---
title: "Connect SAP HANA to ChatGPT: Manage identity and group access"
slug: connect-sap-hana-to-chatgpt-manage-identity-and-group-access
date: 2026-10-13
author: Riya Sethi
categories: ["AI & Agents"]
excerpt: Learn how to connect SAP HANA to ChatGPT using Truto's managed MCP server. Automate SCIM 2.0 user provisioning and group access with zero custom integration code.
tldr: "Connect SAP HANA to ChatGPT via Truto's auto-generated MCP servers. This guide shows how to handle SCIM 2.0 schemas, execute partial updates, and orchestrate identity workflows."
canonical: https://truto.one/blog/connect-sap-hana-to-chatgpt-manage-identity-and-group-access/
---

# Connect SAP HANA to ChatGPT: Manage identity and group access


If you need to connect SAP HANA to ChatGPT to automate user provisioning, manage SAP Cloud Identity Services, or orchestrate group access, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and SAP HANA's SCIM 2.0 API. You can either build and maintain this SCIM translation infrastructure yourself (see our guide on [how to build ERP integrations without storing data](https://truto.one/blog/how-to-build-erp-integrations-netsuite-sap-without-storing-data/)), or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on [connecting SAP HANA to Claude](https://truto.one/blog/connect-sap-hana-to-claude-automate-user-directory-provisioning/) or explore our broader architectural overview on [connecting SAP HANA to AI Agents](https://truto.one/blog/connect-sap-hana-to-ai-agents-orchestrate-scim-lifecycles/).

Giving a Large Language Model (LLM) read and write access to SAP Cloud Identity Services is a complex engineering task. You have to handle deeply nested SCIM extension payloads, exact `PatchOp` syntax requirements, and strict pagination models. Every time you want to expose a new capability, you have to write, deploy, and maintain custom MCP tool schemas.

This guide breaks down exactly how to use Truto to generate a secure, managed SAP HANA MCP server, connect it natively to ChatGPT, and execute complex identity management workflows using natural language.

> Stop writing boilerplate SCIM integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds.
>
> [Talk to us](https://truto.one/book-a-demo/)

## The Engineering Reality of the SAP HANA API

A custom MCP server is essentially a self-hosted integration layer. While the open MCP standard provides a predictable way for models like GPT-4 to discover tools, implementing it against SAP HANA's Cloud Identity Services is exceptionally painful (see how it compares to other platforms in our [NetSuite vs SAP guide](https://truto.one/blog/netsuite-vs-sap-for-ai-agents-the-2026-erp-integration-guide/)) due to its reliance on the SCIM (System for Cross-domain Identity Management) 2.0 specification.

If you decide to build a custom SAP HANA MCP server, you own the entire API lifecycle. Here are the specific integration challenges you will face:

### The SCIM PatchOp Complexity
Unlike a typical REST API where you might send a simple `PUT /users/123` with `{ "active": false }`, SAP HANA requires strict adherence to the SCIM 2.0 Patch protocol. To deactivate a user, your MCP server must instruct the LLM to format the payload exactly like this:

```json
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}
```

LLMs are notoriously bad at spontaneously generating complex, nested schema envelopes. Without rigorous JSON Schema definitions injected into the MCP tool descriptions, ChatGPT will hallucinate standard REST updates, resulting in immediate HTTP 400 Bad Request errors from SAP.

### SAP-Specific Extension Attributes
SAP HANA does not just use standard SCIM fields (`userName`, `name`, `emails`). It heavily relies on enterprise extensions, specifically `urn:ietf:params:scim:schemas:extension:sap:2.0:User` and `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`. If your AI agent needs to assign an employee number or trigger a welcome email via the `sendMail` flag, the MCP tool schema must correctly map these nested URIs. 

### Complex Filtering and Pagination
When an LLM wants to search for an SAP group by name, it must pass a specific SCIM filter syntax in the query parameter, such as `displayName eq "Admins"`. Furthermore, SAP HANA uses `startIndex` and `count` for pagination, rather than `page` or `cursor`. If you build this yourself, you have to teach the LLM how to increment `startIndex` mathematically across multiple tool calls to page through large directories.

## How Truto Solves SAP HANA Tool Generation

Truto eliminates these hurdles through dynamic, documentation-driven tool generation. When you connect an SAP HANA account, Truto inspects the integration's resource definitions and automatically derives the necessary MCP tools. 

