ODATA

Contents
ODATA ............................................................................................................................................................ 1
Introduction ............................................................................................................................................... 4
Create OData Service using Tcode SEGW................................................................................................... 4
Create Structure ..................................................................................................................................... 4
Create a Project...................................................................................................................................... 4
Create a Entity Type and Entity Set........................................................................................................ 6
Generate Runtime Objects................................................................................................................... 11
Service Maintenance ............................................................................................................................ 13
Service Metadata ................................................................................................................................. 17
MPC and DPC classes ........................................................................................................................... 18
Implementation for Get_Entity method .............................................................................................. 23
Testing the Get_Entity method............................................................................................................ 24
Implementation for Get_EntitySet method ......................................................................................... 27
Testing the Get_EntitySet method....................................................................................................... 30
Implementation for Create_Entity method ......................................................................................... 32
Testing Create_Entity method ............................................................................................................. 34
Implementation for Update_Entity method ........................................................................................ 37
Testing the Update_Entity method...................................................................................................... 38
Implementation for Delete_Entity method ......................................................................................... 39
Testing Delete_Entity method ............................................................................................................. 40
Create Items Entity type and Enity set................................................................................................. 41
Create Association between two entity types ..................................................................................... 46
Implementation for Get_Expanded_EntitySet method ....................................................................... 51
Testing Get_Expanded_EntitySet method ........................................................................................... 52
Implementation for Get_Expanded_Entity method ............................................................................ 53
Testing Get_Expanded_Entity method ................................................................................................ 54
Implementation for CREATE_DEEP_ENTITY method ........................................................................... 55

1|P a g e
 Testing CREATE_DEEP_ENTITY method ............................................................................................... 56
Save Test Case Variant ......................................................................................................................... 59
List of Test Case Variants ..................................................................................................................... 59
Function Import in ODATA Services ......................................................................................................... 60
Create Function Import for Get Action ................................................................................................ 60
Implementation for Execute_Action method for Get Action............................................................... 61
Testing Execute_Action method for Get Action................................................................................... 62
Create Function import for Post Action ............................................................................................... 64
Implementation for Execute_Action method for Post Action ............................................................. 65
Testing Execute_Action method for Post Action ................................................................................. 66
URI Options in ODATA Services................................................................................................................ 67
$Filter URI............................................................................................................................................. 67
$select URI............................................................................................................................................ 67
$select with filter URI ........................................................................................................................... 68
$format=xml URI .................................................................................................................................. 69
$expand URI ......................................................................................................................................... 69
Filter URI with $format=json ................................................................................................................ 71
$Count with filter URI........................................................................................................................... 71
$inlinecount=allpages URI.................................................................................................................... 72
$top and $skip URI ............................................................................................................................... 73
Inline count with top and skip in the URI ............................................................................................. 75
$value in the URI .................................................................................................................................. 75
$orderby URI ........................................................................................................................................ 75
$search URI .......................................................................................................................................... 76
?sap-ds-debug=download URI ............................................................................................................. 77
?sap-ds-debug=true URI....................................................................................................................... 78
?sap-statistics=true URI........................................................................................................................ 78
?sap-documentation=all URI ................................................................................................................ 79
$metadata?sap-documentation=all_as_markdown URI...................................................................... 79
$metadata?sap-value-list=all URI......................................................................................................... 79
$metadata URI ..................................................................................................................................... 80
$format=xlsx URI .................................................................................................................................. 80

