Systems Under Test
LicenseInt4 Shield Lite (2 of 5) · Custom add-on (3)Details
| Feature or limit | Int4 Shield Lite |
|---|---|
| SAP Integration Suite testing | Included |
| SAP PI/PO testing | Included |
| Solace PubSub+ testing | Add-on |
| SAP Advanced Event Mesh testing | Add-on |
| SAP Event Mesh testing | Add-on |
Anything a license model does not include can be added through a custom license. The license installed for you is shown in the app under Profile → License. All features by license
Overview
A System Under Test (SUT) is a saved connection to one of the external systems your test cases talk to — an SAP Cloud Integration tenant, an SAP PI/PO system, an SAP ABAP backend, a generic HTTP service, a Solace PubSub+ or SAP Advanced Event Mesh broker, or an SAP Event Mesh service instance. It stores everything Int4 Suite needs to reach that system: the URL, how to authenticate, and a handful of runtime settings such as rate limits and trace settings.
A connection deliberately captures only how to reach one concrete system — its address and credentials — and nothing about which stage of your landscape that system represents. That separation is what lets a single test case be reused widely: tests reference a stage (an environment) rather than a hard-wired address, and the platform looks up the matching connection at run time. The same connection can therefore be shared by many tests and swapped out for a different system without touching any test that uses it.
There are seven system types because the systems a test talks to are reached in fundamentally different ways. SAP Cloud Integration and SAP PI/PO are integration middleware that the engine injects messages into and then reads results back from. The SAP ABAP backend is used to inject IDocs, proxies and RFC calls and to validate that the right documents were created or changed. The HTTP host is a generic target for everything else. Solace PubSub+, SAP Advanced Event Mesh and SAP Event Mesh are message brokers that tests publish to and capture from. Each is spoken to through its own native interface, which is why the form re-shapes itself to the connections and credentials that type needs, and why the type is fixed once chosen.
This page is the central inventory of those connections. From here you can browse and search the systems, filter them by type, open one to view, edit, copy or delete it, create a new one, and export the list to Excel or PDF.
Each row in the list shows the system's name, its purpose, what type of system it points at, whether it is flagged as a production system, and basic audit information. Names and descriptions are stored in plain text; passwords, client secrets, API keys, and RFC credentials are kept in the secret manager and never appear on this screen.
Tasks
How to create a system
- Under Configuration, open Systems Under Test and click Create New. The button is disabled if you do not hold the System Under Test: Write permission.
- In General Information, enter the System Name and choose the System Type. Types your licence does not include are greyed out. Optionally add a Description, switch on Production System, and pick a project scope in Project Scope Id.
- As soon as a type is chosen, the Parameters section appears, pre-filled with the defaults for that type. Values in angle brackets, such as
https://<hostname>, are placeholders — replace them with your system's details. - Fill in each connection under Connections: the address, and under Authentication the authentication type and credentials. For SAP Cloud Integration and SAP Event Mesh you can fill a connection from an SAP BTP service key instead — see How to import an SAP BTP service key.
- Keep an eye on the Checklist panel on the right. It lists every required field of the chosen type and marks the ones that are missing or invalid as you type.
- Optionally click Check connection under a connection to test what you have entered before saving.
- Click Save. You return to the list, and the new system is checked in the background within the next 15 minutes.
How to check a connection
Every connection section has its own Check connection button below its fields. The result appears directly under the section: a green notice when the system answered as expected, a red one with the reason when it did not.
- New system: the check uses exactly what you typed, including the credentials.
- Saved system: the check uses the saved configuration and the stored credentials. To test unsaved changes, re-enter the password or secret of that connection first — the form reminds you with the notice "Check connection tests the last saved configuration. Re-enter the password to test your unsaved changes.".
- Checking a saved system also updates its status on the Dashboard, and a successful check resumes automatic checks that were paused because the credentials had been refused.
