winget install --id=kts982.SAPODataExplorer -e Desktop explorer for SAP OData services: catalog discovery across V2/V4, metadata and annotation browsing with a Fiori-aware SAP view, query building and execution with an HTTP trace inspector, and an offline EDMX library for browsing hand-carried $metadata files without a network connection. Not affiliated with SAP SE.
> A focused SAP OData explorer for real systems, with catalog discovery, metadata browsing, and query tooling.
> [!TIP] > 📸 Take the visual tour in the Showcase before reading further — system setup, SAP View annotation overlay, F4 value-help picker, Fiori-readiness linter, and pre-flight validator. Screenshots before commitment.
A CLI tool and desktop app for exploring and testing SAP OData services against real customer systems. It supports OData V2 and V4, SAP Gateway catalog discovery, and three common authentication modes: basic auth, Windows SSO (Kerberos / SPNEGO), and browser-based SSO (Azure AD / SAP IAS / SAML flows).
> [!NOTE] > Early-stage project. Core workflows work end-to-end on real SAP systems, but packaging, docs, and polish are still evolving. > > This is an independent project and is not affiliated with, endorsed by, or sponsored by SAP SE.
Working with SAP OData often means choosing between SAP-native tools that are awkward to use and generic API clients that do not understand SAP conventions.
/IWFND/GW_CLIENT) is useful, but dated and tied to a single SAP session.sap-client, Gateway catalogs, or OData V4 service discovery.This project is aimed at a narrower problem: understand a real SAP OData service quickly, query it safely, and move on.
$select, $expand, $filter, $orderby, $top, and $skip interactively$expand--verbose/IWFND/MAINT_SERVICE, /IWFND/ERROR_LOG, ST22, or the browser SSO sign-in flow when appropriatePath references, and emits ABAP CDS fix hints pointing at the source annotation. Severity levels filter the output. Available in the CLI (sap-odata lint) and the desktop describe panel.API_WAREHOUSE_2 and resolve it from the catalogGo to the Releases page and pick the latest tag. Each release attaches the following assets:
| Asset | What it is | When to use |
|---|---|---|
SAP-OData-Explorer__x64_en-US.msi | Desktop app installer (MSI) | Easiest path. Double-click, install, launch from the Start menu. |
SAP-OData-Explorer__x64-setup.exe | Desktop app installer (NSIS) | Alternative installer with different uninstall hooks. |
SAP-OData-Explorer__portable.exe | Desktop app, no install | Locked-down environments (Citrix, no-admin laptop, customer VM). Copy and run — no installer, no admin required. |
sap-odata.exe | CLI tool, no install | Scripting, CI, or terminal use. Put on your PATH and run sap-odata setup. |
SHA256SUMS.txt | Checksums | Verify downloads with Get-FileHash -Algorithm SHA256 and compare. |
The CLI and the desktop app share the same connections.toml and Windows Credential Manager entries — no need to duplicate profiles between them.
> [!WARNING] > Binaries are unsigned. Windows SmartScreen will show an "unrecognized app" warning — click More info → Run anyway. Code signing is planned.
Cargo (CLI, any OS with Rust 1.85+ — builds from source, no SmartScreen involved):
cargo install sap-odata-cli
# → `sap-odata` on your PATH
WinGet (Windows — desktop app, MSI):
winget install kts982.SAPODataExplorer
Scoop (Windows):
scoop bucket add kts982 https://github.com/kts982/scoop-bucket
scoop install sap-odata # CLI
scoop install sap-odata-explorer # Desktop app (portable)
Prerequisites: Rust 1.85+ (rustup.rs) and Node.js 20+ (for the desktop app frontend build).
git clone https://github.com/kts982/sap-odata-explorer.git
cd sap-odata-explorer
# CLI only — fast
cargo build --release -p sap-odata-cli
# → target/release/sap-odata(.exe on Windows)
# Desktop app — slower, especially on first build
cd tauri-app
npm install
cargo tauri build
# → ../target/release/bundle/msi/ (Windows installer)
# → ../target/release/bundle/deb/ (Linux .deb)
# → ../target/release/bundle/macos/ (macOS .app)
See CONTRIBUTING.md for development setup, tests, and contribution guidelines.