When ChatGPT calls a tool, it sends a flat JSON object of arguments. Truto's MCP router dynamically splits these arguments into query parameters (like the SCIM filter or `startIndex`) and body parameters (like the `Operations` array) based on the underlying schemas. It handles the request to SAP HANA, normalizes the SCIM response, and returns the result back to the LLM.

```mermaid
sequenceDiagram
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP Router
    participant SAP as SAP HANA (SCIM)
    
    ChatGPT->>Truto: Call sap_hana_users_partial_update(id, Operations)
    Truto->>Truto: Split flat arguments into Query & Body
    Truto->>Truto: Inject authentication & metadata
    Truto->>SAP: PATCH /service/scim/Users/{id} (PatchOp payload)
    SAP-->>Truto: 200 OK (Updated User Resource)
    Truto-->>ChatGPT: JSON-RPC Result
```

## Step 1: Create the SAP HANA MCP Server

An MCP server in Truto is scoped to a single integrated account. This means the server URL contains a cryptographic token encoding the specific SAP HANA tenant, the tools exposed, and the authentication state. 

You can create this server via the Truto UI or programmatically via the API.

### Method 1: Via the Truto UI
1. Navigate to the **Integrated Accounts** page in your Truto dashboard.
2. Select your connected SAP HANA instance.
3. Click the **MCP Servers** tab.
4. Click **Create MCP Server**.
5. Select the desired configuration (e.g., allow `read` and `write` methods, filter by `users` tags).
6. Copy the generated MCP server URL. It will look like `https://api.truto.one/mcp/a1b2c3d4...`.

### Method 2: Via the Truto API
If you are dynamically provisioning AI agents for your customers, you can generate MCP servers programmatically. 

Make a `POST` request to the `/integrated-account/:id/mcp` endpoint:

```bash
curl -X POST https://api.truto.one/integrated-account/<YOUR_INTEGRATED_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer <YOUR_TRUTO_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "SAP HANA Identity Manager for ChatGPT",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["users", "groups"]
    }
  }'
```

The API validates the SAP HANA connection, generates a secure, hashed token, and returns the URL. Treat this URL as a secret - it contains routing and authentication routing for that specific SAP instance.

## Step 2: Connect the MCP Server to ChatGPT

Once you have your Truto MCP server URL, you must register it with ChatGPT. 

### Method 1: Via the ChatGPT UI (Custom Connectors)
If you are on a ChatGPT Plus, Pro, Team, or Enterprise plan with Developer Mode enabled:
1. Open ChatGPT and go to **Settings -> Apps -> Advanced settings**.
2. Enable **Developer mode**.
3. Under **MCP servers / Custom connectors**, click **Add new server**.
4. Enter a name (e.g., "SAP HANA via Truto").
5. Paste the Truto MCP URL into the **Server URL** field.
6. Click **Save**.

ChatGPT will perform the MCP initialization handshake and instantly discover the SAP HANA tools.

### Method 2: Via Manual Config File (Claude Desktop / Local Agents)
If you are testing locally or using an agent framework that relies on the standard `mcp_config.json` file (common in Claude Desktop or local LangChain setups), you can use the official `@modelcontextprotocol/server-sse` transport.

Add this to your configuration file:

```json
{
  "mcpServers": {
    "sap-hana-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/<YOUR_TOKEN>"
      ]
    }
  }
}
```

Restart your client, and the tools will be immediately available.

## Security and Access Control

Giving an LLM write access to an enterprise identity directory requires strict guardrails. Truto provides several mechanisms to secure your SAP HANA MCP server, adhering to a [zero-data retention architecture](https://truto.one/blog/zero-data-retention-ai-agent-architecture-connecting-to-netsuite-sap-and-erps-without-caching/):

*   **Method Filtering:** By passing `config: { methods: ["read"] }` during creation, you ensure the LLM can only execute `GET` requests (e.g., auditing users). It is physically impossible for the model to accidentally invoke a `DELETE` or `PATCH` operation.
*   **Tag Filtering:** Restrict the server to specific operational domains. Use `config: { tags: ["groups"] }` to allow group management while keeping user profile creation completely out of scope.
*   **Expiration (TTL):** Set an `expires_at` ISO datetime. Truto will automatically tear down the MCP server and revoke the token at the exact minute specified, which is ideal for temporary contractor access or limited-time audit workflows.
*   **Require API Token Auth:** By setting `require_api_token_auth: true`, possession of the MCP URL is no longer enough. The connecting client must also pass a valid Truto API token in the Authorization header, adding a mandatory second layer of authentication.

## Hero Tools for SAP HANA

Truto automatically generates highly descriptive snake_case tools based on the SAP HANA integration schemas. Here are the highest-leverage tools available to ChatGPT.

### list_all_sap_hana_users
Executes `GET /service/scim/Users` to return a paginated list of SCIM user resources. This includes core attributes, SAP extension attributes, and group memberships. The tool schema natively instructs the LLM on how to construct valid SCIM filter expressions.

> "Audit the SAP Cloud Identity directory. Find all users where the active status is true but they haven't logged in for 90 days. Give me a table of their names and emails."

