# 403 Access Denied when calling SAP API from Ignition **URL:** \ **Category:** Ignition\ **Created:** [March 5, 2026, 4:02am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330 "2026-03-05T04:02:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Syed\_Najam\_ul\_arfeen](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Syed\_Najam\_ul\_arfeen](https://forum.inductiveautomation.com/u/Syed_Najam_ul_arfeen)\ **Post date:** [March 5, 2026, 4:02am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/1 "2026-03-05T04:02:24Z")
I am trying to call a SAP API from Ignition. The API works correctly in Postman and browser, but when I call it from Ignition I am getting 403 Access Denied (SAP ICM error page). The same request works in Postman with Basic Auth, but Ignition returns **403**. Thanks. ![SAP-API](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/9/b96e5b0b5d2f2ed708bc9b7a09040edb52feee63.png) ![SAP_API](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/0/607cdc8abaf9546d00957ba5c73af5f250e6acab.png) ---
**Author:** ![Bushmatic](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bushmatic/32/87014_2.png) [@Bushmatic](https://forum.inductiveautomation.com/u/Bushmatic)\ **Post date:** [March 5, 2026, 9:36am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/2 "2026-03-05T09:36:52Z")
I believe Postman automatically base64 encodes your credentials. Try deleting lines 4 through 6 in your Ignition code and replace with this: ```python import base64 credentials = "your_username:your_password" encoded = base64.b64encode(credentials.encode("utf-8")).decode("utf-8") headers = { "Authorization": "Basic " + encoded, "Accept": "application/json" } ``` If that doesn’t work, make sure the Ignition gateway’s IP is allowed in SAP’s icm/HTTP/auth or ICM allow rules. ---
**Author:** ![Syed\_Najam\_ul\_arfeen](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Syed\_Najam\_ul\_arfeen](https://forum.inductiveautomation.com/u/Syed_Najam_ul_arfeen)\ **Post date:** [March 6, 2026, 3:17am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/3 "2026-03-06T03:17:24Z")
Thank you @Bushmatic for your response. I tried the approach you suggested, but the issue still persists. I think I should now loop in the SAP team regarding the ICM related query. Furthermore, I have attached a snapshot after performing the Base64 encoding. ![SS](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/b/2b8b10c4b231570bd76b29be7e1f1bbf0647df67.png) ![SS_2](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/d/bdb79c05f691c0688a2de2541f5856c3059e7d22.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 6, 2026, 3:26am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/4 "2026-03-06T03:26:54Z")
`system.net.httpClient` handles the basic auth header and encoding when you specify the username and password, you don't need to do it yourself. ---
**Author:** ![Syed\_Najam\_ul\_arfeen](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Syed\_Najam\_ul\_arfeen](https://forum.inductiveautomation.com/u/Syed_Najam_ul_arfeen)\ **Post date:** [March 6, 2026, 3:50am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/5 "2026-03-06T03:50:55Z")
Thanks for the clarification. I understand that `system.net.httpClient()` handles the Basic Auth automatically. However, I have already tried passing the username/password directly as well as manually replicating the headers from Postman, but I am still getting **HTTP 403**. Since the request works in Postman, could you please suggest what else might be missing in the Ignition request? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 6, 2026, 3:56am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/6 "2026-03-06T03:56:13Z")
Share your postman config, or better compare a Wireshark capture between the two. ---
**Author:** ![Syed\_Najam\_ul\_arfeen](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Syed\_Najam\_ul\_arfeen](https://forum.inductiveautomation.com/u/Syed_Najam_ul_arfeen)\ **Post date:** [March 6, 2026, 6:06am UTC](https://forum.inductiveautomation.com/t/403-access-denied-when-calling-sap-api-from-ignition/114330/7 "2026-03-06T06:06:04Z")
Thank you for the suggestion about comparing the requests using Wireshark. That hint helped a lot. After capturing and inspecting the traffic, I noticed that Ignition was sending the request with a different HTTP protocol behavior compared to Postman. I then explicitly set the HTTP version to **HTTP\_1.1** in the system function and after doing that the issue was resolved and the API started responding correctly. Appreciate the guidance! Script: ![solution](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/d/4dba7b0b8b407f13fed90ead1ab197abcdd1c631.png) Wireshark Postman response: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2ddfcaaff09625952bc0a981a42dbc1be242a102.png) Wireshark Ignition response: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/5/35005bc49ab94f780038849ca57b0c50f47d88c9.png)