API Tokens: Issue, Expire, Revoke addresses a problem most SAP landscapes know too well: Speed without masking and tokens invites data incidents that erase savings.
Security spans field/row rules in REP, masking rule sets, API tokens and IP lists, rate limits, certificate upload, and trace — Zero Trust applied to integration, not bolted on after go-live.
Masking preview and audit trails show what left the building; API Assign Users limits Basic Auth callers to named accounts.
Capabilities you use in iDataEngine
- Masking rule sets import/export
- Certificate upload validation
- IP allow/block lists
- Rate limit per minute/hour
- Secure mail recipient resolution
- Response size and save limits
Recommended workflow
- Enable monitoring alerts and review dashboard KPIs for the first production cycle.
- Open the relevant cockpit (iDataView Explorer, SQL Project, API Service Detail, or AccessGuard).
- Run Test (iDataView Test, SQL First Row, API Test Service, or AG scan) before scheduling or publishing.
- Extend the same definition to the next channel (API, SQL, MF, BI) without redesigning from scratch.
Real-world scenario (2018)
Payroll columns masked in SQL Transfer and omitted from API fieldset — same policy, two channels, one rule set.
Why it matters
Trust is a feature: customers integrate faster when IP lists, rate limits, and audit trails are demonstrable.
The competitive edge is not more developers; it is removing wait states between idea, data, and delivery.