SAP SuccessFactors Source

Connect SAP SuccessFactors as a source to sync your HR data -- employees, employment, job and compensation history, and foundation objects -- from the SuccessFactors OData API into your data warehouse.

For an overview of capabilities and use cases, see the SAP SuccessFactors connector page. To run pipelines natively inside Snowflake, see Snowflake Native ETL.

Prerequisites

Before you begin, ensure you have:

• A SAP SuccessFactors instance with the OData API enabled
• A SAP Cloud Identity Services (IAS) tenant with an OIDC application configured for SuccessFactors, using the client credentials grant
• A technical (API) user in SuccessFactors mapped to that OIDC application
• The OIDC client ID and client secret from the IAS application
• The IAS dependency name for SuccessFactors (the resource name)
• Role-Based Permissions (RBP) granting the technical user read access to the objects and fields you want to sync

Supported Objects

SuccessFactors exposes hundreds of entity sets through its OData service, and the available set depends on the modules enabled in your instance (Employee Central, Recruiting, Onboarding, Performance & Goals, Compensation, Learning, and more). Supaflow discovers the queryable entity sets from your instance automatically, so the objects you can select reflect your own configuration rather than a fixed list.

Common objects include:

Object	Sync Mode	Description
User	Incremental	User accounts and profile attributes.
PerPerson	Incremental	Person records for the people in your organization.
EmpEmployment	Incremental	Employment records linking a person to employment with the company.
EmpJob	Incremental	Job information history (effective-dated).
EmpCompensation	Incremental	Compensation information history (effective-dated).
Foundation Objects (FOCompany, FODepartment, FOBusinessUnit)	Incremental	Organizational structure such as legal entities, departments, and business units.
Picklist, PickListV2	Full Refresh	Picklist definitions and values used across SuccessFactors.

Sync mode is determined per object: an object syncs incrementally when SuccessFactors exposes a filterable last-modified timestamp for it, and is fully refreshed otherwise. The objects above are representative; your instance's complete object list is discovered from its OData metadata.

Not Yet Supported

Some entity sets in the OData service are not offered as standalone tables. The connector skips entity sets that SuccessFactors does not allow to be queried directly as a complete collection -- for example entities that are only returned when expanded from a parent, entities that require a key or filter to query, and feature-gated entities that are not enabled in your instance. Large binary attachment data is also skipped to keep syncs reliable.

Objects restricted by Role-Based Permissions are not skipped -- they are still listed and selectable. Access is enforced when a sync reads them, so grant the technical user access to the objects you want to sync.

Contact us with the objects you need.

Incremental Sync

Objects that expose a filterable last-modified timestamp sync incrementally on that field -- only records changed since the last run are fetched. Objects without one are fully refreshed (see Supported Objects).

Effective-dated objects, such as job and compensation history, are loaded with their full effective-dated history. By default the connector loads all available history; set the Historical Sync Start Date to limit how far back the first sync reaches. Picklist objects are always fully refreshed.

Authentication

Supaflow authenticates with SAP Cloud Identity Services (IAS) using the OAuth 2.0 client credentials grant. IAS issues an access token that SuccessFactors accepts for OData access through a technical user mapped to your OIDC application -- no SuccessFactors username or password is stored.

Configure Access in SAP

1. In SAP Cloud Identity Services (IAS), create or open an OIDC application for SuccessFactors.
2. Under the application's client authentication, create a client ID and client secret for the client credentials grant.
3. Add SuccessFactors as a dependency on the application and choose the Technical User Access API (sf_technical_access), not Principal Propagation -- the connector uses the client credentials (technical user) flow. Note the Dependency Name, which you enter in Supaflow as the Resource Dependency Name.
4. Map the OIDC application to a technical user in SuccessFactors so the issued token can read OData. SAP support can complete this mapping if it is not available in your admin console.

Permissions

Through Role-Based Permissions (RBP), grant the technical user:

• View access to each object you want to sync
• Field-level view permission for the fields you select

You do not need access to everything -- the technical user reads only what its permissions allow, so grant access to the objects and fields you want and leave the rest. Some objects also depend on the technical user being in an RBP role's target population, or on a feature being enabled in Provisioning (for example Calibration, Employee Referral, or Execution Manager). Missing permissions surface as per-object setup errors during a sync, not as connector failures -- see Troubleshooting for how they appear and how to resolve them.

