# How the connection works

## How the connection works
- **Standard APIs.** Mercura uses SAP's released OData v2 APIs from the SAP
Business Accelerator Hub, the same in every S/4HANA system. Your own fields
(`YY1_…`, `ZZ1_…`) are supported as long as they are added to these APIs.
- **Authentication.** Mercura signs in at SAP Gateway with the technical
user's name and password (Basic authentication) and, before it writes, fetches
the CSRF token SAP requires. Mercura stores the password encrypted and never
shows it again.
- **Pulls.** On the schedule you choose, Mercura reads what changed since the
last pull, and everything once a week. Business partners record their
change date as a day, so Mercura reads the day of the last pull again;
changes to an address or a customer record alone do not change it and are
caught by the weekly pull. The first pull reads everything.
- **Documents.** When an order or a tender is completed in Mercura, Mercura
creates the sales order or sales quotation in one call and stores the SAP
document number it gets back. The number is shown on the request and can
link to the document in SAP Fiori.
- **Network.** Mercura calls SAP Gateway over HTTPS from the internet. If your
system is only reachable internally, publish the OData services through a
reverse proxy or SAP Web Dispatcher. If your firewall admits only known
addresses, ask your Mercura contact for Mercura's outbound IP addresses.
- **Certificate.** If SAP Gateway uses a certificate of an internal or
self-signed CA, Mercura shows its SHA-256 fingerprint on the connection, and
you trust exactly this certificate after comparing it with your IT. If the
server later presents another certificate, Mercura pauses the connection and
sends nothing until you check and trust the new one.

Version: 1.79.2

## Description:

  - `How the connection works` ()
    - **Standard APIs.** Mercura uses SAP's released OData v2 APIs from the SAP
Business Accelerator Hub, the same in every S/4HANA system. Your own fields
(`YY1_…`, `ZZ1_…`) are supported as long as they are added to these APIs.
- **Authentication.** Mercura signs in at SAP Gateway with the technical
user's name and password (Basic authentication) and, before it writes, fetches
the CSRF token SAP requires. Mercura stores the password encrypted and never
shows it again.
- **Pulls.** On the schedule you choose, Mercura reads what changed since the
last pull, and everything once a week. Business partners record their
change date as a day, so Mercura reads the day of the last pull again;
changes to an address or a customer record alone do not change it and are
caught by the weekly pull. The first pull reads everything.
- **Documents.** When an order or a tender is completed in Mercura, Mercura
creates the sales order or sales quotation in one call and stores the SAP
document number it gets back. The number is shown on the request and can
link to the document in SAP Fiori.
- **Network.** Mercura calls SAP Gateway over HTTPS from the internet. If your
system is only reachable internally, publish the OData services through a
reverse proxy or SAP Web Dispatcher. If your firewall admits only known
addresses, ask your Mercura contact for Mercura's outbound IP addresses.
- **Certificate.** If SAP Gateway uses a certificate of an internal or
self-signed CA, Mercura shows its SHA-256 fingerprint on the connection, and
you trust exactly this certificate after comparing it with your IT. If the
server later presents another certificate, Mercura pauses the connection and
sends nothing until you check and trust the new one.