> For the complete documentation index, see [llms.txt](https://docs.userlane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.userlane.com/administration/attributes/connect-an-attribute-source/sap-successfactors.md).

# SAP SuccessFactors

How to connect SAP SuccessFactors as an attribute source, including the permissions needed, setup steps, and the values to enter in Userlane.

This page walks through connecting SAP SuccessFactors so that Userlane can read employee information from your human resources (HR) system automatically. By the end, SuccessFactors appears as a connected attribute source and your user data begins syncing.

SuccessFactors is usually the most complete and most authoritative source of employee information in an organization. It also asks for more than most sources: an application registered in SuccessFactors, a certificate, and a separate permission grant. Set aside a session with your SuccessFactors administrator rather than collecting the values piecemeal.

{% hint style="warning" %}
**Prerequisites.** You need a SuccessFactors administrator with permission to manage OAuth2 client applications, and an application programming interface (API) user[^1] whose role-based permissions allow reading employee data. On the Userlane side, you need an **Admin**, **Portfolio Owner**, or **Deployment Manager** role.
{% endhint %}

## What Userlane reads from SuccessFactors

Userlane matches SuccessFactors against its standard set of attributes, the same set it uses for every source. See [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md) for the full list.

Three things follow from that:

* Anything SuccessFactors holds that is not in Userlane's set is dropped rather than stored. SuccessFactors holds a great deal more than Userlane asks for, so most of it is never taken.
* Anything in Userlane's set that SuccessFactors does not hold, or does not fill in, stays empty.
* Attributes are applied to people who already exist in Userlane. An employee in SuccessFactors who has never used Userlane is ignored, not created.

The connection is read-only. Userlane never writes to SuccessFactors and never changes anything in it.

## Who you need

**To register the application:** a SuccessFactors administrator with permission to manage OAuth2 client applications.

**To read employee records:** an API user whose role-based permissions allow reading employee data.

{% hint style="warning" %}
**These are two separate things, and missing the second is the most common problem with this connector.** Registering the application produces working credentials. It does not, on its own, grant permission to read anybody's record. If the permission grant is missing, the connection authorizes successfully and returns nothing at all. Nothing reports an error.
{% endhint %}

If you have connected and no information has appeared after a day, this is the first thing to check.

## Register the client application

{% stepper %}
{% step %}

#### Open the OAuth2 client application manager

In SuccessFactors, open the **Admin Center** and go to the OAuth2 client application manager.
{% endstep %}

{% step %}

#### Register a new client application

The application name can be anything you will recognize later. The application URL is not used, so any valid address is fine.
{% endstep %}

{% step %}

#### Generate a certificate and copy the private key

Generate an X.509 certificate[^2] and copy it. Download the private key file, open it, and copy the key from inside.
{% endstep %}

{% step %}

#### Note the API key

The API key is shown above the certificate on the same screen.
{% endstep %}
{% endstepper %}

The private key file is sensitive. Handle it the way you would handle a password, and delete the downloaded file once the connection is made.

## Grant the API user permission to read employee records

The account behind the application also needs role-based permission to read employee data. Your SuccessFactors administrator grants this.

## Find the values Userlane asks for

<table><thead><tr><th width="185.0693359375">Userlane asks for</th><th>Where to find it</th></tr></thead><tbody><tr><td><strong>API server</strong></td><td>Depends on which SuccessFactors data center hosts your instance. SAP publishes a lookup table matching tenant domains to API servers</td></tr><tr><td><strong>Username</strong></td><td>Shown in brackets underneath your profile image in SuccessFactors</td></tr><tr><td><strong>Company ID</strong></td><td>Shown under the version information option in the same profile menu</td></tr><tr><td><strong>API key</strong></td><td>On the client application screen, above the certificate</td></tr><tr><td><strong>Private key</strong></td><td>Inside the private key file you downloaded</td></tr></tbody></table>

## Connect in Userlane

{% stepper %}
{% step %}

#### Open Attribute sources

In the portal, go to **Attribute sources** under company settings.
{% endstep %}

{% step %}

#### Select SAP SuccessFactors and enter the values

Select **SAP SuccessFactors** and enter the API server, username, company ID, API key, and private key.
{% endstep %}
{% endstepper %}

Once connected, SuccessFactors appears under connected sources. SuccessFactors can take up to fifteen minutes to accept a newly created connection, and you may see an authorization error during that window. This does not mean the setup is wrong, so wait and check again before changing anything. For troubleshooting, see [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md).

## Testing before production

If you have a non-production SuccessFactors instance, connecting that first lets both sides confirm the field mapping before any production data is involved. Userlane only reads, in test and in production alike, and demo or anonymized records are sufficient as long as the field structure matches your live tenant.

## Relevant articles

{% content-ref url="/pages/5RV9H7dUyIbkTHBrF8Av" %}
[Connect an attribute source](/administration/attributes/connect-an-attribute-source.md)
{% endcontent-ref %}

{% content-ref url="/pages/heUmxS6HxlGKqCQSjqbs" %}
[Attribute sources](/administration/attributes/attribute-sources.md)
{% endcontent-ref %}

{% content-ref url="/pages/dOsfp2lveEGwAS8a7Pkt" %}
[ServiceNow](/administration/attributes/connect-an-attribute-source/servicenow.md)
{% endcontent-ref %}

{% content-ref url="/pages/b1SMRSBtvkd1sZZNi9U4" %}
[Salesforce](/administration/attributes/connect-an-attribute-source/salesforce.md)
{% endcontent-ref %}

## FAQ

<details>

<summary>Why did the connection succeed but no data appeared?</summary>

The most common cause is a missing permission grant. Registering the OAuth2 client application does not automatically grant permission to read employee records. Your SuccessFactors administrator needs to grant role-based permission separately.

</details>

<details>

<summary>Why is the manager flag empty for SuccessFactors users?</summary>

SuccessFactors returns the manager's person ID rather than a yes or no value for whether someone manages others. The manager flag cannot be populated from this source.

</details>

<details>

<summary>Does Userlane write anything back to SuccessFactors?</summary>

No. The connection is read-only. Userlane never creates, updates, or deletes anything in SuccessFactors.

</details>

[^1]: An API user is the SuccessFactors account that Userlane's requests run as. Its permissions decide which employee records Userlane can read.

[^2]: An X.509 certificate is a standard digital certificate that SuccessFactors uses to verify that requests really come from the registered application.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.userlane.com/administration/attributes/connect-an-attribute-source/sap-successfactors.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.