2|P a g e
Create Odata Service with BAPI/RFC........................................................................................................ 82
Create ODATA Service using CDS Views ................................................................................................... 87
Create ODATA Service with publish of CDS Views ................................................................................... 91
Create ODATA Service with Service Definition and Binding..................................................................... 94
Error Handling in OData Services ............................................................................................................. 95
ADD_MESSAGE Method....................................................................................................................... 95
ADD_ERROR_DETAIL Method .............................................................................................................. 98
ADD_MESSAGE_TEXT_ONLY Method .................................................................................................. 99
ADD_MESSAGE_FROM_BAPI Method ............................................................................................... 100
ADD_MESSAGES_FROM_BAPI Method ............................................................................................. 101
Batch Technique in OData Services........................................................................................................ 102
Media Handling in OData Services ......................................................................................................... 117
Create Table ....................................................................................................................................... 117
Create entity type and entity set ....................................................................................................... 117
Maintain Media option ...................................................................................................................... 119
Generate Runtime Objects................................................................................................................. 120
Implementation for Create_Stream Method ..................................................................................... 120
Testing Create_Stream Method......................................................................................................... 121
Implementation for Get_Stream method .......................................................................................... 122
Testing Get_Stream method .............................................................................................................. 123
Implementation for Update_Stream method .................................................................................... 123
Testing Get_Stream method .............................................................................................................. 124
Implementation for Delete_Stream method ..................................................................................... 126
Testing Delete_Stream method ......................................................................................................... 127
Troubleshooting ..................................................................................................................................... 128
HTTP status Codes .............................................................................................................................. 128
T-codes for OData Services ................................................................................................................ 128
Cross Site Request Forgery (CSRF) ......................................................................................................... 131
Enable CSRF Token ............................................................................................................................. 131

3|P a g e
Introduction
OData - Open Data Protocol, is a web protocol for building and consuming RESTful APIs (Application
Programming Interfaces).
It provides a standardized way to expose and consume data over the web between different systems
and platforms.
It is based on the principles of Representational State Transfer (REST) and uses the HTTP protocol for
communication for data access and manipulation.
It uses JSON or XML as the data format for communication between client and server.
OData is used in web and mobile applications to access data from SAP systems.
OData Service allows to perform CRUD Operations.
CRUD stands for CREATE, READ, UPDATE and DELETE.
OData relies on standard HTTP methods, such as GET, POST, PUT, PATCH, and DELETE.
OData Services are of 3 types
OData ABAP Services -> for DB operations/interaction with SAP ECC/CRM/SRM
OData HANA Services -> for DB operations/interaction with SAP HANA
OData External Services -> for DB operations/interaction with Non-SAP or external server.

Create OData Service using Tcode SEGW

Create Structure
Create a Structure in Tcode - SE11

Create a Project
Navigate to Transaction code - SEGW

4|P a g e
Click on Create Project icon

Give the Project name and Description

Assign package or click on Local Object

5|P a g e
Project got created

Every odata Service Project contains 4 main folders

Data Model
Service Implementation
Runtime Artifacts
Service Maintenance

Create a Entity Type and Entity Set

Entity Type is to maintain collection of fields with data type & length and it is same as Structure
Entity is to hold single record at runtime and it is same as Work Area
Entity Set is to hold collection of records at runtime and it is same as Internal Table

6|P a g e
Create a Entity Type and Entity Set by importing properties of a structure

Provide the Entity Type and Structure name.

Keep selected check box for create default entity set as it is to create Entity Set
Entity Type and Entity Sets are case sensitive

7|P a g e
These are the properties from the structure, select the required properties.

8|P a g e
9|P a g e
Select the key fields

10 | P a g e
Entity type and entity set got created and change the Properties names for understanding purpose.

Click on Check button to check consistency.

Generate Runtime Objects

Click on Generate Runtime Objects button

11 | P a g e
These are the MPC classes and DPC classes for the odata service.

Do save if package assigned or click on local object.

Runtime Objects generated

12 | P a g e
Runtime Artifacts:
Collection of Classes for implementing Database functionalities
_MPC is a Model Provider Class
_MPC_EXT is a Mode Provider Extension Class
_DPC is a Data Provider Class
_DPC_EXT is a Data Provider Extension Class
_SRV is a Registered Service
_MDL is a Registered Model

Service Maintenance
Service Maintenance is to Register/Maintain the service

Click on Register button to register the service

13 | P a g e
Provide the system alias as Local.

14 | P a g e
Click on Local Object

Click on Maintain Button to maintain the service registration

15 | P a g e
Select the Service

Activate it

16 | P a g e
Service Metadata
Click on SAP Gateway Client to check the metadata

17 | P a g e
Metadata contains Name of EntityType, Name of EntitySet, Name of each Field with data type and
length, Name of structure used for importing fields.

MPC and DPC classes

Navigate to service Implementation

18 | P a g e
Implementation can be done in dpc ext class.

