Docs / Installation / Roles
Roles and Authorization
Detailed authorization requirements for the ASAPIO Integration Add-on, including standard roles and specific authorization objects.
Standard Roles
The following information is applicable for all scenarios and use cases of the ASAPIO Integration Add-On.
Administrator role: For administrator users, role
/ASADEV/ACI_ADMIN_ROLE is provided. This role has all necessary authorization objects for configuration and support of the Integration Add-On. This role (or the containing authorization objects) must be assigned to users who should configure, test, execute and monitor the solution.
Batch job role: For technical / system users, for example to run batch jobs, role
/ASADEV/ACI_JOB_ROLE is provided. This role includes all necessary authorization objects to run the ASAPIO Integration Add-On.
Authorizations of Administrator role (/ASADEV/ACI_ADMIN_ROLE)
| Authorization Object | Settings |
|---|---|
S_TCODE |
TCD = /ASADEV/68000202, /ASADEV/68000203, /ASADEV/68000204, /ASADEV/68000205, /ASADEV/68000206, /ASADEV/68000207, /ASADEV/68000212, /ASADEV/68000216, /ASADEV/68000217, /ASADEV/68000218, /ASADEV/ACI_MONITOR, /ASADEV/ACI, /ASADEV/DESIGN, /ASADEV/SCI_CP_RESET, /ASADEV/SCI_TPW, BD52, BD61, RBDCPCLR, SE38, SPRO, WE81, SOAMANAGER |
/ASADEV/AR |
/ASADEV/CO/ = * /ASADEV/OB/ = * |
/ASADEV/CU |
All possibilities |
/ASADEV/IN |
/ASADEV/CO/ = * /ASADEV/IN/ = * |
/ASADEV/ML |
/ASADEV/CO/ = * /ASADEV/ML/ = * |
/ASADEV/RC |
/ASADEV/RF = * |
/ASADEV/PL |
ACTVT = Create, Change, Display, Delete |
/ASADEV/PW |
ACTVT = Display |
S_GUI |
ACTVT = Export |
S_TABU_DIS |
ACTVT = Change, Display DICBERCLS = /AS/,ALE0, EDI0 |
S_TABU_NAM |
ACTVT = Change, Display TABLE = /ASADEV/* |
S_DEVELOP |
ACTVT = Display, Execute DEVCLASS = SALE OBJNAME = RBDCPCLR OBJTYPE = PROG |
S_APPL_LOG |
ACTVT = Display ALG_OBJECT = /ASADEV/AMR_LOG ALG_SUBOBJ = * |
S_IDOCDEFT |
ACTVT = Display EDI_TCD = WE30 |
S_SRT_CF_C |
ACTVT = Create or generate, Change, Display, Delete, Activate, generate SRT_NAME = /ASADEV/* |
S_IDOCMONI |
ACTVT = Change, Display EDI_DIR = Outbound, Inbound EDI_MES = * EDI_PRN = * EDI_PRT = * EDI_TCD = * |
Authorizations of Batch job role (/ASADEV/ACI_JOB_ROLE)
| Authorization Object | Settings |
|---|---|
S_TCODE |
TCD = /ASADEV/ACI |
/ASADEV/AR |
/ASADEV/CO/ = * /ASADEV/OB/ = * |
/ASADEV/IN |
/ASADEV/CO/ = * /ASADEV/IN/ = * |
/ASADEV/ML |
/ASADEV/CO/ = * /ASADEV/ML/ = * |
/ASADEV/RC |
/ASADEV/RF = * |
/ASADEV/PW |
ACTVT = Display |
Event Studio Roles
The ABAP Edition of Event Studio has no roles of its own — it reuses the /ASADEV/CU authorization object from the standard Integration Add-on roles above, so any user with Customizing access (e.g. via /ASADEV/ACI_ADMIN_ROLE) can use it.
The CAP Edition, deployed to SAP BTP Cloud Foundry, uses role collections rather than PFCG roles. Assign these in the SAP BTP Cockpit under Security → Role Collections, then have users log out and back in to refresh their authorization token. See Event Studio — Deploy CAP Edition for deployment context.
| Role Collection | Purpose |
|---|---|
eventstudiocap_viewer |
Required to access Event Studio. Grants the base application — Data Catalog, Interfaces, Events, and Connections pages. |
eventstudiocap_aiviewer |
Required to access the Event Studio AI Assistant. Enables the AI side panel for guided navigation and contextual documentation help; requires an AI destination to be configured (see Bring Your Own LLM). |
Users without
eventstudiocap_aiviewer can still use Event Studio normally — the AI side panel is simply not shown. Assign both collections to users who should have full access including AI features.
Authorization Objects Overview
| Authorization Object | Description |
|---|---|
/ASADEV/AR |
Used to restrict the execution of outbound objects as defined in the ASAPIO Integration Add-on Customizing (Values: Instance, Object) |
/ASADEV/CU |
General access to the ASAPIO Integration Add-on Customizing |
/ASADEV/IN |
Used to restrict the execution of inbound objects as defined in the ASAPIO Integration Add-on Customizing (Values: Instance, Object) |
/ASADEV/ML |
Used to restrict the execution of multiline outbound objects as defined in the ASAPIO Integration Add-on Customizing (Values: Instance, Object) – Not required for event-messaging use cases! |
/ASADEV/RC |
General execution of ASAPIO Integration Add-on functionality (Field: /ASADEV/RF, Values: DATA_PROC, FRAMEWORK). Data Processing is checked in all extraction FM and Framework in all other places of execution. |
/ASADEV/PD |
Authorization to use the ASAPIO Payload Designer (transaction /ASADEV/DESIGN). |
/ASADEV/PW |
General authorization to read a secret for the ASAPIO Integration Add-on from the Secure Store. |