- On a system flagged as production, checks never send a test message: SAP PI/PO runs only a read-only message search, and the SAP Cloud Integration runtime and SAP Event Mesh messaging checks only confirm that a token can be obtained.
You need the System Under Test: Execute permission, because a check sends real traffic with the credentials. If the same connection is still being checked, the new check is refused — wait a moment and try again.
How to import an SAP BTP service key
SAP Cloud Integration connections and SAP Event Mesh systems can be filled from the JSON service key that SAP BTP issues for a service instance.
- Click Import Service Key — on SAP Cloud Integration it sits in each connection section (API Destination, IFL Destination); on SAP Event Mesh it sits at the top of the connections and fills both connections at once.
- In Upload Service Key, either choose the JSON file (Upload a JSON file:) or paste its content (or paste the service key in JSON format:).
- Click Upload. The URL, the OAuth2 token URL, client ID and client secret are filled in and the authentication type is set to OAuth2 Client Credentials. For SAP Event Mesh, the namespace is filled as well.
If the key is missing a required part, the dialog names it (for example "Missing 'oauth' object in service key") and nothing is changed.
How to edit a system
- Open the system from the list and click Edit. The button is disabled when you lack write permission on the system's project scope.
- Change what you need. The System Type cannot be changed.
- Stored secrets show (unchanged). Leave the field empty to keep the stored value, type a new value to replace it, or tick Set empty to clear it.
- Click Save Changes.
When you change anything else in a connection that has a stored secret — URL, base path, network route, user name, token URL and so on — you must enter the secret again (or tick Set empty); the form shows "Enter a new value or select set empty" until you do. This makes sure a stored secret is only ever sent to the address it was saved for. On an SAP ABAP backend, the RFC password is needed again when you change the host, system number, client, user, SAProuter string or network route; the logon language, time zone, client role check and bridge optimizations can be changed without it.
How to copy a system
- Open the system and click Copy.
- The create form opens with the same type and settings and the name
<original name>_COPY. Credentials are not copied — enter them again. - Adjust the name and anything else, then click Save.
How to delete a system
- Open the system and click Delete.
- Confirm in Delete System Under Test.
The system and its stored credentials are removed. Deletion is refused while the system is still in use — by a test case, a past test execution, a cell of the System Landscape, a crawler, a trace scheduler, or a Messenger object. The message does not say which record blocks it; remove those references first.
How to see who changed a system
Open the system and scroll to the Admin section. It shows who created and last changed the system and when, followed by the full change history. Changes to credentials appear as a changed reference, never as the secret itself.
How to set up an SAP Event Mesh system
SAP Event Mesh is the SAP BTP messaging service. It is not the same as SAP Advanced Event Mesh, which is a Solace broker and has its own type. Int4 Suite reaches an Event Mesh service instance through its two REST interfaces — management and messaging — so the system holds two connections plus the instance's namespace.
- Choose the SAP Event Mesh type on the create form.
- Download the service key of the Event Mesh service instance from SAP BTP and click Import Service Key. Upload the JSON file or paste its content and confirm with Upload. The import fills Management API Destination and Messaging REST Destination — URL, base path and OAuth2 client credentials for each — and the Namespace. You can also type everything in by hand; the form starts with placeholder hosts and the standard base paths already in place.
- Check the Namespace under Event Mesh Configuration. It is the namespace of the service instance's message client (for example
orgname/demo/em); every queue and topic Int4 Suite touches lives under it. Surrounding slashes are removed automatically. - Leave Technical Queue Prefix at its default (
INT4SuiteTech) unless your naming rules require otherwise. It is a prefix, not a queue name: SAP Event Mesh capture tests create their temporary queues under<namespace>/<prefix>/…for each run and remove them afterwards. Use a single name segment — no slashes, spaces or wildcards. - Optionally adjust Rate Limiting. The default — 10 requests per second with a burst of 5 — matches what the Event Mesh REST interfaces tolerate.