Model Provider Class (MPC)

Model Provider Class registers "metadata" of OData Service as per Data Model
Model Provider Class is a Super Class for Model Provider Extension Class

19 | P a g e
Model Provider Extension Class (MPC_EXT)
Model Provider Extension is a sub class or derived class

20 | P a g e
Data Provider Class (DPC)
Data Provider Class is a Super Class for Data Provider Extension Class

Data Provider Extension Class (DPC_EXT)

Data Provider Extension Class is a sub class or derived class

21 | P a g e
Data Provider Extension Class contains 5 CRUD methods for each and every Entity Set
<EntitySetName>_Create_Entity( ) C
<EntitySetName>_Get_Entity( ) R
<EntitySetName>_Get_EntitySet( ) R
<EntitySetName>_Update_Entity( ) U
<EntitySetName>_Delete_Entity( ) D

Data provider Extension Class contains other methods also

Create_Stream( )
Update_Stream( )
Get_Stream( )
Execute_Action( )
Get_Expanded_Entity( )
Get_Expanded_EntitySet( )

22 | P a g e
Implementation for Get_Entity method
This method is used to fetch a record based on input Key Fields
Redefine the method to implement.

Signature button views the method parameters

IT_KEY_TAB parameter contains input Key Field Values
ER_ENTITY sends output record

23 | P a g e
Testing the Get_Entity method
Navigate to Odata Service and click on SAP Gateway Client

24 | P a g e
Also, can click on maintain button to navigate to gateway client

Gateway Client Tcode - /IWFND/GW_CLIENT

25 | P a g e
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t(PurchaseOrder='4500000005')

/sap/opu/odata/SAP/ZPURCHASE_ORDER_SRV -> Resource Root

/sap/opu/odata -> Service Path
SAP -> Namespace
ZPURCHASE_ORDER_SRV -> OData Service Name
PO_HEADERSet -> Resource Name

26 | P a g e
Implementation for Get_EntitySet method
This method is used to fetch N Number of records based on Inputs
This method contains below method parameters
IT_FILTER_SELECT_OPTIONS contains filter values
IV_FILTER_STRING contains filter string
IO_TECH_REQUEST_CONTEXT contains input Values
ET_ENTITYSET send output records
Redefine the method to implement

27 | P a g e
28 | P a g e
29 | P a g e
Testing the Get_EntitySet method

30 | P a g e
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t/$count?$filter=DocType eq 'NB'

Implement for multiple filter values request

https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSet?$filter=(Pur
chaseOrder eq '4500000004' and DocType eq 'NB')

31 | P a g e
Implementation for Create_Entity method
This method is used to Insert Data
This method contains below method parameters
IO_DATA_PROVIDER contains Input record values
ER_ENTITY is to send output record

32 | P a g e
Redefine the method to implement

33 | P a g e
Testing Create_Entity method
First get data and click on use as request button

34 | P a g e
35 | P a g e
Record is added in the table

36 | P a g e
Implementation for Update_Entity method
This method is used to Update Data
This method contains below method parameters
IT_KEY_TAB contains input Key Field Values
IO_DATA_PROVIDER contains input record values
ER_ENTITY send output record

37 | P a g e
Testing the Update_Entity method
Table records

Update Request

38 | P a g e
Table record got updated

Implementation for Delete_Entity method

This method is used to "Delete Data"
This method contains below method parameters
IT_KEY_TAB contains input key field values

39 | P a g e
Testing Delete_Entity method

40 | P a g e
Record from table got deleted

Under single OData Service Project, N Number of Entity Types, EntitySets can be created.

