Hands-On SAP OData and API Testing: CSRF Tokens, ETags, $batch and the SAP Business Accelerator Hub Sandbox

Keep this: job aid

SAP OData API testing cheat sheet

• Read $metadata first: keys, types, lengths, sap:filterable, sap:creatable, sap:updatable.
• Sandbox: api.sap.com, Show API Key, header APIKey, read-only sample data.
• Writes: GET with X-CSRF-Token: Fetch; send the token and the same cookies; 403 + "Required" means fetch again.
• Reads: $filter, $select, $expand, $orderby, $top/$skip; count with $inlinecount=allpages (V2) or $count=true (V4).
• Paging: follow __next (V2) or @odata.nextLink (V4) and compare with the count.
• Updates: GET the ETag (header, __metadata.etag or @odata.etag), send If-Match; 412 = changed, 428 = required. Avoid If-Match: *.
• $batch: multipart POST; change sets are atomic; outer 202 means nothing; assert every part.
• Errors: read error.code, message and all errordetails/details plus the sap-message header; on the system use /IWFND/ERROR_LOG, /IWBEP/ERROR_LOG, /IWFND/GW_CLIENT.
• Reusable tests: environments, token setup, data files, exact assertions, negative cases, cleanup, no secrets, evidence in SAP Cloud ALM.