- Save, then click Check connection on each of the two connections. The management check must be able to list the instance's queues. The messaging check publishes one small test message to the topic
<namespace>/int4suite/connectioncheck; the expected success is the service accepting the publish. No queue receives that message unless one of your queues subscribes to a namespace-wide wildcard. On a system flagged as production the test message is not sent: the messaging check only confirms that an OAuth token can be obtained. A wrong client secret shows up as a token error; a wrong base path — on either connection — as a failure naming the HTTP status (typically 404) and asking you to check the base path.
System types
Pick the type that matches how Int4 Suite reaches the system. The automation object you test with decides which type it needs.
| Type | Connections on the form | Used by automation objects of type | Licence |
|---|---|---|---|
| SAP Cloud Integration | API Destination, IFL Destination | SAP CI Injection, SAP CI Capture, SAP CI Micro Unit Test, SAP CI TPM Injection, SAP CI TPM Capture | SAP Cloud Integration |
| SAP PI/PO | PO Destination | SAP PO Injection, SAP PO Capture, SAP PO Synchronous | SAP PI/PO |
| SAP ABAP Backend | RFC Server and Credentials, optional HTTP Destination | SAP DB Comparator, IDoc Injection, IDoc Capture, Proxy Injection, Proxy Capture, RFC Check, RFC Call, AIF Injection, NAST Injection | Included |
| HTTP Host | HTTP Destination | HTTP Call | Included |
| Solace PubSub+ | SEMP Destination, SMF Messaging Destination | Solace PubSub+ Injection, Solace PubSub+ Capture | Solace PubSub+ |
| SAP Advanced Event Mesh | SEMP Destination, SMF Messaging Destination | SAP Advanced Event Mesh Injection, SAP Advanced Event Mesh Capture | SAP Advanced Event Mesh |
| SAP Event Mesh | Management API Destination, Messaging REST Destination | SAP Event Mesh Injection, SAP Event Mesh Capture | SAP Event Mesh |
"Included" means the type can be created with any licence; the automation objects that use it may still need their own licence feature.
SAP Cloud Integration
License: Included in Int4 Shield Lite
Choose this for an SAP Cloud Integration tenant, including an Edge Integration Cell and SAP Cloud Integration running on a PI/PO runtime. The system has two connections: API Destination reaches the tenant's management API (message processing logs, traces, iFlow content), and IFL Destination reaches the runtime where the Int4 dispatcher iFlow receives test messages. Both usually use OAuth2 client credentials from a service key.
| Field | Description |
|---|---|
| Dispatcher ID | Name of the Int4 dispatcher iFlow on the tenant (default Int4_Dispatcher). |
| Dispatcher Async | Send test messages to the dispatcher asynchronously. Requires a dispatcher ID. |
| Trace Retry Number | How often to try activating the trace on an iFlow (0–10, default 5). |
| Trace Retry Delay | Seconds between trace activation attempts (0–300). |
| iFlow Check Retry Number | How often to check that a deployed iFlow is ready (0–60, default 5). |
| iFlow Check Retry Delay | Seconds between readiness checks (0–600, default 5). |
| PO Runtime | Switch on when SAP Cloud Integration runs on a PI/PO runtime. Synchronous test messages then use that runtime's address format. |
| Custom Header Search | Find the processed messages of a test by their custom header properties instead of the default correlation. |
| Runtime Location ID | Runtime location of an Edge Integration Cell. Leave empty when the API base path already starts with /location/<id> — it is taken from there; if you fill it, it must match. |
| Micro Unit Test Package ID | Package where micro unit tests store the temporary iFlow copies they create. |
| Reference Script | Groovy script injected into those temporary iFlows (default SetHeaderProperties). |
| Reference Script Collection | Script collection holding the reference script (default Int4ScriptCollection). |
| TPM Processing iFlow | iFlow ID of the generic Trading Partner Management processing flow. An automation object can override it. |
| TPM Input ProcessDirect Endpoint | ProcessDirect endpoint that receives Trading Partner Management input. An automation object can override it. |
SAP PI/PO
License: Included in Int4 Shield Lite
Choose this for an SAP Process Integration / Process Orchestration system. One connection, PO Destination, reaches the system's web services and adapters, usually with basic authentication. Its user is the Int4 communication user: objects it changes on the system are listed on the PI/PO Objects page.
