12 / MANUFACTURING / SAP INTEGRATION & RPA

Multi-tenant platform that reads scanned SAP documents with AI and posts them straight into SAP over a self-healing VPN tunnel.

Client: Manufacturing company running SAP ERP

Tags: Manufacturing · SAP · RPA · Document Automation · Multi-Tenant

// Problem

Purchase requisitions, sales quotes, and invoices arrived as scanned PDFs, and someone had to read each one and key it into SAP by hand, field by field. SAP's own APIs sit behind a CSRF-token handshake and, for this client, a VPN tunnel to an on-prem instance — not something a simple integration script could just point at.

// Our Solution

A multi-tenant RPA platform that reads documents with AI and posts them straight into SAP. Each organization's integration logic is resolved dynamically at request time, so a new client is a configuration change rather than a rebuild. Incoming PDFs are read by GPT-4o Vision using an extraction prompt generated directly from SAP's own field definitions, and a dedicated watchdog service keeps the client's VPN tunnel to their on-prem SAP instance alive around the clock.

// Technical Details

Dynamic Module Router

A single API endpoint resolves `{org}.{module}.{action}` to a runtime-imported, organization-specific handler, checking a permission string and a per-org module-enablement flag before dispatch.

Document Extraction

Multi-page PDFs are rendered to images, concatenated into one, and read by GPT-4o Vision. The extraction prompt is generated directly from the SAP field dataclasses, so the JSON returned always matches SAP's exact expected schema.

SAP OData Integration

Posting to SAP replicates its CSRF-protected OData handshake exactly: a token fetch, then an authenticated POST in the same session, matching SAP's required headers and parameters field for field.

VPN Watchdog

A standalone FastAPI service manages the OpenFortiVPN tunnel to the client's on-prem SAP instance, with a 60-second self-healing monitor that reconnects automatically unless manually turned off.

Multi-Tenant Administration

Organizations, users, API keys, module enablement, and per-org credentials sit on a fine-grained permission model, managed through role-scoped Super Admin and tenant Admin dashboards.