> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP Ariba

> Connect SAP Ariba so Oleria can discover users, supplier users, groups, and audit activity in your Ariba realm, and deactivate users or change group membership.

Connect SAP Ariba to Oleria to see every user in your Ariba realm, the groups they belong to, and who is an Ariba administrator. Oleria also collects Ariba audit activity and can deactivate users or change their group membership.

<Note>This is a governance integration. Oleria discovers users, groups, and group membership. It doesn't inventory documents, purchasing units, or other Ariba content as resources.</Note>

## What Oleria discovers

| Area | Detail |
| :- | :- |
| **Accounts** | Every user in the realm. Enterprise users and supplier users are shown with their Ariba user type. Users in the **Customer Administrator** group, directly or through a nested group, are marked as administrators. |
| **Groups** | Every Ariba group, its direct members, and the groups nested inside it. |
| **Activity** | SAP Ariba audit events, such as sign-ins, user and group changes, and configuration changes, with the user who performed them. Requires the optional **Audit Search API**. Changes Oleria makes are excluded. |

## Prerequisites

* An SAP Ariba realm, and access to the **SAP Ariba Developer Portal** for that realm.
* An application on the Developer Portal with the **SCIM API for User and Group Master Data** API product approved for your realm.
* Optional: the **Audit Search API** API product, on the same application or on a separate one, if you want Oleria to collect activity. SAP documents it for the US and EU data centers.

<Warning>
  SAP's terms for the SCIM API for User and Group Master Data govern how third-party services connect to your realm. They require your organization to give SAP written consent before a third-party service, such as Oleria, uses the API. Contact your SAP account team to confirm what SAP needs from you before you request the API product.
</Warning>

<Note>SAP Ariba has no read-only version of the SCIM API. The application you create can also make changes, and Oleria uses it for the remediation actions below.</Note>

## Set up the integration

<Steps>
  <Step title="Create an application">
    Sign in to the **SAP Ariba Developer Portal** and create an application for Oleria.
  </Step>

  <Step title="Request the API products">
    Request the **SCIM API for User and Group Master Data** API product for your realm. SAP must approve the request. Activating SCIM can also require an SAP support case.

    To collect activity, also request the **Audit Search API** product, either for the same application or for a separate application.
  </Step>

  <Step title="Collect the connection details">
    From the Developer Portal, copy these values for each application:

    * **Application key**
    * **OAuth client ID**
    * **OAuth client secret**

    Also note your **realm name** (for example, `mycompany-T`), your **Ariba Network ID (AN-ID)** (for example, `AN01234567890`), and the data center that hosts your realm.
  </Step>
</Steps>

## Connect SAP Ariba to Oleria

<Steps>
  <Step title="Open the integration">
    Sign in to your Oleria workspace and navigate to **Integrations** -> **SAP Ariba** -> **Connect**.
  </Step>

  <Step title="Complete the connection form">
    | Field | Notes |
    | :- | :- |
    | **Data center** | Required. **United States (US)**, **Europe (EU)**, **Australia (AU)**, **Japan (JP)**, **United Arab Emirates (UAE)**, or **Saudi Arabia (KSA)**. |
    | **Realm name** | Required. You can't change it after the connection is created. |
    | **Ariba Network ID (AN-ID)** | Required. `AN` followed by digits. |
    | **SCIM application key** | Required. |
    | **SCIM OAuth client ID** | Required. |
    | **SCIM OAuth client secret** | Required. |
    | **Audit Search application key (optional)**, **Audit Search OAuth client ID (optional)**, **Audit Search OAuth client secret (optional)** | Only if the Audit Search API is approved on a separate application. Enter all three or leave all three blank. Blank reuses the SCIM application. |
    | **Audit types** | The audit events to collect as activity. **Security events** and **Configuration changes** are selected by default. |
    | **SCIM runtime URL override (optional)**, **Audit Search runtime URL override (optional)** | Advanced. Leave blank unless the Developer Portal shows a different runtime URL for your environment. Must be an `https://*.ariba.com` URL. |
  </Step>

  <Step title="Complete the connection">
    Select **Authenticate**. Oleria checks the credentials and confirms that the SCIM API product is approved for your realm, then begins the first sync. If the Audit Search API isn't approved, the connection still succeeds, but Oleria doesn't collect activity.
  </Step>
</Steps>

<Note>Connect each parent or child realm as a separate integration.</Note>

## Verify the integration

Confirm SAP Ariba appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review Ariba users, groups, and activity in your Oleria workspace.

## Remediation actions

Oleria checks that the SCIM API product is approved for the application before it runs each action. Every action is reversible, and reverting undoes only the change Oleria made.

| Action | What it does |
| :- | :- |
| **Deactivate SAP Ariba User** | Deactivates the user. Reverting reactivates the user, unless the user was already inactive. |
| **Add User to SAP Ariba Group** | Adds the user to the group. Reverting removes the user, unless the user was already a member. |
| **Remove User from SAP Ariba Group** | Removes the user's direct membership in the group. Reverting adds the user back. |

Oleria refuses an action, and explains why, in these cases:

* **Nested membership.** The user belongs to the group only through a nested group. Oleria never changes a nested or parent group. Remove the user from the nested group instead.
* **System users.** Oleria won't act on the `aribasystem` user, or on the technical user that the connection authenticates as.

## Known limitations

* **Group permissions:** Oleria shows which groups a user belongs to, but not the roles and permissions each group grants. SAP Ariba's APIs don't expose them.
* **Sign-in details:** SAP Ariba's APIs don't report MFA, SSO, or last sign-in, so Oleria shows these as unavailable.
* **Activity history:** Oleria collects up to the last 89 days of audit events.
* **Activity by data center:** SAP has documented the Audit Search API for the US and EU data centers. If your realm is hosted elsewhere and SAP can't approve the Audit Search API for it, Oleria still connects but doesn't collect activity.
* **China data center:** Realms hosted in the China (CN) data center aren't supported yet.
* **No account creation or deletion:** Oleria deactivates users and changes group membership. It doesn't create or delete users or groups.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.