--- title: "Technical user in SAP S/4HANA for Administrators - Payhawk Help Center" slug: "setting-up-a-technical-user-in-sap-s-4hana-cloud-private-edition" description: "Create a technical user in SU01 and a role in PFCG in SAP S/4HANA Cloud, Private Edition, then add the API services and Fiori catalogs the integration needs." updated: 2026-10-20T14:10:08Z published: 2026-10-20T14:10:08Z canonical: "payhawk.com/setting-up-a-technical-user-in-sap-s-4hana-cloud-private-edition" --- > ## Documentation Index > Fetch the complete documentation index at: https://payhawk.com/help/llms.txt > Use this file to discover all available pages before exploring further. # Setting up a technical user in SAP S/4HANA Cloud, Private Edition When you connect third-party applications or automated workflows to an SAP S/4HANA® Cloud, Private Edition environment, creating the technical user and setting up the right security permissions is a critical first step. To let an external application access your data safely, you must configure a dedicated security role that grants access to specific APIs. ## Phase 1: Creating the technical user (transaction `SU01`) Before you configure permissions, create a dedicated user account that the external application uses to authenticate. In SAP, integrations must always use a technical user (either a **System** or **Communication** user type) rather than a dialog user. 1. Launch transaction `SU01` in your SAP system. 2. Enter a clear technical name for your integration user (for example, `INT_FIN_API`) and click the **Create** icon (the blank page button). 3. On the **Address** tab, fill in the required fields (Last name and Description) to indicate what this user connects to. 4. Switch to the **Logon Data** tab and maintain the following critical settings: - **User Type**: System or Communication. - **Password**: assign a secure, complex password. > [!WARNING] > Setting the type to System or Communication ensures the account cannot be used by a person to log into the SAP GUI interactively. It also exempts the password from standard user expiration policies, preventing your live production integration from breaking due to a forced password reset cycle. ## Phase 2: Creating the technical role (transaction `PFCG`) With the user account ready, create a custom security container (a single role) to hold the API technical services and data restrictions. 1. Launch transaction `PFCG`. 2. Enter a unique role name in the **Role** field using your company's naming convention (for example, `Z_FI_API_INTEGRATION_GATEWAY`). 3. Click the **Single Role** button to initialize the creation process. 4. In the **Description** field, write a brief summary of what this role does (for example, Contains OData V2/V4 authorizations for financial and master data API access). 5. Click **Save**. Once saved, the **Menu**, **Authorizations**, and **User** tabs unlock, so you can attach the specific APIs from the inventory list. ## Phase 3: Setting up the technical role (transaction `PFCG`) ### Understanding SAP API types SAP uses a few different frameworks to handle data, and they are authorized slightly differently in the system backend: - **Standard OData V2 services (**`IWSV`**)**: the traditional framework for SAP APIs. Each service is added to a security role individually. - **OData V2 service groups (**`IWSG`**)**: a modern way to bundle multiple V2 APIs together. This allows for easier routing and centralized management. - **OData V4 services (**`G4BA`**)**: next-generation, high-performance APIs. These use a newer authorization model inside SAP's security engine. - **SOAP web services (**`WS`**)**: operations typically used for transactional or bulk data processing, such as posting financial documents or processing bank statements. These are added through the legacy web service architecture. - **SAP Fiori Launchpad Catalogs**: Structural containers that bundle business applications. Even for certain purely technical integration users, assigning specific catalogs is required to pass underlying application-level context and processing checks. ### Master API authorization list Below is the full inventory of services required for a comprehensive financial and master data integration role. When adding these to SAP transaction `PFCG`, select the correct component type. | Technical service name | Type | Selection in SAP role menu | | --- | --- | --- | | `ZAPI_COSTCENTER_SRV_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_INTERNALORDER_SRV_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_PROFITCENTER_SRV_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_BUSINESS_PARTNER_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_FINWBSELEMENT_SRV_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_COMPANYCODE_SRV_0001` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_SUPPLIERINVOICE_PROCESS_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_CHARTOFACCOUNTS_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_CV_ATTACHMENT_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_ENTERPRISE_PROJECT_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_GLACCOUNTINCHARTOFACCOUNTS_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `ZAPI_OPLACCTGDOCITEMCUBE_SRV` | Service