Release Notes Release Notes
Go back

Bizagi SAP Cloud Platform Dispatcher

Released on 08/25/26

Description

The Dispatcher is the entry point for applications running in the SAP BTP Cloud Foundry environment. It routes requests to configured services, handles authentication, rewrites URLs, and forwards requests to other microservices.
 

In Bizagi, the Dispatcher routes requests to the destinations configured in SAP BTP, enabling communication with the OData services exposed by the SAP system.
 

To get started, download the latest Bizagi Dispatcher file.
 

The following sections describe the updates introduced in each version of the Bizagi SAP Cloud Platform Dispatcher.

In this version

Version 1.3.1

  • Added two new request headers:
    • isBoundAction: A flag indicating that a POST request targets an OData bound action.
    • endpointBoundAction: A URI-encoded target endpoint.

These headers allow the caller to signal that a POST request targets an OData bound action rather than a standard entity set operation.

  • Updated trailing slash handling for bound actions. When isBoundAction is set, trailing slash normalization is skipped to preserve the exact action URL required by SAP OData services.
  • Updated CSRF token retrieval for bound actions. The token is now retrieved from the service root, located two path levels above the action endpoint. This aligns with the SAP OData V4 contract and helps prevent 403 Forbidden errors.
  • Added support for SAP ETag requirements on instance-bound actions. When endpointBoundAction is provided and differs from the base path, the request is classified as an instance-bound action, and the If-Match: * header is automatically injected into the write request.
  • Updated transformGetResponse() to receive and evaluate the isBoundAction flag. When the flag is active, GET response data is returned as a structured object rather than being JSON-stringified, preserving the payload shape expected by bound action consumers.
  • Added the normalizeODataV2ServiceRootUrl() function. This function ensures that OData V2 service root GET requests with 5-segment paths matching /sap/opu/odata/{namespace}/{service} always include a trailing slash. This prevents 404 Not Found errors during service discovery calls caused by a missing trailing slash on the root endpoint.

Version 1.1.23

  • Fixed CSRF token handling for POST requests targeting SAP HANA Public Edition.
  • Corrected If Match header behavior to avoid incorrect usage in POST operations.
  • Centralized If Match header logic so it is only applied to PUT, PATCH, and DELETE requests, preventing 501 errors during POST executions.
  • Improved error logging with enhanced anonymization of sensitive data during POST method execution.
  • Added comprehensive error logging covering multiple failure scenarios, including response metadata, request configuration details, and CSRF token related errors.


Version 1.1.20

  • Adjusted POST method execution for OData V4 services.
  • Improved GET method handling to correctly process special characters in parameter values.


Version 1.1.19

General adjustments and performance improvements.


Version 1.1.18

  • Added support for OData V4 executions.
  • Added support for SAP S 4 HANA Public Edition environments.


Version 1.1.17

The dispatcher version is now displayed when accessing the root path.

Version 1.1.16

  • Fix(start.js): decode filters header before appending to baseUrl
    • Decoded URI-encoded ‘filters’ header received from Connector Service.
    • Ensured safe fallback if decoding fails.
    • Re-encoded decoded value when constructing baseUrl for GET requests.
    • Added log for final resolved baseUrl.

Version 1.1.15

Added the header “X-Requested-With”: “XMLHttpRequest” to ensure compatibility with CSRF requests in SAP.

Version 1.1.14

Removed the entity set from the base URL to properly retrieve x-csrf-token in POST actions

Version 1.1.13

Initialize proxyConfigM to prevent reference errors in Axios GET requests.

Version 1.1.12

Prevent server-side parameter pollution. Modified the isValidDestinationPath function to improve validation of the destinationPath parameter.

Version 1.1.11

Avoid server-side parameter pollution. Added a function to validate the path parameter that reaches the dispatcher and avoid unsafe characters.

Version 1.1.10

Added environment variables to get the correct names of the dispatcher bound services. The protocol property of the headers where the proxy information was located was removed, since it was not necessary.

Version 1.1.9

HTTP Security Headers Improvements (Missing X-Frame-Options, Content-Security-Policy, Cache-Control).

Version 1.1.8

Improved logs to anonymize sensitive information.

Version 1.1.7

In the Patch method security was added to verify token and log messages were improved.

Version 1.1.6

Values with sensitive information were removed so that error logs with that information are not created in the BTP and are not returned to Bizagi.

Version 1.1.5

Upgraded @sap/xssec version to 3.6.0.

Version 1.1.4

New way to deploy the dispatcher in SAP Cloud BTP.

Version 1.1.3

  • The way to obtain the authorization X-CSRF-Token before making the final request has been modified.
  • Return request headers to the connector service.
  • Improvement in destinationPath. Now is sent Location ID in headers when is necessary.
  • The filters are scaped to support special characters.
  • Were added the special SAP headers in the POST methods and was implemented a logical to send headers in status code 204 because this code does not have content to send a body.
  • Was implemented specific handling of headers for CREATE, UPDATE and PATCH method when status code is 204.
  • Refactor en code.
  • Improvements and new logs.
  • Updated to node js version 18.

Version 1.1.2

  • Added location Id header to Basic Authentication. This makes it possible to connect to configurations that use a different locationId.
  • Added location Id header to Basic Authentication (TM24640).

Version 1.1.1

  • Replaced request library by axios, which improves the speed and efficiency of requests in the application.
  • Updated dependencies of several libraries used in the application, which improves the security and stability of the application.
  • Replaced request library (deprecated: https://www.npmjs.com/package/request) by axios
  • Updated “express” dependencie to “4.18.2”
  • Updated “pug” by “Jade”
  • Updated “pg-promise” dependencie to “11.0.2”
  • Updated “body-parser” dependencie to “1.20.1”
  • Updated “passport” dependencie to “0.6.0”

Version 1.1.0

  • Update to SAP Cloud Connector: Bizagi integrates with SAP S/4 HANA, ECC, or R/3 systems using the SAP Cloud Platform. It has been enhanced with a new set of security features, using OAuth based authentication, that helps secure access to the Bizagi Dispatcher for SAP Cloud connector.
  • Added Authentication and Authorization feature.

Version 1.0.3

  • Updated several dependencies of libraries used in the application, which improves the security and stability of the application.
  • Updated node version to ^16 in package.json
  • Updated @sap/xssec dependency to ^3.2.13
  • Updated @sap/xsenv dependency to ^3.3.2
  • Added validation to get environment and use logger component
  • Removed JWT logs and other user data

Version 1.0.2

  • Added extra logs to view more details of incoming requests in Cloud Foundry, which helps developers debug issues with requests.
  • Removed an unnecessary option in the start command, which improves the efficiency of the application.
  • Added extra logs to view more details of incoming request in cloud foundry
  • some code comments were removed
  • Removed “–inspect” option on start command
  • Removed “/destinations” data sensitive endpoint from configured destinations