| Field | Description |
|---|---|
| Message Version | Message version read from the message store (default AM). |
| Archive | Also read messages from the archive. |
| Message List Pack Size | How many messages are read per request when reading message lists (1–1000, default 250). |
| Allow Wait Status | Do not wait for a message to reach its final status. |
| PIT Message Injector | Inject test messages through the SAP PIT web service instead of the SOAP adapter. An automation object can override this. |
| Stop Receiver Process | Stop receiver processing during unit tests. Requires the PIT message injector. |
| BC Name | Business component of the technical communication channel (default BC_IFTT). Required when a channel name is set. |
| Channel Name | Technical communication channel used to send test messages (default CC_SND_SOAP). |
| Flat File Destination BC | Business component of the flat-file destination channel. Required when a flat-file channel is set. |
| Flat File Destination Channel | Channel used for flat-file messages. |
| Flat File Destination Party | Party of the flat-file destination channel, if any. |
The default rate limit for this type is 5 requests per second with a burst of 3.
SAP ABAP Backend
Choose this for an SAP ABAP system such as SAP S/4HANA or SAP ERP. The RFC connection is always present; switch on Use HTTP destination to add an HTTP Destination for HTTP services of the same system. Each has its own Check connection. RFC connections need the SAP NW RFC SDK; when it is not installed, the form shows "The SAP NW RFC SDK is not installed, so RFC connections will fail." with a link to the Global Parameters page, where an administrator uploads it.
| Field | Description |
|---|---|
| Application Server Host | Host name of the SAP application server. |
| System Number | Two-digit system number, for example 00. |
| Client | Three-digit client, for example 100. |
| Logon Language | Logon language, for example EN. Can be changed without re-entering the password. |
| SAP System Time Zone | Time zone of the SAP application server as an IANA name, for example Europe/Berlin (default UTC). Timestamps the system returns are converted with it. |
| Disable Client Role Check | Skip the SAP client role check, so tests can run on a client that is flagged as productive. Use with care. |
| SAP Router String | SAProuter string, when the system is reached through a SAProuter. Cannot be combined with the SAP BTP Cloud Connector route. |
| Network Route | Shown only when your installation is connected to SAP BTP Connectivity. SAP BTP Cloud Connector reaches an on-premise system through the Cloud Connector and needs the host and system number. |
| Cloud Connector Location ID | Cloud Connector location, when your subaccount uses more than one. |
| Enable bridge optimizations | Shown for the Cloud Connector route on SAP BTP. Reduces per-call overhead; off by default. Can be changed without re-entering the password. |
| User / Password | SAP logon user (up to 12 characters) and password, under Credentials. |
HTTP Host
Choose this for any service reached over plain HTTP(S) — for example a REST API called by an HTTP call automation object. It has one connection, HTTP Destination, with any of the authentication types, and an optional rate limit (default 10 requests per second, burst 5).
Solace PubSub+ and SAP Advanced Event Mesh
Both types connect to a Solace broker; SAP Advanced Event Mesh is Solace PubSub+ under the SAP brand. Pick the name your landscape uses — the forms are identical, but the type cannot be switched later. A system describes one message VPN of one broker; for several VPNs, create one system per VPN.
