Skip to main content

Connect SAP SuccessFactors to Metaintro

Register Metaintro as an OAuth client in SAP SuccessFactors so people who choose to share with you arrive as candidates and applications in Recruiting.

Employers

Paste it into Claude, ChatGPT, Codex, Cursor or Pi.

Before you start

You need a SuccessFactors administrator who can:

  • Register OAuth client applications. SAP calls this permission Manage Integration Tools > Manage OAuth2 Client Applications.

  • Edit permission roles in Admin Center > Manage Permission Roles.

You need SAP SuccessFactors Recruiting. You also need OpenSSL, or another tool that makes an X.509 certificate, on your own computer.

You will paste five things into Metaintro:

  • Your API server

  • Your company ID

  • The API key of the client application you register

  • The user ID of the SuccessFactors user Metaintro acts as

  • The private key that matches the certificate you register

Create the credential in SuccessFactors

These steps follow SAP's SAP SuccessFactors API Reference Guide. The page numbers below are in that guide.

1. Choose the API user. Pick or create a SuccessFactors user that Metaintro will act as. A user only for Metaintro makes its changes easy to spot. SAP's guide does not name the menu for creating users, so use the user setup you normally use. Note the user ID.

2. Give the user's role its permissions. In Admin Center > Manage Permission Roles, open the role the API user has. Under User Permissions > Recruiting Permissions, turn on:

  • OData API Requisition Export

  • OData API Candidate Export, OData API Candidate Create and OData API Candidate Update

  • OData API Application Export, OData API Application Create and OData API Application Update

  • OData API Application Audit Export (SAP lists it for application comments, where Metaintro adds the proof card)

  • OData API Application Create and Update Validation Bypass for Required Fields, if your application templates have required fields that Metaintro does not fill

SAP lists these on the JobApplication, Candidate and JobRequisition pages of the guide.

3. Make your own key pair. On your computer, run SAP's example command (page 22):

openssl req -nodes -x509 -sha256 -newkey rsa:2048 -keyout private.pem -out public.pem

Fill in at least one of the questions it asks, such as Common Name. This makes two files:

  • public.pem is the certificate. You upload it to SuccessFactors.

  • private.pem is the private key. You paste it into Metaintro.

Keep private.pem safe and do not email it or share it. Keep -nodes in the command: Metaintro cannot use a key protected with a passphrase. SAP also lets you generate a certificate inside SuccessFactors, but it advises against that because it means downloading the private key.

4. Register the client application (page 19).

  1. Go to Admin Center > API Center > OAuth Configuration for OData and choose Register Client Application. You can also search for Manage OAuth2 Client Applications in Action Search.

  2. In Application Name, enter a unique name, such as Metaintro.

  3. In Application URL, enter https://www.metaintro.com. SAP uses it only to identify the application.

  4. Bind to Users is optional. If you turn it on, enter the API user's ID in User IDs.

  5. In X.509 Certificate, paste the contents of public.pem without the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. SAP shows an error if you include them.

  6. Choose Register.

  7. In the list of registered applications, choose View and copy the API key.

5. Find your company ID. Select your user icon at the top right and choose Show version information. The company ID is in the window that opens (SAP KBA 2655655). It is case-sensitive.

6. Find your API server. Look up your data center in SAP's List of SAP SuccessFactors API Servers (page 7). Production, preview and sales demo instances have different API servers. You need the host only, for example api4.successfactors.com.

Connect in Metaintro

  1. In Metaintro, go to Settings > Integrations.

  2. Choose SAP SuccessFactors Recruiting.

  3. In API server, enter your API server, such as api4.successfactors.com.

  4. In Company ID, enter your company ID exactly as shown.

  5. In OAuth API key, paste the API key from step 4.

  6. In API user ID, enter the API user's ID.

  7. In Private key, paste the whole of private.pem.

  8. Select Connect.

Metaintro signs in to check the details, then you map your jobs, set your rules, check the preview and go live.

What Metaintro sends and reads

Metaintro only sends people who chose to share their profile with you for a specific job.

  • Jobs: Metaintro reads your job requisitions, with their title, status and location, so you can map them.

  • Candidate: Metaintro first looks for a candidate whose primary email is exactly the person's email. If there is one, it uses that candidate. If there is more than one, it stops rather than guess. Otherwise it creates a candidate with their first name, last name, primary email and phone.

  • Application: Metaintro applies the candidate to the mapped requisition. If they already have an application on it, Metaintro uses that one.

  • Résumé: attached to the new application when the person has one.

  • Proof card: a comment on the application with a link to their proof card and their summary.

  • Stages: Metaintro checks each application's status regularly. SuccessFactors does not notify Metaintro of changes. Hired, disqualified and withdrawn applications are recognised.

  • Stage moves: when Metaintro moves a candidate, it picks the status with the matching name from the statuses that applications on the same requisition already have.

Limits

  • Metaintro cannot create a candidate without an email address.

  • Metaintro does not set the application's source field. The proof card comment shows the person came through Metaintro.

  • Stage moves only use statuses that some application on the same requisition already has. If none matches, the move is skipped.

  • SuccessFactors sends the emails you set up for status changes when Metaintro moves an application, as it does for changes made by people.

  • If your application template requires fields Metaintro does not fill, applications fail until the API user's role has the required-field bypass permission.

  • SAP limits API calls per tenant, and the limit is shared with your other integrations. Metaintro paces its calls and waits when SuccessFactors says the limit is reached.

  • If you change or regenerate the certificate, the connection stops working until you paste the new private key in Metaintro.

If something goes wrong

  • SuccessFactors refuses the connection: check that the company ID is exact, that the API server is the one for your data center, that the private key belongs to the certificate you registered, and that the API key is from that same application. If Bind to Users is on, make sure the API user is listed. Make sure the API user is active.

  • Your instance restricts API access by IP address: SAP applies Admin Center > IP Restriction Management and Admin Center > Password & Login Policy Settings > Set API login exceptions to sign-in. Contact Metaintro support for the addresses to allow.

  • Access is refused, or jobs or candidates are missing: check the Recruiting Permissions on the API user's role in Manage Permission Roles.

  • Applications fail: your application template probably has required fields. Give the role the required-field bypass permission, or make those fields optional.

  • Too many requests: SuccessFactors has paused calls for a while. Metaintro waits and tries again by itself.

  • A stage move is skipped: no application on that requisition has a status with a matching name yet. Move the candidate in SuccessFactors.

Was this article helpful?

Related Articles

Return to navigation