04/e2a0665e-4c7f-0010-bca6-c68f7e60039b.pdf","title":"Frequently Asked Questions on SAP API Policy v1.3","checked":"2026-09-16","quote":"the custom interface itself is not per se prohibited"}},{"id":"FAQ 38","title":"Large-scale data access","summary":"Large-scale extraction and replication must use access mechanisms and patterns documented for that purpose rather than treating a transactional or custom API as a general bulk-data surface.","source":{"url":"https://www.sap.com/docs/download/2026/04/e2a0665e-4c7f-0010-bca6-c68f7e60039b.pdf","title":"Frequently Asked Questions on SAP API Policy v1.3","checked":"2026-09-16","quote":"must use the access mechanisms and patterns documented"}}],"sources":[{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16"},{"url":"https://www.sap.com/documents/2026/04/e2a0665e-4c7f-0010-bca6-c68f7e60039b.html","title":"Frequently Asked Questions on SAP API Policy v1.3","checked":"2026-09-16"}],"drafted_with_ai":true},"applicability":[],"edges":{"relevant_to":[{"ref":"artifact:cap-js-mcp","name":"@cap-js/mcp","json":"/artifacts/cap-js-mcp.json"},{"ref":"artifact:hochfrequenz-aibap-mcp","name":"aibap.mcp","json":"/artifacts/hochfrequenz-aibap-mcp.json"},{"ref":"artifact:arc-mcp-arc-1","name":"arc-1","json":"/artifacts/arc-mcp-arc-1.json"},{"ref":"artifact:cesar-sap-abap-kafka-rest-proxy","name":"cesar-sap/abap_kafka_rest_proxy","json":"/artifacts/cesar-sap-abap-kafka-rest-proxy.json"},{"ref":"artifact:rahulsethi-sap-datasphere-mcp","name":"mcp-sap-datasphere-server","json":"/artifacts/rahulsethi-sap-datasphere-mcp.json"},{"ref":"artifact:marianfoo-sap-api-policy-skill","name":"SAP API Policy Evidence Skill","json":"/artifacts/marianfoo-sap-api-policy-skill.json"},{"ref":"artifact:rahulsethi-sap-bdc-mcp","name":"sap-bdc-mcp","json":"/artifacts/rahulsethi-sap-bdc-mcp.json"},{"ref":"artifact:secondsky-sap-skills","name":"secondsky/sap-skills","json":"/artifacts/secondsky-sap-skills.json"}],"explicitly_relevant_to":[{"ref":"artifact:cap-js-mcp","name":"@cap-js/mcp","json":"/artifacts/cap-js-mcp.json"},{"ref":"artifact:hochfrequenz-aibap-mcp","name":"aibap.mcp","json":"/artifacts/hochfrequenz-aibap-mcp.json"},{"ref":"artifact:arc-mcp-arc-1","name":"arc-1","json":"/artifacts/arc-mcp-arc-1.json"},{"ref":"artifact:cesar-sap-abap-kafka-rest-proxy","name":"cesar-sap/abap_kafka_rest_proxy","json":"/artifacts/cesar-sap-abap-kafka-rest-proxy.json"},{"ref":"artifact:rahulsethi-sap-datasphere-mcp","name":"mcp-sap-datasphere-server","json":"/artifacts/rahulsethi-sap-datasphere-mcp.json"},{"ref":"artifact:marianfoo-sap-api-policy-skill","name":"SAP API Policy Evidence Skill","json":"/artifacts/marianfoo-sap-api-policy-skill.json"},{"ref":"artifact:rahulsethi-sap-bdc-mcp","name":"sap-bdc-mcp","json":"/artifacts/rahulsethi-sap-bdc-mcp.json"},{"ref":"artifact:secondsky-sap-skills","name":"secondsky/sap-skills","json":"/artifacts/secondsky-sap-skills.json"}],"capability_context":[{"ref":"capability:agent-code-access","name":"Agent access to your code","json":"/capabilities/agent-code-access.json","prominence":"prominent","sections":["1.1","1.2","2.2.2"]},{"ref":"capability:agent-systems-access","name":"Agent access to your systems","json":"/capabilities/agent-systems-access.json","prominence":"prominent","sections":["1.1","1.2","2.2.2"]},{"ref":"capability:agent-tooling","name":"Agent tooling","json":"/capabilities/agent-tooling.json","prominence":"prominent","sections":["2.2.2"]},{"ref":"capability:gui-automation","name":"Driving the SAP GUI","json":"/capabilities/gui-automation.json","prominence":"prominent","sections":["2.2.2","3"]},{"ref":"capability:event-mesh","name":"Event Mesh","json":"/capabilities/event-mesh.json","prominence":"contextual","sections":["2.2.2","3","FAQ 12","FAQ 27","FAQ 38"]},{"ref":"capability:mcp-servers","name":"Serve your application over MCP","json":"/capabilities/mcp-servers.json","prominence":"prominent","sections":["1.1","1.2","2.2.2"]},{"ref":"capability:tool-governance","name":"Tool governance","json":"/capabilities/tool-governance.json","prominence":"prominent","sections":["1.1","1.2","2.2.2","3"]}]}}