Create Items Entity type and Enity set

Create Items structure

Create items entity type and set

41 | P a g e
42 | P a g e
43 | P a g e
44 | P a g e
45 | P a g e
Create Association between two entity types

46 | P a g e
Principle Entity Type is to maintain Collection of Fields related to Header Data
Dependent Entity Type is to maintain Collection of Fields related to Items Data
Principle EntitySet is to hold collection of Header Records at runtime
Dependent EntitySet is to hold collection of Item Records at runtime
Association is the relationship between Principle Entity Type and Dependent EntitType, the relationship
between Two Entity Types
AssociationSet is the relationship between Principle Entity Set and Dependent Entity Set, the
relationship between Two Entity Sets
Referential Constraints is the common field between Principle Entity Type and Dependent EntityType
Navigation Property is used to Execute Create_Deep_Entity( ), Get_Expanded_Entity( )

47 | P a g e
Cardinalities are 0 -> 0..1
1 -> 1
M -> 0..n
N -> 1..n

48 | P a g e
49 | P a g e
Navigation Property:
Navigation Property is used to navigate between related entities
It is used to fetch Item data for each Header record using expand keyword under service URL
/sap/opu/odata/SAP/ServiceName/PrincipleEntitySet?$expand=<NavigationProperty>

50 | P a g e
Implementation for Get_Expanded_EntitySet method
This method is used to fetch Header data and its corresponding items data
This method contains below method parameters
IT_FILTER_SELECT_OPTIONS contains input values
ET_EXPANDED_TECH_CLAUSES send output data ( Header + it's Items )

51 | P a g e
Testing Get_Expanded_EntitySet method
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t?$expand=POHeadtoPOItem

https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t?$filter= DocType eq 'NB'&$expand=POHeadtoPOItem

52 | P a g e
Implementation for Get_Expanded_Entity method
This method is used to FETCH Header Record along with Corresponding Item Records.
This method contains below method parameters
io_expand contains input value
Et_expanded_tech_Clauses send output data

53 | P a g e
Testing Get_Expanded_Entity method
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t('4500000005')?$expand=POHeadtoPOItem

54 | P a g e
Implementation for CREATE_DEEP_ENTITY method
Deep Entity set is a Structure inside structure
This method is used to INSERT Header Record along with Corresponding Item Records.
This method contains below parameters
IO_DATA_PROVIDER contains Input Header Record along with its corresponding item records
ER_DEEP_ENTITY to send Output ( header + its Items ) back

55 | P a g e
Testing CREATE_DEEP_ENTITY method
Table records Header and items

56 | P a g e
57 | P a g e
Header Table records

Item Table records

58 | P a g e
Save Test Case Variant

List of Test Case Variants

59 | P a g e
Function Import in ODATA Services
Function Import can deal with GET, POST options
CRUD Methods can deal with GET, POST, PUT, DELETE options

Create Function Import for Get Action

Provide Function import name

Add the return type, cardinality, entity set and HTTP method type.

60 | P a g e
Implementation for Execute_Action method for Get Action
This method is generic and can be used for INSERT functionality and SELECT Query functionality
This method contains below method parameters
IV_ACTION_NAME capture the name of the function triggered
IT_PARAMETER accept input values
ER_DATA send output data

61 | P a g e
Testing Execute_Action method for Get Action

62 | P a g e
Add input parameters for get action

Change the logic to get data based on the input parameters

Test the get action with passing input parameters

https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/GetPODetails?
PurchaseOrder='4500000005'

63 | P a g e
Create Function import for Post Action

Provide the name for post action

64 | P a g e
Add the return type, cardinality, and HTTP method type

Add the input parameters for post action

Implementation for Execute_Action method for Post Action

65 | P a g e
Testing Execute_Action method for Post Action

66 | P a g e
URI Options in ODATA Services
These are used to control the data and the Query Options are the parameters added to the odata
service URL.

$Filter URI
This is used to filter the data based on the provided filter values
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t?$filter= DocType eq 'NB'

https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t?$filter= DocType eq 'NB' and PurchaseOrder eq '4500000004'

$select URI
This is used to specify which properties to include in the result set and display only required fields with
values

67 | P a g e
$select with filter URI

68 | P a g e
$format=xml URI

$expand URI
It is used to include related entities in the result set
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t?$filter= DocType eq 'NB'&$expand=POHeadtoPOItem

69 | P a g e
https://s4hana2023.sapserver.com:44326/sap/opu/odata/sap/ZPURCHASE_ORDER_SRV/PO_HEADERSe
t('4500000005')?$expand=POHeadtoPOItem

70 | P a g e
Filter URI with $format=json
This is used to view records in Json format

