How to use SAP API Portal Policy Editor to automatically add authentication information to SAP API calls

Open the API portal, find the API you want to edit, click Open, and enter the detailed page:

Click Policies:

On the right side of the strategy editor, you can see out-of-the-box strategies that can help you choose a strategy for your use case. All security policies are grouped under security, and similar traffic management policies, intermediary policies, and extended policies are also grouped accordingly.

There are Flows on the left side of the policy editor. PreFlow and PostFlow are located under the proxy endpoint and target endpoint.

Select PreFlow on the left, and Mediation Policies -> Assign Message on the right,

In the Create Policy panel, select Stream as Incoming Request:

The added Policy is displayed in the Policy as shown in the figure below:

Enter the source code source code editor:

Copy the following:

<AssignMessage async="false" continueOnError="false" enabled="true" xmlns='http://www.sap.com/apimgmt'>
<Add>
<Headers>
    <Header name="apikey">e9ZLBOfIplCOnibykWXsAfkMUexchhHN</Header>
    <Header name="Accept-Encoding">gzip,deflate</Header>
   </Headers>
</Add>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<AssignTo createNew="false" type="request"></AssignTo>
</AssignMessage>

You must replace the marked text with the API key you copied earlier.

This code will cause SAP API Management to add the required API key value to each request sent to the API Center and accept the compressed format used to efficiently transmit data for consumers.

In the same way, add an Assign Message under Mediation Policies to A_SalesOrder flow:

<!-- This policy can be used to create or modify the standard HTTP request and response messages -->
<AssignMessage async="false" continueOnError="false" enabled="true" xmlns='http://www.sap.com/apimgmt'>

     <!-- Sets a new value to the existing parameter -->
     <Add>
<QueryParams>
    <QueryParam name="$top">3</QueryParam>
</QueryParams>
</Add>

     <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
     <AssignTo createNew="false" type="request"></AssignTo> </AssignMessage>

This will limit the number of fields returned by S/4HANA.

After saving the Policy, click directly on the API proxy url after successful deployment:

You can directly use the API key edited in the policy to access the S/4HANA cloud Sales Order API without entering the user name and password:

More original articles by Jerry, all in: "Wang Zixi":