XovityBlueprint AI

Pre-Connection Checklist

Share this with your Basis, Security, Network and Azure AD teams before adding a tenant. Having every item ready makes the connection succeed on the first attempt.

Go to Connect
Xovity Blueprint AI performs read-only scans over OData. No write transactions, no master-data changes, and credentials are encrypted at rest with pgcrypto.

SAP S/4HANA (Public, Private Cloud / RISE, On-prem)

System & endpoint details

Owner: SAP Basis
  • System ID (SID) and environment
    EGPRD — Production
  • Base Host URL of the OData gateway
    https://my300123-api.s4hana.cloud.sap
  • Confirmation OData v2 services are activated
    /sap/opu/odata/sap/* must respond to $metadata
  • Edition (Public Cloud / Private Cloud / On-prem RISE)

OAuth 2.0 credentials

Owner: SAP Security / BTP admin
  • Client ID issued via SOAUTH2 or BTP Service Key
  • Client Secret (paste once; stored encrypted)
  • Token URL
    https://<tenant>.authentication.<region>.hana.ondemand.com/oauth/token
  • Grant type: client_credentials
    User-propagation flows are not used for read-only scans
  • Scopes / role collection granting read access to API_* services

Network & allow-list

Owner: Network / Firewall
  • Outbound HTTPS reachable from Xovity scanner egress IPs
  • TLS 1.2+ enabled; valid public certificate (no self-signed)
  • For Private Cloud / RISE: Cloud Connector or reverse proxy exposing OData externally

Authorisations (read-only)

Owner: SAP Security
  • Technical/communication user mapped to the OAuth client
  • Read access on the modules in scope (FI, CO, MM, WM, SD, PM, PS)
  • No write/transaction authorisations required

Microsoft Dynamics 365

Environment details

Owner: D365 admin
  • Environment URL
    https://contoso.crm.dynamics.com
  • Region and environment type (Prod / Sandbox)

Azure AD app registration

Owner: Azure AD admin
  • Tenant ID (GUID)
  • Application (Client) ID
  • Client Secret (value, not the secret ID)
  • API permission: Dynamics CRM user_impersonation (admin-consented)
  • Application user created inside D365 with a read-only security role

Network

Owner: Network
  • Outbound HTTPS to login.microsoftonline.com and *.dynamics.com