### get_single_sap_hana_user_by_id
Fetches the complete SCIM resource for a specific user using their UUID. This is critical for reading a user's exact state before attempting a full replacement update, ensuring that omission of optional fields doesn't inadvertently clear them.

> "Pull the complete SAP HANA profile for the user ID 8f72b-11c... What department and manager are listed in their enterprise extension attributes?"

### create_a_sap_hana_user
Executes `POST /service/scim/Users` to provision a new identity. The schema forces the LLM to provide the required `userName` and at least one email, while optionally setting the SAP extension `sendMail` flag to true to trigger the welcome flow.

> "Provision a new SAP HANA user for Jane Doe (jane.doe@company.com). Set her userType to 'Contractor' and make sure the SAP extension flag is set to send her an activation email immediately."

### sap_hana_users_partial_update
Executes a `PATCH` request using the SCIM PatchOp specification. This is the safest way to modify a user without sending a full payload representation. It is most commonly used for deactivating accounts or updating single organizational attributes.

> "Deactivate the SAP HANA user with ID 3b4c5-99d... You need to use a partial update to replace the 'active' path with the value false."

### list_all_sap_hana_groups
Executes `GET /service/scim/Groups` to list SCIM group resources. It returns `displayName`, members, and the SAP group extension (technical name, description, type). This tool is essential for auditing RBAC (Role-Based Access Control).

> "List all SAP HANA groups that contain 'Admin' in the displayName. Show me the technical names and the total count of members in each."

### sap_hana_groups_partial_update
Executes `PATCH /service/scim/Groups/{id}` to modify group membership without overriding the entire member array. The tool schema defines the exact syntax for `op add` or `op remove` against the `members` path.

> "Add user ID 1a2b3-4c5... to the Engineering group (Group ID: 9f8e7-6d5...). Use a partial update to append them to the members array."

For a complete list of endpoints, schemas, and custom operations, view the [SAP HANA integration page](https://truto.one/integrations/detail/saphana).

## Workflows in Action

With the MCP server connected, ChatGPT can orchestrate multi-step identity workflows natively.

### Scenario 1: The Automated Employee Offboarding
When an employee leaves, IT needs to revoke access and remove them from all security groups.

> "Offboard John Smith (john.smith@company.com) from SAP HANA. Find his user ID, deactivate his account, check what groups he is currently in, and remove him from all of them."

**How the agent executes this:**
1. Calls `list_all_sap_hana_users` using the SCIM filter `userName eq "john.smith@company.com"` to retrieve the user's UUID and current group memberships.
2. Calls `sap_hana_users_partial_update` passing the UUID and a PatchOp to `replace` the `active` attribute with `false`.
3. Iterates over the user's groups. For each group ID found in step 1, it calls `sap_hana_groups_partial_update` with a PatchOp to `remove` the specific user UUID from the `members` path.

**What the user gets:** A confirmation that the account is deactivated, alongside an itemized list of the 4 groups John was successfully removed from.

### Scenario 2: Provisioning an Engineering Contractor
DevOps needs to onboard a temporary contractor and grant them specific access based on their role.

> "Create a new SAP user for contractor Alex Chen (alex.chen@agency.com). Send him the activation email. Then, find the 'External-Devs' group and add him to it."

**How the agent executes this:**
1. Calls `create_a_sap_hana_user` with the required schemas, email, and the specific SAP extension attribute `sendMail: true`. It stores the returned new user UUID.
2. Calls `list_all_sap_hana_groups` with the filter `displayName eq "External-Devs"` to locate the target group UUID.
3. Calls `sap_hana_groups_partial_update` to append Alex's new UUID to the `External-Devs` group.

**What the user gets:** The new user's SAP HANA UUID, confirmation that the email was dispatched, and verification of group assignment.

## A Note on Rate Limits and Upstream Errors

When building autonomous agents against enterprise APIs, managing rate limits is crucial. 

It is important to understand that **Truto does not retry, throttle, or apply backoff on rate limit errors.** If ChatGPT makes too many concurrent requests and SAP HANA returns an HTTP 429 (Too Many Requests), Truto passes that exact error back to the caller.

However, Truto normalizes the upstream rate limit information into standardized IETF headers: `ratelimit-limit`, `ratelimit-remaining`, and `ratelimit-reset`. The MCP client (or the LLM framework executing the tool) is responsible for reading these headers and implementing its own retry or backoff logic.

## Stop Writing SCIM Boilerplate

Connecting AI agents to SAP HANA requires deep knowledge of SCIM 2.0 schemas, exact PatchOp syntax, and complex filtering dialects. Writing and maintaining a custom MCP server to handle this translation is a massive drain on engineering resources. 

Truto abstracts this away entirely. By automatically generating MCP tools directly from SAP HANA's API documentation, flattening the input namespace for LLMs, and handling the OAuth lifecycle securely, Truto lets you focus on building agentic workflows rather than wrestling with identity protocols.