| Field | Description |
|---|---|
| Message VPN | Message VPN that both connections work in (default default). |
| Technical Queue Name | Queue that capture tests in topic mode subscribe to the captured topic and read from (default INT4SuiteTech). Dedicate it to Int4 Suite: any other consumer bound to it takes the messages away before the test can read them. |
| SEMP Destination | The broker's management (SEMP) address, for example https://broker.example.com:943 with base path /SEMP/v2, used to look up and manage queues and subscriptions. |
| SMF Host URI | Messaging address under SMF Messaging Destination, with scheme and port, for example tcps://broker.example.com:55443. Supports no authentication or basic authentication only. |
SAP Event Mesh
License: Not in any license model, available as a custom add-on
Choose this for an SAP Event Mesh service instance on SAP BTP. It has two connections, Management API Destination and Messaging REST Destination, both normally filled from the service key, plus:
| Field | Description |
|---|---|
| Namespace | Namespace of the message client, as shown in the service key. Required. Int4 Suite only creates, reads and writes queues and topics under it. |
| Technical Queue Prefix | Prefix for the temporary queues that capture tests create per run (default INT4SuiteTech). One name segment: no /, spaces, * or >. |
See How to set up an SAP Event Mesh system for the step-by-step setup.
Field reference
Type-specific fields are documented under the matching type in System types above.
General information
| Field | Description |
|---|---|
| System Name | Unique name of the system. 1–40 characters: letters, digits, ., - and _, starting with a letter or digit. Unique regardless of case, and also not used by any environment (group) on the System Landscape page. |
| System Type | The kind of system, see System types. Chosen once; it cannot be changed later. |
| Description | Short free text (up to 100 characters) describing what the system is used for. |
| Production System | Marks a live production system. Connection checks then never send a test message to it, Business Object execution actions and Messenger refuse to send to it, and the dashboard judges it by read-only checks only. |
| Project Scope Id | Project scope the system belongs to. Only users with permissions on that scope can open, change, use or delete it. Leave empty for a system outside any scope, which needs permissions granted without a scope. |
List columns
| Column | Description |
|---|---|
| Name | The system's name; click it to open the system. |
| Description | The description. |
| Type | The system type. |
| Production | Yes for a production system, No otherwise. |
| Created By | E-mail of the user who created the system. |
| Created Date | When the system was created, shown relative to now (for example "3 days ago"). |
Use the search box to filter by name or description and the type drop-down to show one type. Export saves the visible columns to Excel or PDF.
Connection fields
Most connections — every one except the RFC connection and the Solace messaging connection — share these fields.
| Field | Description |
|---|---|
| Url | Address of the system with http:// or https://, for example https://api.example.com:8443. No query string or fragment. |
| Base Path | Optional path appended to the URL, for example /api/v1. |
| Network Route | Shown only when your installation is connected to SAP BTP Connectivity. SAP BTP Cloud Connector reaches an on-premise system through the Cloud Connector; the URL must then be the http:// virtual host configured in the Cloud Connector (the tunnel itself is encrypted). |
| Cloud Connector Location ID | Cloud Connector location, when your subaccount uses more than one. |
| Authentication Type | No Authentication, Basic Authentication, OAuth2 Client Credentials or API Key. |
Authentication fields
| Field | Description |
|---|---|
| Username / Password | User and password for Basic Authentication. |
| Token Url | Token endpoint for OAuth2 Client Credentials. |
| Client Id / Client Secret | Client credentials issued for the system. |
| Scope / Audience | Optional values some token endpoints require. |
| Key / Value | Name of the header or query parameter and the API key for API Key. |
| Add to | Send the key as a Header or in the Query Params. |
| Set empty | Shown next to a stored secret while editing. Clears the stored secret on save. |
Rate limiting
| Field | Description |
|---|---|
| Requests per Second | Highest sustained number of requests per second that Int4 Suite sends to the system, across all test runs and workers. Leave empty to use the type's default. |
| Burst Size | How many requests may go out at once before the per-second limit applies. |
Defaults: 10 requests per second with a burst of 5 for SAP Cloud Integration, HTTP Host, Solace PubSub+, SAP Advanced Event Mesh and SAP Event Mesh; 5 with a burst of 3 for SAP PI/PO. SAP ABAP Backend has no rate limit.