$Count with filter URI

It is used to get the total number of entities in the result set

71 | P a g e
$inlinecount=allpages URI
This is used to show number of records fetched along with the data
Add the below code to get the count along with data

72 | P a g e
$top and $skip URI
$top is used to limit the data that are being fetched
$skip is used to skip a certain number of entities from the result set
Add the below code to get records based on top and skip

73 | P a g e
74 | P a g e
Inline count with top and skip in the URI

$value in the URI

This is used to get the value of a particular field

$orderby URI
It is used to sort the data based on one or more properties
Add the below code to get records based on order

75 | P a g e
$search URI
Add below code to get records based on search string

76 | P a g e
?sap-ds-debug=download URI

77 | P a g e
?sap-ds-debug=true URI

?sap-statistics=true URI

78 | P a g e
?sap-documentation=all URI

$metadata?sap-documentation=all_as_markdown URI

$metadata?sap-value-list=all URI

79 | P a g e
$metadata URI
This is used to get the metadata details like name of entity name, entity set, navigation and association
details

$format=xlsx URI
This is used to export the data in to excel sheet

80 | P a g e
81 | P a g e
Create Odata Service with BAPI/RFC

Provide the Entity Type and Bapi name

Select the required fields

Select the key field

82 | P a g e
Map to Data Source

83 | P a g e
Propose Mapping for input and output fields

84 | P a g e
Default code generated in the Get entity method

85 | P a g e
86 | P a g e
Create ODATA Service using CDS Views
SADL – Service Adaptation Description Language
This is a framework which generates the OData service from the CDS

87 | P a g e
88 | P a g e
89 | P a g e
90 | P a g e
Create ODATA Service with publish of CDS Views
The annotation @OData.publish: true is used to publish the CDS as OData Service

Activate the service using the Tcode-/iwfnd/maint_service

91 | P a g e
92 | P a g e
93 | P a g e
Create ODATA Service with Service Definition and Binding
Below are the steps to create OData service
Create CDS View
Create Service Definition by referencing CDS View
Create Service Binding
Activate Service Binding and publish it
Service URL can be generated and consumed using that URL.

94 | P a g e
Error Handling in OData Services
Interface /IWBEP/IF_MESSAGE_CONTAINER to add the messages to the OData response
Methods that can be used to add messages to message container
ADD_MESSAGE -> it is to add an error message
ADD_ERROR_DETAIL -> it is to add error detail
ADD_MESSAGE_TEXT_ONLY -> it is to add an Error text without Message Details
ADD_MESSAGE_FROM_BAPI -> it is used to add one message of type BAPIRET2 to the message
container
ADD_MESSAGES_FROM_BAPI -> it is to add messages of type BAPIRET2 to the message container

Steps to raising an error message to odata response

Create a message container object
Add message text to message container object
Raise the exception by exporting message container object

ADD_MESSAGE Method
Add single message to response

95 | P a g e
96 | P a g e
Add multiple messages to response

97 | P a g e
ADD_ERROR_DETAIL Method

98 | P a g e
ADD_MESSAGE_TEXT_ONLY Method

99 | P a g e
ADD_MESSAGE_FROM_BAPI Method

100 | P a g e
ADD_MESSAGES_FROM_BAPI Method

101 | P a g e
Batch Technique in OData Services
OData Batch requests allow the grouping of multiple operations into a single HTTP request payload.
Batch Requests are submitted as a single HTTP POST request to the batch endpoint of a service.
http://<gateway_host>:<port>/sap/opu/odata/iwfnd/Odata_service_name/$batch
The batch request must contain a Content-Type header specifying a content type of "multipart/mixed"
and a boundary specification.
The boundary specification is used in the body of the request to mark the beginning and end of each
part of the batch request – i.e. separating the different operations contained in the request.
In Batch request, each part representing an operation must include a Content-Type header with value
“application/http” and a Content-Transfer-Encoding” header with value “binary”.

