← Technical blog

SAP CPI observability

SAP CPI: end-to-end tracing with Correlation IDs (without archaeology)

In real incidents, the problem is not “seeing the error”. It is answering which business transaction failed, at which hop, with what evidence, and how to reproduce it without depending on “the one person who knows”.

SAP CPIIntegration SuiteObservabilityGovernance

A well-designed Correlation ID turns “search five systems” into “follow a thread”. The key is to treat it as part of the integration operational contract: it is generated, propagated, logged, and used for support.

1) Define what you correlate (and what you do not)

Before choosing a header, define scope:

  • Correlation unit: order, employee, invoice, transfer, ticket?
  • Cardinality: one ID per message, per transaction, or per batch?
  • Privacy: avoid IDs that expose personal data; use technical identifiers or safe tokens.
Rule of thumb: if your Correlation ID includes PII, your traceability is already a security incident waiting to happen.

2) Minimum standard: a stable header + a platform execution ID

For support, it helps to separate:

  • Correlation ID (business): travels across systems and ties hops together (e.g. X-Correlation-ID).
  • Execution ID (platform): what the runtime gives you (message/log IDs) to reach technical detail.

The common mistake is using only platform IDs: they help for a single hop, but not for the full journey when you have retries, replays, or parallel routes.

3) Propagation: every hop preserves the thread

Whether you use HTTP, SOAP, OData or queues, the pattern is the same: a Correlation ID arrives or is generated, then it is copied to every outbound request.

  • Inbound: if a valid ID arrives, keep it; otherwise, generate one.
  • Outbound: inject the same ID into outbound headers (and, if applicable, into responses).
  • Batch: decide if the ID is per batch (support-friendly) and add a sub-ID per item when you need granularity.

4) SAP CPI / Integration Suite implementation (operational pattern)

Without tying this to a specific iFlow, a healthy pattern looks like:

  1. Validate/normalize the Correlation ID at the beginning (length, charset, format).
  2. Persist as properties to reuse it across the flow (and avoid losing it in mappings).
  3. Inject into outbound (HTTP headers, SOAP headers, or equivalent adapter capabilities).
  4. Minimum logging: on errors or retries, record Correlation ID + contract (entity, operation, destination).

A strong signal of maturity is that each iFlow has an explicit “observability” section: what is logged, what is not, and how support traces a case end-to-end.

5) Minimum evidence for support (without log dumping)

“More logs” is not a strategy. Minimum useful evidence is typically:

  • Correlation ID + timestamp + environment.
  • Contract: entity/operation/destination.
  • Fingerprint: payload hash or stable signature without sensitive data.
  • Outcome: success/failure + error class (transient vs functional).

This does not replace SAP lifecycle, transport management, or runtime monitoring tooling. It is middleware governance focused on operable traceability.

6) Governance: prevent “every iFlow does it differently”

If you do not standardize, tracing breaks on the first change. Keep governance simple:

  • Names: one canonical header and format (UUID or safe token).
  • Mandatory scope: which integrations must always include it (most cross-system flows).
  • Runbook: “how to trace a case” from ticket to failing hop.
  • Tests: a smoke test that validates Correlation ID survival across the journey.

Quick checklist (for SAP partners)

  • A canonical header exists (X-Correlation-ID or equivalent) and it never contains PII.
  • iFlows generate an ID when missing and propagate it on every outbound call.
  • There is minimum evidence (fingerprint + contract) for incidents and controlled replay.
  • Support can trace a case with a runbook without “asking development”.

Want to standardize tracing without bureaucracy?

In our Picasso CPI Governance Assessment we review operational patterns (including traceability), minimum evidence and drift risks so your team supports integrations with real control.

Talk to an architect