SAP SuccessFactors

Connect SAP SuccessFactors to collect hris evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In SAP SuccessFactors:

   1. Use (or have your administrator create) a dedicated SuccessFactors user for the integration; its user name and password go into the Username and Password fields.
   2. In SuccessFactors, go to Admin Center › Manage Permission Roles.
   3. Select the role assigned to the integration user.
   4. In that role, assign the Employee Central HRIS OData API permission, which SAP names as the permission for the user making Employee Central OData API requests.
   5. Grant the role access to the Employee Central entities Safeguard reads (User, EmpEmployment, EmpJob) through Role Based Permission (RBP): in user mode, the assigned RBP settings determine which entities can be viewed and what can be done with them.

   SAP SuccessFactors's public documentation does not cover every step.

   help.sap.com pages render client-side and could not be read in full; steps come from public SAP KBAs. Not verified from a fetched page: the exact permission name for basic-auth API access (search results cite Manage Integration Tools › Allow Admin to Access OData API through Basic Authentication), whether a read-only variant Employee Central HRIS OData API (read-only) exists (search snippet only), and where the UI shows the Company ID. SAP's API reference reports HTTP Basic Authentication for OData as deprecated, to be retired in favour of OAuth 2.0 / OIDC, so the optional Access token path may become the only one. KBA 2732680: Employee Central OData admin mode overrides role-based permissions; use user mode with scoped RBP for least privilege. No API key exists to reveal once; the password is the user's normal password. Verification: the API server list on help.sap.com rendered no content, so the Host location was removed.

   Source: userapps.support.sap.com, userapps.support.sap.com, userapps.support.sap.com, help.sap.com, checked 2026-10-07.

   The permissions Safeguard needs: User, EmpEmployment, EmpJob.

2. On Compliance › Connectors, open SAP SuccessFactors, click Connect, choose API token and fill in:

   Field	What to enter
   Host	Optional. For example: api4.successfactors.com
   Username	Optional.
   Password	Optional. Stored encrypted and never shown again.
   Company ID	Optional.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read SAP SuccessFactors and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks