Authenticate to SAP SuccessFactors using OAuth 2.0 and read a single employee's record via the Employee Central OData v2 API.
domain: help.sap.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
In SAP SuccessFactors Admin Center, register an OAuth client for your integration and generate an X.509 certificate/private key for it.
Build a SAML assertion identifying the API user and exchange it for an OAuth bearer token by POSTing to your tenant's /oauth/token endpoint on its API server.
Include the returned bearer token in the Authorization header on all subsequent OData calls.
Call GET /odata/v2/PerPerson('{personIdExternal}') on your instance's API server to retrieve one employee's personal data record.
Use $select, $filter, $top, and $skip OData query options on /odata/v2/PerPerson to narrow fields and page through bulk reads.
Request JSON explicitly (e.g. $format=json or an Accept: application/json header) since OData v2 defaults to XML/Atom.
Known gotchas
Personal data lives on 'Per*' entities (PerPerson, PerPersonal) while employment data lives on separate 'Emp*' entities (EmpJob, EmpEmployment) — assembling a full employee profile usually needs multiple entity calls or $expand.
There is no single global API host: each customer's OData endpoint is tied to the specific SAP data center hosting their instance.
OAuth requires a SAML bearer assertion signed with a registered X.509 certificate, not a plain client credentials POST — you need certificate management, not just a static secret.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?