---
title: SAP CMIS Setup
description: "FileRelay as a CMIS 1.1 client against SAP Document Management Service. Works on S/4HANA Cloud Public — no ABAP."
---

# SAP CMIS Setup

CMIS is an OASIS standard for document repositories. SAP exposes **Document Management Service (DMS)** via a CMIS 1.1 endpoint. FileRelay polls or subscribes, fetches new documents, and routes them.

> **Use CMIS when** you're on **S/4HANA Cloud Public Edition** (no other option) or on **Private Edition / RISE** and prefer pull over ArchiveLink push. See the [protocol comparison](/docs/sources/protocol-comparison) for the full matrix.

## SAP-side prerequisites

Four things from your Basis / BTP admin:

| Item | Where it comes from |
|---|---|
| **CMIS base URL** | DMS service key → `endpoints.dms_url` |
| **Repository ID** | List at `{base-url}/browser` — pick the one holding the documents you want |
| **OAuth client ID + secret** | Service key → `uaa.clientid` / `uaa.clientsecret` |
| **OAuth token URL** | Service key → `uaa.url` + `/oauth/token` |

The service key is generated when an admin creates a service instance of **`sdm`** in BTP cockpit (plan name varies — `standard`, `integration`).

If your tenant uses **Communication Arrangements** instead (typical for integrated S/4HANA Cloud):

1. **SAP Fiori → Communication Arrangements** → create one with template **`SAP_COM_0552`** (Document Management Service Integration).
2. Bind a Communication User + System as inbound.
3. Note the **Service Endpoint URL** (= CMIS base URL) and the **OAuth credentials**.

## Configure the source

1. **Repositories → Add Source → CMIS**.
2. Fill in: name, CMIS base URL, Repository ID, OAuth client ID / secret / token URL.
3. **Test connection** — FileRelay mints a token, queries the CMIS service document, validates.
4. Save.

Credentials are encrypted at rest. See the [Security page](/security) for the deeper architecture.

## How fetching works

### Polling (default, 60 s)

CMIS query for documents created or modified since the last poll:

```sql
SELECT * FROM cmis:document
WHERE cmis:lastModificationDate > TIMESTAMP '<last-poll-time>'
```

For each result, FileRelay fetches the binary via `cmis:contentStream` and forwards.

Polling works on every tenant. Right for moderate volume + few-seconds latency tolerance.

### Webhook / Event Mesh

If your tenant has **SAP Event Mesh** connected to DMS, FileRelay can subscribe to `sap.dms.DocumentCreated` + `sap.dms.DocumentVersionCreated` events. The endpoint is `https://<your-deployment-host>/cmis/<source-slug>/events`. Triggers immediate fetches — no polling lag.

If you're not sure whether Event Mesh is wired up, stay on polling.

## Authentication + rotation

UAA tokens are ~12 h. FileRelay refreshes automatically with the configured credentials.

- **OAuth secret rotation** — paste the new value; next token request uses it.
- **Service key regeneration** — plan rotation **before** the old key expires; the source starts failing the moment the old key is invalidated.

## Forwarded metadata

| CMIS property | Forwarded as |
|---|---|
| `cmis:name` | filename |
| `cmis:objectId` | source document ID (traceability) |
| `cmis:createdBy` | author |
| `cmis:creationDate` | source creation timestamp |
| `cmis:contentStreamMimeType` | MIME type |
| Custom (`sap:businessObjectKey`, etc.) | passed through verbatim, mapped to destination custom fields where supported |

Per-connection mapping in [Document Routing](/docs/connections/routing).

## Gotchas

- **Browser binding (JSON) over AtomPub (XML)** — FileRelay defaults to browser binding (`/browser`). Faster, simpler to debug, supported on every SAP DMS release.
- **Repository ID ≠ BTP service instance name** — get the repository ID from a CMIS-level `GET {base}/browser`, not from the BTP UI.
- **Pagination** — handled internally, but a poll interval shorter than the time to drain peak load causes lag accumulation. Tune to your peak document creation rate.
- **Permissions** — the principal needs **`DocumentDownload`** + **`DocumentRead`** scopes. Without them `getContentStream` returns 403 with no useful body.
- **No delete propagation by default** — when documents are deleted in DMS, FileRelay does **not** delete them from destinations. Once a document is routed, you own its lifecycle. Contact us if you need propagation.

## Troubleshooting

| Symptom | Likely cause |
|---|---|
| `401` from token URL | Wrong client ID/secret, or Communication User isn't bound as inbound |
| `404` on the service document | CMIS base URL wrong (missing `/browser`?) or DMS isn't provisioned on the tenant |
| Polling works, nothing picked up | Repository empty, or the OAuth principal lacks read on documents |
| Polling falls behind | Poll interval too long, or upstream rate-limited — switch to Event Mesh if available |

Raw CMIS request/response captures: [Request Viewer](/docs/api/request-viewer).

## Next steps

- [OData Setup](/docs/sources/odata) — alternative pull-based source
- [Protocol Comparison](/docs/sources/protocol-comparison)
- [Connections Overview](/docs/connections/overview)