Install
$ agentstack add skill-efeumutaslan-sap-skills-sap-ariba ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
SAP Ariba Procurement & Sourcing
Related Skills
sap-s4hana-extensibility— S/4HANA MM/procurement integration with Aribasap-event-mesh— Event-driven integration between Ariba and BTPsap-security-authorization— OAuth/certificate setup for Ariba APIs
Quick Start
Choose your integration approach:
| Scenario | API/Protocol | Authentication | |----------|-------------|----------------| | Procurement data extract | Ariba Open APIs (REST) | OAuth 2.0 client credentials | | Transactional documents | cXML over HTTPS | Shared secret | | Supplier management | Ariba SOAP APIs | Certificate-based | | S/4HANA integration | Cloud Integration Gateway (CIG) | SAP Integration Suite | | Custom UI extensions | Ariba Custom Forms | Ariba Developer Portal |
First API call — Procurement Reporting:
# Step 1: Get OAuth token
curl -X POST "https://api.ariba.com/v2/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id={{CLIENT_ID}}&client_secret={{CLIENT_SECRET}}"
# Step 2: Call Procurement API
curl -X GET "https://openapi.ariba.com/api/procurement-reporting/v2/prod/views/{{VIEW_ID}}" \
-H "Authorization: Bearer {{TOKEN}}" \
-H "apiKey: {{API_KEY}}" \
-H "X-ARIBA-NETWORK-ID: {{AN_ID}}"
Core Concepts
Ariba Solution Architecture
| Module | Purpose | Key Objects | |--------|---------|-------------| | Ariba Procurement | Requisitions, POs, Invoices | Requisition, PurchaseOrder, Invoice | | Ariba Sourcing | RFx, Auctions, Contracts | SourcingProject, SourcingRequest | | Ariba Contracts | CLM, compliance | Contract, ContractWorkspace | | Ariba Supplier Management | Qualification, risk | SupplierRegistration, Questionnaire | | Ariba Network | B2B transactions | cXML OrderRequest, InvoiceDetailRequest | | Ariba Spend Analysis | Spend visibility | SpendFact, SpendCategory |
API Landscape
- Open APIs (REST) — Reporting/analytics, paginated data extraction
- Operational APIs (REST) — CRUD on procurement documents
- SOAP APIs — Legacy supplier/sourcing integration
- cXML — B2B document exchange (PunchOut, OrderRequest, InvoiceDetail)
- CIG (Cloud Integration Gateway) — Mediated S/4HANA ↔ Ariba integration
cXML Protocol Essentials
- Envelope: `
→(auth) +//` - Authentication: SharedSecret in `` element
- PunchOut: Buyer catalog browsing on supplier site →
PunchOutSetupRequest→PunchOutOrderMessage - Document flow: OrderRequest → ConfirmationRequest → ShipNoticeRequest → InvoiceDetailRequest
Common Patterns
Pattern 1: cXML OrderRequest
{{BUYER_AN_ID}}
{{SUPPLIER_AN_ID}}
{{BUYER_AN_ID}}
{{SHARED_SECRET}}
SAP Ariba Procurement
5000.00
Main Warehouse
Finance Department
MAT-001
50.00
Office Supplies
EA
Pattern 2: Open API Data Extraction with Pagination
import requests
BASE_URL = "https://openapi.ariba.com/api/procurement-reporting/v2/prod"
API_KEY = "{{API_KEY}}"
TOKEN = "{{OAUTH_TOKEN}}"
REALM = "{{REALM_NAME}}"
headers = {
"Authorization": f"Bearer {TOKEN}",
"apiKey": API_KEY,
"Accept": "application/json"
}
def extract_requisitions(date_from, date_to):
"""Extract requisitions using Procurement Reporting API."""
all_records = []
page_token = None
while True:
params = {
"realm": REALM,
"filters": f'{{"createdDateFrom":"{date_from}","createdDateTo":"{date_to}"}}',
"limit": 100
}
if page_token:
params["pageToken"] = page_token
resp = requests.get(
f"{BASE_URL}/views/RequisitionLineItemFact",
headers=headers, params=params
)
resp.raise_for_status()
data = resp.json()
all_records.extend(data.get("Records", []))
page_token = data.get("PageToken")
if not page_token:
break
return all_records
Pattern 3: PunchOut Setup Request
{{SESSION_ID}}
https://buyer-app.example.com/punchout/return
CAT-001
Pattern 4: Operational API — Create Requisition
import requests
def create_requisition(token, api_key, realm, req_data):
"""Create purchase requisition via Operational API."""
