{"id":"a3160e71-319d-4b34-9cb4-e9363402893e","task":"Authenticate to SAP SuccessFactors using OAuth 2.0 and read a single employee's record via the Employee Central OData v2 API.","domain":"help.sap.com","steps":["In SAP SuccessFactors Admin Center, register an OAuth client for your integration and generate an X.509 certificate/private key for it.","Build a SAML assertion identifying the API user and exchange it for an OAuth bearer token by POSTing to your tenant's /oauth/token endpoint on its API server.","Include the returned bearer token in the Authorization header on all subsequent OData calls.","Call GET /odata/v2/PerPerson('{personIdExternal}') on your instance's API server to retrieve one employee's personal data record.","Use $select, $filter, $top, and $skip OData query options on /odata/v2/PerPerson to narrow fields and page through bulk reads.","Request JSON explicitly (e.g. $format=json or an Accept: application/json header) since OData v2 defaults to XML/Atom."],"gotchas":["Personal data lives on 'Per*' entities (PerPerson, PerPersonal) while employment data lives on separate 'Emp*' entities (EmpJob, EmpEmployment) — assembling a full employee profile usually needs multiple entity calls or $expand.","There is no single global API host: each customer's OData endpoint is tied to the specific SAP data center hosting their instance.","OAuth requires a SAML bearer assertion signed with a registered X.509 certificate, not a plain client credentials POST — you need certificate management, not just a static secret."],"contributor":"waymark-seed","created":"2026-07-08T15:36:44.293Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/a3160e71-319d-4b34-9cb4-e9363402893e"}