Profiles, aliases, and (optionally) plaintext-fallback passwords are stored in connections.toml. The CLI and the desktop app read the same file.
| Mode | Path |
|---|---|
| Default | %APPDATA%\sap-odata-explorer\config\connections.toml on Windows · ~/.config/sap-odata-explorer/connections.toml on Linux · ~/Library/Application Support/sap-odata-explorer/connections.toml on macOS |
| Portable | A connections.toml placed next to the exe takes precedence — useful when running from a USB stick or a copied folder on a locked-down machine. |
Run sap-odata profile where to print the exact path in use. Basic-auth passwords are stored in the OS keyring by default — see Security notes below.
+ next to the profile dropdown to add a system. Use ✎ to edit an existing profile (URL, password, auth mode) or − to remove it. Profile name and basic-auth username are locked on edit — both feed the keyring entry key, so changing them = delete + re-add./IWFND/CONFIG V4 node off — a common customer config), the sidebar shows a hint to paste the full /sap/opu/odata4/... path directly into the search box.$select, navigation properties to $expand → Run$metadata under a (offline) bucket; Import EDMX opens a file picker for EDMX files hand-pulled outside the tool. Offline profiles appear in the picker with an [OFFLINE] badge; selecting one lets you browse the cached services normally — Run / query / value-help are disabled (no network), and each cached row has a ✕ to remove it from the library.# Easiest path: guided setup
sap-odata setup
# Then browse and query
sap-odata -p DEV services -f warehouse
sap-odata -p DEV -s API_WAREHOUSE_2 entities
sap-odata -p DEV -s API_WAREHOUSE_2 describe Warehouse
sap-odata -p DEV -s API_WAREHOUSE_2 run Warehouse --top 5
# Any command with --verbose prints the full HTTP trace to stderr
# (same data as the desktop app's Inspector, with auth headers redacted).
sap-odata -v -p DEV -s API_WAREHOUSE_2 run Warehouse --top 1
# Offline mode — capture from a live system or import a file from disk
sap-odata -p DEV -s API_WAREHOUSE_2 offline save # cache $metadata under DEV (offline)
sap-odata offline import ./from-customer.edmx # ingest a file the user already has
sap-odata offline list # list buckets
sap-odata offline list --profile "DEV (offline)" # list services in a bucket
sap-odata offline delete --profile "DEV (offline)" # remove a bucket (asks for confirm)
If you prefer scripted setup, sap-odata profile add ... is still available for direct profile creation.
| Command | Purpose |
|---|---|
setup | Interactive wizard to add a new SAP system |
signout | Clear persisted Browser SSO session |
profile list/add/remove/test/where | Manage saved SAP systems |
alias add/list/remove | Per-profile short names for services |
services | List available OData services from the catalog |
entities | List entity sets in a service |
describe | Show properties, keys, nav properties, labels |
functions | List function imports / actions |
build [query] | Dry-run: print the OData URL, no HTTP call |
run [query] | Execute query, show results as table |
metadata | Dump raw $metadata XML |
verify | Smoke-test every entity set with a small $top probe; exit code reflects failures (CI-friendly) |
lint [] | Fiori-readiness checklist — check a service's annotations against list-report / object-page expectations, with ABAP CDS fix hints. --min-severity pass|warn|miss to filter. |
annotations | List every SAP/UI5 annotation parsed from $metadata, grouped by vocabulary. --namespace / --filter to narrow. |
offline save | Cache the connected service's $metadata for offline browsing. Requires -p PROFILE -s SERVICE. |
offline import | Import an EDMX file (API Hub, GW_CLIENT, curl dump). No connection needed. --offline-profile NAME to target a specific bucket. |
offline list [--profile NAME] | List offline buckets, or services within one. |
offline delete --profile NAME [--service-id ID] | Remove a whole bucket or one service. -y skips the confirm prompt. |
See CLI-REFERENCE.md for all options (or run sap-odata --help).
The CLI is deliberately agent-friendly: --json on every command, clean
stdout (banners and HTTP traces go to stderr), meaningful exit codes, and a
strictly read-only SAP surface. skills/sap-odata-cli/SKILL.md
is a ready-made skill that teaches a coding agent the safe workflows —
discovery, describe, queries, lint, offline EDMX — plus the failure
playbook (SSO expiry, keyring states, unpublished V4 catalogs).
For Claude Code, copy the folder into your skills directory:
# personal (all projects) # or per-project
~/.claude/skills/sap-odata-cli/ /.claude/skills/sap-odata-cli/
For other agents (Cursor, Codex, ...), reference the file from your rules /
AGENTS.md. The skill assumes profiles already exist — agents are told to
never run the interactive setup wizard and never to handle passwords.