url = f"https://openapi.ariba.com/api/procurement/v3/prod/requisitions"
headers = {
"Authorization": f"Bearer {token}",
"apiKey": api_key,
"Content-Type": "application/json"
}
payload = {
"realm": realm,
"Requisition": {
"Name": req_data["name"],
"Requester": {"UniqueName": req_data["requester"]},
"LineItems": [
{
"Description": item["description"],
"Quantity": item["quantity"],
"UnitPrice": {"Amount": item["price"], "Currency": "EUR"},
"Commodity": {"UniqueName": item["commodity_code"]},
"DeliverTo": item["deliver_to"]
}
for item in req_data["items"]
]
}
}
resp = requests.post(url, headers=headers, json=payload)
resp.raise_for_status()
return resp.json()
Pattern 5: CIG Integration with S/4HANA
S/4HANA MM ──► CIG Middleware ──► Ariba Network
│ │
PurchaseOrder (IDoc/OData) OrderRequest (cXML)
│ │
GoodsReceipt ◄── ShipNotice ◄──── ShipNoticeRequest
│ │
InvoiceVerification ◄───────────── InvoiceDetailRequest
CIG Configuration Checklist:
- Enable CIG add-on in Ariba realm administration
- Configure S/4HANA connection (RFC destination or OData service)
- Map S/4HANA company codes to Ariba buying organizations
- Set up document routing rules (PO → cXML, Invoice → IDoc)
- Activate number range mapping (Ariba doc ID ↔ S/4HANA doc number)
- Test with Ariba Integration Toolkit (ITK) before go-live
Pattern 6: Supplier API — Questionnaire Response
def submit_questionnaire_response(token, api_key, realm, supplier_id, questionnaire_id, answers):
"""Submit supplier qualification questionnaire."""
url = f"https://openapi.ariba.com/api/supplier-management/v1/prod/questionnaires/{questionnaire_id}/responses"
headers = {
"Authorization": f"Bearer {token}",
"apiKey": api_key,
"Content-Type": "application/json"
}
payload = {
"realm": realm,
"supplierId": supplier_id,
"answers": [
{"questionId": a["id"], "value": a["value"]}
for a in answers
]
}
resp = requests.post(url, headers=headers, json=payload)
resp.raise_for_status()
return resp.json()
Error Catalog
| Error / HTTP Status | Message | Root Cause | Fix | |---------------------|---------|------------|-----| | 401 Unauthorized | Invalid token | OAuth token expired or wrong credentials | Refresh token; check client_id/secret | | 403 Forbidden | Realm access denied | API key not authorized for realm | Verify API key ↔ realm mapping in Ariba Developer Portal | | 404 Not Found | View not found | Wrong view name in reporting API | Check available views in API documentation | | 429 Too Many Requests | Rate limit exceeded | API throttling (varies by endpoint) | Implement exponential backoff; batch requests | | 500 Internal Server Error | Server error | Ariba platform issue | Retry with backoff; check Ariba system status | | cXML 400 | Parsing error | Malformed cXML or wrong DTD | Validate against cXML DTD; check encoding | | cXML 401 | Authentication failed | Wrong SharedSecret or domain | Verify credentials in Ariba Network admin | | cXML 406 | Not Acceptable | Document rejected by business rules | Check Ariba transaction rules configuration | | CIG sync error | Document mapping failed | Missing field mapping in CIG config | Review CIG mapping rules; check mandatory fields | | REALM_NOT_CONFIGURED | Realm not found | Integration not set up for realm | Complete realm setup in Ariba Developer Portal |
Performance Tips
- Use reporting APIs for bulk data — Operational APIs are for single-document CRUD; reporting APIs handle millions of records with pagination
- Batch cXML documents — Use
BatchOrderRequestfor multiple POs in one transmission - Cache OAuth tokens — Tokens are valid for 20 minutes; don't request a new token per API call
- Filter at API level — Use
filtersparameter to narrow date ranges; avoid client-side filtering - Async for large extracts — Use asynchronous job API for views with >100K records
- CIG scheduling — Schedule CIG sync during off-peak hours; configure retry intervals for failed docs
- PunchOut session timeout — Default 30 min; extend via
Extrinsicelement if supplier catalogs are large - Monitor API quotas — Each API has daily/hourly limits; track usage via response headers
Gotchas
- Realm vs. site: API calls require realm name (e.g.,
mycompany-Tfor test), not site URL - cXML DTD validation: Many Ariba endpoints validate against DTD — missing optional elements can cause
406 - API versioning: Open APIs use URL versioning (
/v2/); always specify version explicitly - Timezone handling: cXML timestamps must include timezone offset; UTC recommended
- CIG vs. direct integration: CIG handles transformations but adds latency; for real-time needs, use direct cXML
- Ariba Network ID format:
AN01234567890— always 14 characters withANprefix
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: efeumutaslan
- Source: efeumutaslan/SAP-SKILLS
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.