Webhooks with SAP Cloud Platform Integration & API Management

Webhooks are simple APIs to push real-time information from one application to another. They are represented by HTTP-URLs which are used to catch events from (cloud) applications. The data format is typically JSON.

This article explains how to process webhooks with SAP Cloud Platform Integration (CPI): As webhooks often are not using any authentication methods, we can not push the HTTP Posts directly to SAP CPI as either Basic (User/Password) or Certificate-based authentication is allowed only. Here´s where API Management comes into play!

API Management allows you to generate a sender-specific access key and accept incoming calls with this key only without additional authentication. About API keys: An API key is a long series of random characters that is difficult to guess. User/password are typically much smaller in length, can use common words and can be subject to brute force and dictionary attacks. API keys are therefore safer in general as they have a significant greater entropy and are much harder for attackers to compromise.

SAP Cloud Platform API Management is part of the Trial Program, so using your Trial Account you can evaluate this feature.

Procedure

CPI (you need to have an existing SAP Cloud Platform Integration tenant as there is no trial for CPI so far):
1. Create iFlow with a service endpoint
2. Select Basic Authentication (Role Based)
Access API Management:
1. Cockpit: https://account.hanatrial.ondemand.com/cockpit#/acc/<your-user>trial/service/apimgmt/overview
2. Access API Portal (for API Provisioning)
3. Access Developer Portal (for API Consumption)
API Portal
1. Create API Provider (the endpoint of your CPI flow)
2. Create API (pointing to API Provider)
  1. Add Policies for Preflow: checkKey (to verify access key) & setHeader (to set basic authentication)
3. Create Product (and add API)
Developer Portal
1. Create Application (for Product)
2. Application (access) Key is generated
3. Test

Detailed Procedure:

(1) Create and Deploy your iFlow in SAP CPI

(2) SAP Cloud Platform Cockpit

(3) Access API Portal: Create API

Create API Provider: Use Tenant Runtime Host and Basic Authentication

Create API:

The URL is the path you provided when creating the CPI iFlow – just add /http in front as the channel is HTTP.
The API Base Path will be the service part of the Webhook exposed on the Host Alias above.
Btw: URL and API Base Path can be completely different of course

Implement Policy:

Add Security Policy “Verify API Key” (checkKey) to the PreFlow (to verify the API authentication key has been correctly provided)
Add Mediation Policy “Assign Message” (setHeader) to set the Basic Authentication between API Management and SAP CPI