Group (`IWSG`) | SAP Gateway: Service Groups Metadata | | `API_COST_CENTER` | OData V4 (`G4BA`) | SAP Gateway OData V4 Backend Service Group & Assignments | | `Z_TAXCODE_SB` | OData V4 (`G4BA`) | SAP Gateway OData V4 Backend Service Group & Assignments | | `Z_BANK_ACCOUNT_SB` | OData V4 (`G4BA`) | SAP Gateway OData V4 Backend Service Group & Assignments | | `Z_GLACCOUNT_SB` | OData V4 (`G4BA`) | SAP Gateway OData V4 Backend Service Group & Assignments | | `API_BUSINESS_PARTNER` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_CHARTOFACCOUNTS_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_CN_BANK_RECONCILIAITON_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_COMPANYCODE_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_COSTCENTER_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_CV_ATTACHMENT_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_ENTERPRISE_PROJECT_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_FINWBSELEMENT_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_GLACCOUNTINCHARTOFACCOUNTS_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_INTERNALORDER_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_OPLACCTGDOCITEMCUBE_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_PROFITCENTER_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `API_SUPPLIERINVOICE_PROCESS_SRV` | OData V2 (`IWSV`) | SAP Gateway Business Suite Enablement - Service | | `JOURNALENTRYBULKCLEARINGREQUES` | SOAP Web Service (`WS`) | WebService | | `JOURNALENTRYBULKCREATEREQUEST` | SOAP Web Service (`WS`) | WebService | | `BANKSTATEMENTPOST_IN` | SOAP Web Service (`WS`) | WebService | | `SAP_PRC_BC_INVOICER` | Fiori Launchpad Catalog | SAP Fiori Launchpad > Launchpad Catalog | | `SAP_SFIN_BC_GL_JE_PROC` | Fiori Launchpad Catalog | SAP Fiori Launchpag > Launchpad Catalog | ![List of SAP roles and services for financial processing and invoice management.](https://storage.googleapis.com/payhawk-cdn/Adm%3AIntegrations%3ASAP/SAP_technical_user_screen.png) ### Step-by-step setup guide #### Step 1: Add the services to the role menu 1. Open transaction `PFCG`, type in your custom role name, and click **Change**. 2. Go to the **Menu** tab. 3. Click the drop-down arrow next to the **Transaction** button and choose **Authorization Default**. 4. Use the table above to match each service with its correct category type, search for the service name, and click **Copy** to add it to your role menu tree. 5. Add the Launchpad Dialog/Catalog: Click the dropdown arrow next to the **Transaction** button again, but this time select **SAP Fiori Launchpad** > **Launchpad Catalog**. - Ensure the **Catalog Provider** is set to **Fiori Launchpad Catalog**. - Enter the catalog ID in the Catalog ID field and confirm. > [!TIP] > Always add services through this **Menu** tab rather than typing objects manually into the authorizations. Doing this forces SAP to automatically pull in all the technical data structures required behind the scenes. #### Step 2: Grant business data authorizations Once the services are in the menu, define exactly what data the API can interact with (for example, which specific company codes or controlling areas). 1. Move to the **Authorizations** tab and click **Change Authorization Data** (the pencil icon). 2. Click the **Organizational Levels** button at the top of the screen. Enter your company's target values (such as company code `1010`, or a wildcard if granting access to all data fields). 3. Expand any remaining folders marked with a red status light. Ensure fields like `ACTVT` (Activity) are maintained: - Select `03` (Display) for read-only integrations. - Select `01` (Create) and `02` (Change) if the interface needs to push or modify data. #### Step 3: Generate the security profile The services and permissions do not take effect until a runtime profile is generated. 1. Once all status lights in your authorization tree turn green or yellow, look at the top toolbar. 2. Click the **Generate** button (the red-and-white circle icon). 3. This compiles the role configuration into active system rules. #### Step 4: Perform a user role comparison The final step ensures your newly updated security rules are safely pushed out to your integration user account. 1. Go back to the main `PFCG` screen and switch to the **User** tab. 2. Ensure your communication or system user is added to the user list. 3. If the **User Comparison** status light is yellow or red, click the **User Comparison** button directly above the grid. 4. Select **Full Comparison** from the popup dialog. 5. Once the status indicator turns green, the configuration is live, and your application can now call the APIs. ## Next steps - [Setting up SAP S/4HANA Cloud, Private Edition integration](/help/setting-up-sap-s-4hana-private-cloud-integration)