Connect SAP HANA to ChatGPT: Manage identity and group access

If you need to connect SAP HANA to ChatGPT to automate user provisioning, manage SAP Cloud Identity Services, or orchestrate group access, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and SAP HANA's SCIM 2.0 API. You can either build and maintain this SCIM translation infrastructure yourself (see our guide on how to build ERP integrations without storing data), or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting SAP HANA to Claude or explore our broader architectural overview on connecting SAP HANA to AI Agents.

Giving a Large Language Model (LLM) read and write access to SAP Cloud Identity Services is a complex engineering task. You have to handle deeply nested SCIM extension payloads, exact PatchOp syntax requirements, and strict pagination models. Every time you want to expose a new capability, you have to write, deploy, and maintain custom MCP tool schemas.

This guide breaks down exactly how to use Truto to generate a secure, managed SAP HANA MCP server, connect it natively to ChatGPT, and execute complex identity management workflows using natural language.

The Engineering Reality of the SAP HANA API

A custom MCP server is essentially a self-hosted integration layer. While the open MCP standard provides a predictable way for models like GPT-4 to discover tools, implementing it against SAP HANA's Cloud Identity Services is exceptionally painful (see how it compares to other platforms in our NetSuite vs SAP guide) due to its reliance on the SCIM (System for Cross-domain Identity Management) 2.0 specification.

If you decide to build a custom SAP HANA MCP server, you own the entire API lifecycle. Here are the specific integration challenges you will face:

The SCIM PatchOp Complexity

Unlike a typical REST API where you might send a simple PUT /users/123 with { "active": false }, SAP HANA requires strict adherence to the SCIM 2.0 Patch protocol. To deactivate a user, your MCP server must instruct the LLM to format the payload exactly like this:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}

LLMs are notoriously bad at spontaneously generating complex, nested schema envelopes. Without rigorous JSON Schema definitions injected into the MCP tool descriptions, ChatGPT will hallucinate standard REST updates, resulting in immediate HTTP 400 Bad Request errors from SAP.

SAP-Specific Extension Attributes

SAP HANA does not just use standard SCIM fields (userName, name, emails). It heavily relies on enterprise extensions, specifically urn:ietf:params:scim:schemas:extension:sap:2.0:User and urn:ietf:params:scim:schemas:extension:enterprise:2.0:User. If your AI agent needs to assign an employee number or trigger a welcome email via the sendMail flag, the MCP tool schema must correctly map these nested URIs.

Complex Filtering and Pagination

When an LLM wants to search for an SAP group by name, it must pass a specific SCIM filter syntax in the query parameter, such as displayName eq "Admins". Furthermore, SAP HANA uses startIndex and count for pagination, rather than page or cursor. If you build this yourself, you have to teach the LLM how to increment startIndex mathematically across multiple tool calls to page through large directories.

How Truto Solves SAP HANA Tool Generation

Truto eliminates these hurdles through dynamic, documentation-driven tool generation. When you connect an SAP HANA account, Truto inspects the integration's resource definitions and automatically derives the necessary MCP tools.

When ChatGPT calls a tool, it sends a flat JSON object of arguments. Truto's MCP router dynamically splits these arguments into query parameters (like the SCIM filter or startIndex) and body parameters (like the Operations array) based on the underlying schemas. It handles the request to SAP HANA, normalizes the SCIM response, and returns the result back to the LLM.

sequenceDiagram
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP Router
    participant SAP as SAP HANA (SCIM)
    
    ChatGPT->>Truto: Call sap_hana_users_partial_update(id, Operations)
    Truto->>Truto: Split flat arguments into Query & Body
    Truto->>Truto: Inject authentication & metadata
    Truto->>SAP: PATCH /service/scim/Users/{id} (PatchOp payload)
    SAP-->>Truto: 200 OK (Updated User Resource)
    Truto-->>ChatGPT: JSON-RPC Result

Step 1: Create the SAP HANA MCP Server

An MCP server in Truto is scoped to a single integrated account. This means the server URL contains a cryptographic token encoding the specific SAP HANA tenant, the tools exposed, and the authentication state.

