API Data Encryption in SAP PI/PO –
Complete Implementation Guide
1. Introduction
This guide explains how to implement secured API integrations in SAP PI/PO using
Transport-Level Security (HTTPS), Message-Level Encryption (PGP, AES), and Digital
Signatures. It includes step-by-step configuration, Java mapping code, PGP module setup,
and testing scenarios.
2. Transport-Level Security (HTTPS)
Steps to enable HTTPS in SAP PI/PO:
1. 1. Go to NWA → Configuration → Security → Certificates and Keys
2. 2. Import SSL certificates of external systems
3. 3. Configure HTTP_AAE or REST Adapter to use https:// endpoints
4. 4. Use Basic Authentication or Client Certificate Authentication
3. PGP Encryption in PI/PO
Steps to configure PGP encryption/decryption:
5. 1. Install PGP Adapter Module (part of B2B Add-on)
6. 2. Import public/private keys in NWA Key Storage
7. 3. Configure module in Communication Channel (localejbs/PGPEncryption or
PGPDecryption)
Example Module Configuration:
Parameter Value
publicKeyRing /usr/sap/keys/public.asc
4. Custom Java Mapping (AES Encryption)
Use the following Java class for AES encryption/decryption:
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
public class AESEncryptionMapping {
public static String encrypt(String plainText, String secretKey) throws Exception {
SecretKeySpec key = new SecretKeySpec(secretKey.getBytes("UTF-8"), "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.ENCRYPT_MODE, key);
byte[] encrypted = cipher.doFinal(plainText.getBytes());
return Base64.getEncoder().encodeToString(encrypted);
}
public static String decrypt(String encryptedText, String secretKey) throws Exception {
SecretKeySpec key = new SecretKeySpec(secretKey.getBytes("UTF-8"), "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.DECRYPT_MODE, key);
byte[] original = cipher.doFinal(Base64.getDecoder().decode(encryptedText));
return new String(original);
}
}
5. Key Management
✔ Store keys in NWA Key Storage, not hardcoded in mappings
✔ Rotate keys periodically
✔ Use separate keys for DEV/QA/PROD
6. End-to-End Flow Diagram
[Insert Diagram Here: External Client → HTTPS → PI/PO → Encryption → API Server]
7. Postman Testing
Steps to test:
1. Prepare encrypted payload
2. Send HTTPS request to PI/PO endpoint
3. Check logs in Message Monitor
4. Verify decrypted payload at receiver side
8. Best Practices
✔ Use HTTPS + Payload Encryption
✔ Avoid logging sensitive data
✔ Test thoroughly in non-production
✔ Apply message integrity checks