102 | P a g e
103 | P a g e
Multiple Requests

104 | P a g e
Multiple requests with header and items

105 | P a g e
Change Set Methods

106 | P a g e
107 | P a g e
108 | P a g e
109 | P a g e
110 | P a g e
111 | P a g e
112 | P a g e
113 | P a g e
114 | P a g e
115 | P a g e
116 | P a g e
Media Handling in OData Services
Create Table
Crete a table for media handling in Tcode - SE11

Create entity type and entity set

Create a entity type and entity set by using table

117 | P a g e
118 | P a g e
Maintain Media option
Select the entity type and maintain the media check box

119 | P a g e
Generate Runtime Objects

Implementation for Create_Stream Method

This method is used to Create File Content
This method contains below method parameters
is_media_resource accept Input File Content & Input File Type

120 | P a g e
Testing Create_Stream Method

121 | P a g e
Implementation for Get_Stream method
This method is used to Download File Content
This method contains method parameters
it_key_tab accept Input Key Field values
er_stream send output File Content & Output File Type

122 | P a g e
Testing Get_Stream method

Implementation for Update_Stream method

This method is used to Upload File Content
This method contains below method parameters
it_key_tab accept input key field values
is_media_resource accept Input File Content & Input File Type

123 | P a g e
Testing Get_Stream method

124 | P a g e
125 | P a g e
Implementation for Delete_Stream method
This method is used to Delete File Content
This method contains below method parameters
it_key_tab accept input key field values

Table record

126 | P a g e
Testing Delete_Stream method

File record got deleted from table

127 | P a g e
Troubleshooting
HTTP status Codes
1XX -> Information Messages
2XX -> Success Messages
3XX -> Redirection Messages
4XX -> Client Side Error Messages
5XX -> Server Side Error Messages

100 Continue
101 Switching Protocols
200 OK The request is successfully executed by GET method
201 OK The request is successfully executed by POST method
203 OK The request is successfully executed by UPDATE method
204 OK The request is successfully executed by DELETE method
300 Multiple Choice
301 Moved Permanently
302 Found
303 See Other
304 Not Found
400 Bad Request The request could not be parsed successfully because of a syntactically or
semantically incorrect URI.
401 Unauthorized Authentication is required and has not been provided.
403 Forbidden User does not have privileges to access the entity
404 Record Not Found The record does not exist for the given query.
405 Method Not Allowed A request cannot be used for this record.
406 Not Acceptable Self-explanatory
500 Internal Server Error Internal Error
501 Not Implemented Not Implemented
502 Bad Gateway Gateway issue
503 Service Unavailable Self-explanatory

T-codes for OData Services

SEGW - Create OData Services
/IWFND/MAINT_SERVICE - Register and active the services
/IWFND/GW_CLIENT - Test Odata service
/IWFND/ERROR_LOG – Gateway Error Log
/IWBEP/ERROR_LOG - Backend Error Log
/IWFND/CACHE_CLEANUP – Cache Cleanup
/IWBEP/CACHE_CLEANUP – Cache Cleanup
/IWFND/TRACES - Traces

/iwfnd/gw_client-> More-> Metadata-> Clean up

128 | P a g e
Tcode- /IWFND/CACHE_CLEANUP

Class method -> /iwfnd/cl_sutil_moni=>cleanup_metadata_cache

129 | P a g e
/iwfnd/maint_service - Load Metadata

Change User Name to debug for a particular user, Utilities->Settings->Debugging

130 | P a g e
Cross Site Request Forgery (CSRF)
Cross site request forgery is an attack that tricks a web browser into executing an unwanted action in
application which a user has previously been logged, to protect from CSRF, SAP supports CSRF tokens.
Such a token can be requested which a HTTP GET request and must be sent with each HTTP POST
request.
CSRF token is applicable on HTTP protocol only and can be used to validate the session for a specific user
It is required when Odata Service is being called from third Party Application
If ~CHECK_CSRF_TOKEN parameter is disable then X-SCRF-TOKEN = ‘X’ is passed in the HTTP Header
Tcode – SICF, Parameter Name = ~CHECK_CSRF_TOKEN
Value = 1 -> Enable, 0 -> Disable

Enable CSRF Token

131 | P a g e
Navigate to default host-> sap -> opu -> odata -> sap -> select the required odata service

132 | P a g e
133 | P a g e
Get Request does not show X-CSRF token in the request or response headers

Before posting request

After posting request, X-CSRF token added in the request header.

134 | P a g e
135 | P a g e