You can create this server via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

1. Navigate to the Integrated Accounts page in your Truto dashboard.
2. Select your connected SAP HANA instance.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select the desired configuration (e.g., allow read and write methods, filter by users tags).
6. Copy the generated MCP server URL. It will look like https://api.truto.one/mcp/a1b2c3d4....

Method 2: Via the Truto API

If you are dynamically provisioning AI agents for your customers, you can generate MCP servers programmatically.

Make a POST request to the /integrated-account/:id/mcp endpoint:

curl -X POST https://api.truto.one/integrated-account/<YOUR_INTEGRATED_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer <YOUR_TRUTO_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "SAP HANA Identity Manager for ChatGPT",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["users", "groups"]
    }
  }'

The API validates the SAP HANA connection, generates a secure, hashed token, and returns the URL. Treat this URL as a secret - it contains routing and authentication routing for that specific SAP instance.

Step 2: Connect the MCP Server to ChatGPT

Once you have your Truto MCP server URL, you must register it with ChatGPT.

Method 1: Via the ChatGPT UI (Custom Connectors)

If you are on a ChatGPT Plus, Pro, Team, or Enterprise plan with Developer Mode enabled:

1. Open ChatGPT and go to Settings -> Apps -> Advanced settings.
2. Enable Developer mode.
3. Under MCP servers / Custom connectors, click Add new server.
4. Enter a name (e.g., "SAP HANA via Truto").
5. Paste the Truto MCP URL into the Server URL field.
6. Click Save.

ChatGPT will perform the MCP initialization handshake and instantly discover the SAP HANA tools.

Method 2: Via Manual Config File (Claude Desktop / Local Agents)

If you are testing locally or using an agent framework that relies on the standard mcp_config.json file (common in Claude Desktop or local LangChain setups), you can use the official @modelcontextprotocol/server-sse transport.

Add this to your configuration file:

{
  "mcpServers": {
    "sap-hana-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/<YOUR_TOKEN>"
      ]
    }
  }
}

Restart your client, and the tools will be immediately available.

Security and Access Control

Giving an LLM write access to an enterprise identity directory requires strict guardrails. Truto provides several mechanisms to secure your SAP HANA MCP server, adhering to a zero-data retention architecture:

• Method Filtering: By passing config: { methods: ["read"] } during creation, you ensure the LLM can only execute GET requests (e.g., auditing users). It is physically impossible for the model to accidentally invoke a DELETE or PATCH operation.
• Tag Filtering: Restrict the server to specific operational domains. Use config: { tags: ["groups"] } to allow group management while keeping user profile creation completely out of scope.
• Expiration (TTL): Set an expires_at ISO datetime. Truto will automatically tear down the MCP server and revoke the token at the exact minute specified, which is ideal for temporary contractor access or limited-time audit workflows.
• Require API Token Auth: By setting require_api_token_auth: true, possession of the MCP URL is no longer enough. The connecting client must also pass a valid Truto API token in the Authorization header, adding a mandatory second layer of authentication.

Hero Tools for SAP HANA

Truto automatically generates highly descriptive snake_case tools based on the SAP HANA integration schemas. Here are the highest-leverage tools available to ChatGPT.

list_all_sap_hana_users

Executes GET /service/scim/Users to return a paginated list of SCIM user resources. This includes core attributes, SAP extension attributes, and group memberships. The tool schema natively instructs the LLM on how to construct valid SCIM filter expressions.

"Audit the SAP Cloud Identity directory. Find all users where the active status is true but they haven't logged in for 90 days. Give me a table of their names and emails."

get_single_sap_hana_user_by_id

Fetches the complete SCIM resource for a specific user using their UUID. This is critical for reading a user's exact state before attempting a full replacement update, ensuring that omission of optional fields doesn't inadvertently clear them.

"Pull the complete SAP HANA profile for the user ID 8f72b-11c... What department and manager are listed in their enterprise extension attributes?"

create_a_sap_hana_user

Executes POST /service/scim/Users to provision a new identity. The schema forces the LLM to provide the required userName and at least one email, while optionally setting the SAP extension sendMail flag to true to trigger the welcome flow.