For long-term stability, use a dedicated technical user rather than an individual employee's account.

Configuration

In Supaflow, create a new SAP SuccessFactors source with these settings:

SuccessFactors API Host*

The OData API host for your SuccessFactors data center, with no path.
Example: https://apixyz.sapsf.com

IAS Token URL*

Your SAP Cloud Identity Services token endpoint.
Example: https://yourtenant.accounts.ondemand.com/oauth2/token

OIDC Client ID*

The client ID from your IAS application.

OIDC Client Secret*

The client secret paired with the client ID.
Stored encrypted

Resource Dependency Name*

Your IAS dependency name for SuccessFactors. Enter just the name; the full resource URN is also accepted.
Example: ABCD

Historical Sync Start Date

How far back to load data on the first sync, for objects that track history. Leave blank to load all available history.
Format: YYYY-MM-DD

Page Size

Number of records to request per page.
Default: 1000
Range: 1 to 1000

Test & Save

After configuring your credentials, click Test & Save to verify your connection and save the source.

Rate Limiting

SAP applies API limits to the SuccessFactors OData API. Supaflow handles transient rate limiting automatically with retry and backoff, but very large syncs may take longer or need off-peak scheduling and narrower object and field selection. See the SAP SuccessFactors API documentation for current limits.

Schema Evolution

SuccessFactors schemas are re-discovered on a schema refresh before running.

• New fields appear in subsequent syncs once the schema refresh runs
• New objects are discovered on schema refresh and can be added to a pipeline
• Deleted fields are no longer populated; the column remains in the destination
• Renamed fields are treated as a new field plus a removed field, since SuccessFactors identifies fields by name

Troubleshooting

Connection test fails

Problem:

• Authentication fails or the connection test does not succeed on Test & Save

Solutions:

1. Confirm the SuccessFactors API Host is correct for your data center and has no path
2. Confirm the IAS Token URL is your tenant's token endpoint
3. Verify the OIDC client ID and client secret, and that the IAS application is active
4. Confirm the technical user is mapped to the OIDC application in SuccessFactors

Resource dependency not found

Problem:

• The connection test fails with "No consumed apis matching provided resource parameter found"

Solutions:

1. The Resource Dependency Name does not match a dependency configured on your IAS application
2. Enter the exact Dependency Name from IAS, under Application APIs > Dependencies > Dependency Name

An object fails with a permission error

Problem:

• A selected object fails during a sync with an access error, such as "not in the target population", a "permission ... is required" message, or a feature that is "not enabled in Provisioning"

Solutions:

1. Check the Job Details per-object failure to see exactly which object failed and the message SAP returned
2. Grant the missing access for that object. Common causes are: the technical user is not in the RBP role's target population for that data; a specific RBP permission is missing (such as Calibration export, Execution Manager, Org Chart, Talent Ratings, or RBP role view); or the underlying feature is not enabled in Provisioning (such as Calibration or Employee Referral)
3. Refresh the datasource schema and re-run the sync after granting access. The exact permission is object- and tenant-specific, so deselect objects you do not need rather than over-granting

A field cannot be read

Problem:

• A sync fails with a message that a field is "not viewable" by the API user

Solutions:

1. SuccessFactors rejects the whole object when a selected field is not viewable, so the field must either be made readable or removed from the selection
2. Grant field-level view permission to the technical user's RBP role for that field, or deselect the field in the pipeline. For sensitive fields, such as a password field on user and candidate objects, deselect rather than grant
3. SuccessFactors reports only the first non-viewable field per object, so after fixing one, refresh the schema and re-run the sync to surface any remaining restricted fields

An object is missing from the object list

Problem:

• An entity you expected is not available to select

Solutions:

1. Some entity sets cannot be queried directly as standalone tables (parent-scoped, key or filter required, or feature-gated) and are not offered. Contact support if you need one of these
2. If a recently added object or field is missing, rerun schema discovery to pick it up
3. Role-Based Permissions do not remove objects from the list -- if a selected object instead fails during a sync, grant the technical user access and rerun the sync (see "An object fails with a permission error")

First sync is slow on large objects

Problem:

• A large object takes a long time on the first run

Solutions:

1. Deselect heavy fields, such as photos, that you do not need
2. Set the Historical Sync Start Date to limit how far back history loads
3. Schedule large syncs off-peak

Support

Need help? Contact us at support@supa-flow.io