SAP Business One Integration

The SAP Business One Service Layer is an OData REST API with session login. Clients log in through Portway and send the B1SESSION cookie on later requests; Portway controls which clients reach the Service Layer.

Endpoint ​

{
  "Url": "https://sap-server:50000/b1s/v1",
  "Methods": ["GET", "POST", "PATCH", "DELETE"],
  "SupportsOData": true,
  "AllowedEnvironments": ["prod"]
}

Paths after the endpoint name are appended to Url. One endpoint serves Login, Items, Orders and the other Service Layer resources. Each integration uses its own SAP B1 user with minimal authorizations.

Requests ​

POST /api/prod/SapB1/ServiceLayer/Login
Authorization: Bearer YOUR_PORTWAY_TOKEN
Content-Type: application/json

{ "CompanyDB": "SBODEMOUS", "UserName": "integration01", "Password": "SAP_B1_PASSWORD" }

GET /api/prod/SapB1/ServiceLayer/Items?$filter=ItemsGroupCode eq 100&$top=20
Authorization: Bearer YOUR_PORTWAY_TOKEN
Cookie: B1SESSION=...

Sessions expire after about 30 minutes; a 401 from the Service Layer requires a new login.

Limitations ​

• The login body contains the SAP password. IncludeRequestBodies in traffic logging stays off for this endpoint.
• OData parameters are passed to the Service Layer without translation.
• All resources share one endpoint; access is limited by SAP B1 authorizations.

Troubleshooting ​