"Provision a new SAP HANA user for Jane Doe (jane.doe@company.com). Set her userType to 'Contractor' and make sure the SAP extension flag is set to send her an activation email immediately."

sap_hana_users_partial_update

Executes a PATCH request using the SCIM PatchOp specification. This is the safest way to modify a user without sending a full payload representation. It is most commonly used for deactivating accounts or updating single organizational attributes.

"Deactivate the SAP HANA user with ID 3b4c5-99d... You need to use a partial update to replace the 'active' path with the value false."

list_all_sap_hana_groups

Executes GET /service/scim/Groups to list SCIM group resources. It returns displayName, members, and the SAP group extension (technical name, description, type). This tool is essential for auditing RBAC (Role-Based Access Control).

"List all SAP HANA groups that contain 'Admin' in the displayName. Show me the technical names and the total count of members in each."

sap_hana_groups_partial_update

Executes PATCH /service/scim/Groups/{id} to modify group membership without overriding the entire member array. The tool schema defines the exact syntax for op add or op remove against the members path.

"Add user ID 1a2b3-4c5... to the Engineering group (Group ID: 9f8e7-6d5...). Use a partial update to append them to the members array."

For a complete list of endpoints, schemas, and custom operations, view the SAP HANA integration page.

Workflows in Action

With the MCP server connected, ChatGPT can orchestrate multi-step identity workflows natively.

Scenario 1: The Automated Employee Offboarding

When an employee leaves, IT needs to revoke access and remove them from all security groups.

"Offboard John Smith (john.smith@company.com) from SAP HANA. Find his user ID, deactivate his account, check what groups he is currently in, and remove him from all of them."

How the agent executes this:

1. Calls list_all_sap_hana_users using the SCIM filter userName eq "john.smith@company.com" to retrieve the user's UUID and current group memberships.
2. Calls sap_hana_users_partial_update passing the UUID and a PatchOp to replace the active attribute with false.
3. Iterates over the user's groups. For each group ID found in step 1, it calls sap_hana_groups_partial_update with a PatchOp to remove the specific user UUID from the members path.

What the user gets: A confirmation that the account is deactivated, alongside an itemized list of the 4 groups John was successfully removed from.

Scenario 2: Provisioning an Engineering Contractor

DevOps needs to onboard a temporary contractor and grant them specific access based on their role.

"Create a new SAP user for contractor Alex Chen (alex.chen@agency.com). Send him the activation email. Then, find the 'External-Devs' group and add him to it."

How the agent executes this:

1. Calls create_a_sap_hana_user with the required schemas, email, and the specific SAP extension attribute sendMail: true. It stores the returned new user UUID.
2. Calls list_all_sap_hana_groups with the filter displayName eq "External-Devs" to locate the target group UUID.
3. Calls sap_hana_groups_partial_update to append Alex's new UUID to the External-Devs group.

What the user gets: The new user's SAP HANA UUID, confirmation that the email was dispatched, and verification of group assignment.

A Note on Rate Limits and Upstream Errors

When building autonomous agents against enterprise APIs, managing rate limits is crucial.

It is important to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. If ChatGPT makes too many concurrent requests and SAP HANA returns an HTTP 429 (Too Many Requests), Truto passes that exact error back to the caller.

However, Truto normalizes the upstream rate limit information into standardized IETF headers: ratelimit-limit, ratelimit-remaining, and ratelimit-reset. The MCP client (or the LLM framework executing the tool) is responsible for reading these headers and implementing its own retry or backoff logic.

Stop Writing SCIM Boilerplate

Connecting AI agents to SAP HANA requires deep knowledge of SCIM 2.0 schemas, exact PatchOp syntax, and complex filtering dialects. Writing and maintaining a custom MCP server to handle this translation is a massive drain on engineering resources.

Truto abstracts this away entirely. By automatically generating MCP tools directly from SAP HANA's API documentation, flattening the input namespace for LLMs, and handling the OAuth lifecycle securely, Truto lets you focus on building agentic workflows rather than wrestling with identity protocols.