The CLI has an interactive wizard for adding profiles:
sap-odata setup
This walks through profile name, URL, client, language, auth method, and credentials where needed. For Basic and Windows SSO profiles it can also test the connection immediately.
For Browser SSO, the wizard saves the profile, but the first interactive sign-in happens from the desktop app. After that, the CLI reuses the persisted session automatically.
For Browser SSO profiles, the desktop app and CLI work together:
sap-odata setup or from the desktop app.Typical flow:
sap-odata -p PRD services
sap-odata -p PRD -s API_X run ...
# Clear the persisted CLI session:
sap-odata signout PRD
The desktop app also has a Sign Out button for Browser SSO profiles. That clears the persisted session and local webview cookies for SAP and common IdP hosts.
Sessions still expire server-side. When that happens, the CLI tells you to sign in again from the desktop app. If a profile's base_url, client, or language changes, any persisted Browser SSO session is treated as stale and discarded automatically.
insecure_tls = true in the profile's connections.toml.sap-odata signout clears the persisted Browser SSO session; the desktop app's Sign Out also clears local webview cookies for SAP and common IdP hosts.Use this tool only with SAP systems and endpoints you are authorized to access. SAP's API Policy distinguishes published/documented APIs from internal or private interfaces and describes API controls for availability, limits, security, bulk extraction, and automated use.
sap-odata-explorer is intended for human-driven inspection and testing of documented SAP OData services or customer-owned services. It is not intended to bypass SAP API controls, access internal/private SAP APIs, perform large-scale data extraction, or act as an autonomous API-calling agent.
The short version: other tools treat an SAP OData service as generic REST. This one reads the SAP/UI5 annotations that come with the service, renders results the way a Fiori app would, and flags Fiori-readiness gaps with ABAP CDS fix hints.
| Tool | Where it fits |
|---|---|
| SAP Gateway Client | Better suited to backend QA replay inside SAP. sap-odata-explorer runs cross-platform, discovers V2+V4 catalogs, overlays a Fiori-aware view from the service's own UI5 annotations (column order, filter chips, F4 pickers, Capabilities.* restrictions), and lints for Fiori-readiness with ABAP CDS fix hints — GW Client shows the raw OData response. |
| SAP Business Accelerator Hub | Better suited to official SAP API browsing and SDK downloads. sap-odata-explorer works against live customer systems and custom services, with annotation-driven rendering and a Fiori-readiness linter — things reference docs can't provide. |
| Postman / Insomnia / Bruno / Hoppscotch | Better suited to broad API workflows, collections, and collaboration. sap-odata-explorer is focused on SAP specifics — CSRF handling, sap-client, Gateway catalog discovery — reads UI5 annotations to render results the way a Fiori app would, and lints annotations for dangling references and missing Fiori expectations. Generic HTTP clients don't attempt any of this. |
The CLI is scriptable by design (stable subcommands, exit codes, --verbose trace output) and composes cleanly with shell pipelines, CI steps, or external wrappers — so while the tool is aimed at human-driven exploration, nothing stops you from invoking it from higher-level automation when that's what you need.
Best fit: "I need to quickly understand and query this SAP OData service."
sap-odata-explorer/
├── crates/
│ ├── core/ # Shared library (auth, HTTP, metadata, query, catalog, config, SSO)
│ └── cli/ # CLI binary
└── tauri-app/
├── src/ # Frontend (HTML + Tailwind + vanilla JS)
└── src-tauri/ # Tauri commands wrapping core
The sap-odata-core crate holds all protocol logic. CLI and Tauri are thin wrappers. This makes it easy to add a third frontend later (MCP server, web app, etc.).
Not a commitment — priorities may shift. Open issues track current focus.
Legend: [x] done · [-] partial / in progress · [ ] planned
sap:value-list → infer *_VH entity set → drive the picker)See CONTRIBUTING.md. Bug reports, PRs, and discussions welcome.
MIT — see LICENSE.
$metadata from a connected system, or import an EDMX file from disk (API Hub download, GW_CLIENT "Save Response", curl > out.xml). Cached services browse through the same UI as live ones — describe, lint, annotations, all work without network access. The route-around for customer sites where the unsigned exe can't be installed on the SAP host: pull $metadata over curl / /IWFND/GW_CLIENT / browser, hand the file to a consultant running the explorer on their own laptop.