Tips & edge cases
- Connections are checked in the background. Every 15 minutes the platform runs the connection check on each configured connection of every system and shows the outcome on the Dashboard. On a system flagged as production nothing is ever sent to it: connections whose check would send a message — the SAP Cloud Integration runtime and the SAP Event Mesh messaging connection — are not checked, and the system counts as connected when its read-only connections answer. On other systems the SAP Cloud Integration runtime check posts a small test message and the SAP Event Mesh messaging check publishes its test message each time. A connection that keeps failing is retried less often (up to every two hours). When the system refuses the stored credentials, automatic checks of that connection stop until you save the system again or a manual check succeeds, so repeated failed logons cannot lock the technical user. Your administrator can switch the background check off for the whole installation.
- Opening a system depends on its project scope. You can open, edit, use or delete a system only with permissions on its project scope; a system without a scope needs permissions granted without a scope. The Edit, Copy and Delete buttons reflect your permissions on the open system.
- Type is locked after creation. If a system moves to a different platform — for example from SAP PI/PO to SAP Cloud Integration — delete the old entry and create a new one. This applies even to Solace PubSub+ and SAP Advanced Event Mesh, which use identical settings.
- Names are unique regardless of case.
QA_Backendandqa_backendcannot both exist, and a system cannot share its name with an environment on the System Landscape page. - Secrets never appear on this page. Passwords, OAuth client secrets, API key values and RFC passwords are stored in the secret manager configured for your installation and are never returned to the browser. A copied system does not take them over.
- Prefer Header over Query for API keys. A key in the query string travels in the request URL, where proxies, gateways and access logs routinely record it. Choose Header unless the target only accepts the key as a query parameter.
- What the production flag does — and does not do. It keeps test messages away from the system in connection checks, and Business Object execution actions and Messenger refuse to send to it. It does not block test case runs and adds no extra confirmation when you edit or delete the system — use roles and project scopes to control who can change production systems.
- A connection is the addressable half; the stage is configured elsewhere. Which stage of your landscape a system represents, and how it lines up with the same system in other stages, is set on the System Landscape page by placing it in an environment and a system line. That is what lets you re-point a test at another stage — for example to replay a captured result against an upgrade target — without editing the test or the connection.
- One connection per real system. Because tests reference connections indirectly, keep a single entry per real system and let every test share it. Near-duplicate connections make the landscape harder to reason about and to retarget.
- Slow systems may fail the check. A check waits 10 seconds (15 seconds for SAP Cloud Integration and SAP PI/PO) for an answer; this cannot be changed per system.
Related features
- System Landscape — place systems into environments and system lines so test cases can be retargeted between stages.
- PI/PO Objects — clean up PI/PO objects left behind on an SAP PI/PO system.
- Automation Objects — each automation object type needs a system of a specific type.
- Global Parameters — upload the SAP NW RFC SDK that SAP ABAP backend connections need.
- Dashboard — shows the connection status of every system.
Prerequisites & permissions
About permissions. What you can see and do is decided by the roles assigned to your user. Each role bundles permission groups, and each permission group allows activities — Read, Write, Delete, Execute and, for schedules, Change owner — on a kind of record (for example Test Case, Automation Object, System Under Test). A role grants its groups per project scope, so you may be allowed to change records in one project but only view, or not see, those of another.
If a button is disabled, a page says you don't have access, or a list comes back empty, missing permissions are the most likely cause — or, for whole product areas, the installed licence. You can review your own access under Profile → My access; an administrator can change your roles under IAM → Users.
| Action | Required permission |
|---|---|
| View the list and open a system | System Under Test: Read (on the system's project scope to open it) |
| Create or copy a system | System Under Test: Write on the chosen project scope |
| Edit a system | System Under Test: Write on its current scope, and on the new scope if you move it |
| Delete a system | System Under Test: Delete on its project scope |
| Check a connection | System Under Test: Execute |
Creating a system of a licensed type also needs the matching licence feature; see Licenses.