Test an SAP CPI HTTPS iFlow with a Service Key, Then Trace the Call

An iFlow with an HTTPS sender is easy to deploy and surprisingly awkward to call: you need the right endpoint, a token from the right service key, sometimes a CSRF token, and then you still have to find the message your call created in the monitor.

This article goes through the whole loop for SAP Cloud Integration (SAP CPI): what you need, how to get a token and call the endpoint, how to find the resulting message, and how to trace it.

What you need

• A deployed iFlow with an HTTPS sender channel. Its Address, for example /orders/create, becomes part of the endpoint.
• The endpoint URL: the runtime host followed by /http and the address. The monitor's Manage Integration Content lists it for the deployed iFlow.
• A service instance of Process Integration Runtime with the plan integration-flow and a role that may send messages, and a service key of that instance with a client ID and secret.
• A test payload that the iFlow accepts.

Get a token and call the endpoint

The service key holds what the call needs: the client ID and secret, the URL of the token service, and the runtime host:

{
  "oauth": {
    "clientid": "<client id>",
    "clientsecret": "<secret>",
    "url": "https://<subaccount>.it-cpi<nn>-rt.cfapps.<region>.hana.ondemand.com",
    "tokenurl": "https://<subaccount>.authentication.<region>.hana.ondemand.com/oauth/token"
  }
}

Treat the client secret like a password: keep the key out of shared files, tickets and chats.

Call the endpoint and read the answer

The call takes two requests: a token with the client credentials grant, then the call itself with that token:

# 1. Get an access token with the client credentials of the service key
curl -X POST "<tokenurl>" \
     -u "<clientid>:<clientsecret>" \
     -d "grant_type=client_credentials"

# 2. Call the iFlow's HTTPS endpoint with the token
curl -i -X POST "<url>/http/orders/create" \
     -H "Authorization: Bearer <access_token>" \
     -H "Content-Type: application/json" \
     -d @order.json

# The response headers include SAP_MessageProcessingLogID: the Message ID of this call.

• 401: the token is missing, expired or from another subaccount.
• 403: the service key's role may not send messages, or the HTTPS sender requires a CSRF token. For a test endpoint you can switch CSRF protection off in the channel, or fetch a token first.
• 404: the address is wrong, or the iFlow is not deployed.
• 500: the iFlow failed; the message processing log says where.

Whatever the status, the response header SAP_MessageProcessingLogID gives the Message ID of the call, and with it you can open the message: see finding a message by Message ID.

Do it in the browser with the HTTP Runner

Kitegra's Toolbox has an HTTP Runner for your iFlow endpoints. Open it from the Tools view of the extension's popup.

• "New collection" and "New request" start a collection of requests with GET, POST, PUT, PATCH, DELETE or HEAD, query parameters, headers, and a JSON, XML or text body or a file.
• {{variables}} and environments (dev, test, prod): add one with "New environment", or send with "No environment". A variable marked "Secret" keeps its value in this browser.
• Auth: "From the collection", "None", "Basic", "Bearer token" or "OAuth2 client credentials (service key)", for which you paste the JSON of a "Service key (Process Integration Runtime)"; the token is fetched for you. A key with a client secret is needed; a certificate-based key is not supported.
• "Tests" check the response ("Status equals", "Body contains", "JSONPath equals", "XPath equals"), "Extract" saves values from it into variables, and "Run collection" sends the whole collection in order.
• "Import" → "Postman collection" brings in a Postman collection, as in from Postman or OpenAPI to an HTTP receiver, and on the "Data set" tab, "Send each payload" sends every payload of a data set from the test payload generator.

Nothing is sent until you click "Send", and your SAP cookies are never sent. The Runner calls only hosts under *.hana.ondemand.com. After a call, "Open in monitor" opens the message from its SAP_MessageProcessingLogID in the log viewer; if the designer host cannot be guessed from the endpoint, set "Tenant (designer host) for Open in monitor" in the environment.

Trace the call

1. Open the iFlow in the designer, open Messages from the "Kitegra" button, and switch "Trace: off" to on.
2. Click "Send" in the Runner, or call the endpoint with curl.
3. The message appears in the Messages panel with a TRACE mark. Choose "On diagram".
4. Click a coloured step to see the body, headers and exchange properties before it.

Tracing a message step by step covers the trace panel in detail.

How Kitegra helps

In the Kitegra, the service key, auth values and secret variables stay in your browser. Signed in, the Runner's collections and environments sync with your Kitegra account with every auth value and secret variable removed. The Runner is part of the Toolbox, which is free; tracing and the log viewer belong to the Message Monitor.

The Helper, Message Monitor, iFlow Inspector and iFlow Docs each count the iFlows you use them on: 5 per module without an account, 50 on the Free plan, 100 on Starter and 300 on Pro; Business has no limit. The Toolbox and the workspace extras are free. Compare the plans.

Try it in your next iFlow

Read what Kitegra adds around the SAP Integration Suite designer, or see it next to its modules.

Frequently asked questions