What are the most asked SAP CPI interview questions on iFlows, adapters, Groovy scripts, security and monitoring, with clear answers?

SAP CPI interview questions usually cover seven areas: platform basics, I flow design, mapping, adapters, Groovy scripting, security and monitoring.

SAP CPI, officially called SAP Cloud Integration and part of SAP Integration Suite, is a cloud middleware that moves data between SAP and non-SAP systems. Interviewers test whether you can explain a concept, build it and fix it when it breaks.

The talk moves quickly from definitions to live scenarios.

One minute you are explaining what an iFlow is, and the next you are asked why your SFTP adapter keeps failing at 2 AM. This guide answers the most common questions the way a working consultant would say them out loud.

Questions are grouped by topic and roughly by difficulty.

Beginners should start at the top; experienced candidates can jump to mapping, Groovy, security and monitoring, where interviewers separate average candidates from strong ones. Read each answer, then say it again in your own words.

Key Takeaways for SAP CPI Interviews

• What it is: the integration capability of SAP Integration Suite, running on SAP Business Technology Platform (BTP).
• Core building block: the integration flow (iFlow), made of a sender, processing steps and a receiver.
• Most-asked topics: headers versus properties, Content Modifier, Router versus Multicast, exception handling, Groovy basics, security roles and log levels.
• Best preparation: build three small iFlows on a trial account and answer aloud with a real example.

Part 1: Basic SAP CPI Interview Questions

1. What is SAP CPI and why do companies use it?

SAP CPI (Cloud Integration) is cloud-based middleware that moves data between systems such as SAP S/4HANA, SuccessFactors, Ariba, Salesforce, banks and file servers. Companies use it because they do not maintain their own integration servers, new connections are often built faster than on-premise tools, and it ships with ready-made adapters and prepackaged content. Older material calls it "SAP Cloud Platform Integration"; that name has been retired.

2. What is the difference between SAP PI/PO and SAP CPI?

PI/PO is installed on your own servers, so you handle patching, hardware and upgrades. CPI runs in the cloud and SAP operates the platform. PI/PO uses a separate Integration Repository and Integration Directory, while CPI offers a single web designer where you build and deploy the iFlow. CPI suits cloud-to-cloud scenarios, and PO still runs many heavy on-premise landscapes.

Expect a follow-up on lifecycle. Migration partners report that mainstream maintenance for SAP Process Orchestration 7.5 ends on 31 December 2027, with optional extended maintenance to 31 December 2030, and that SAP positions Integration Suite as the target. Confirm the dates on SAP's official lifecycle pages before quoting them.

3. What is a tenant, and how do the design workspace and runtime differ?

A tenant is your own isolated environment on the platform, usually one for test and one for production. The design workspace is where you create packages and iFlows. The runtime is where deployed iFlows process messages. You build in design, deploy to runtime and watch the result in monitoring.

4. What is an iFlow?

An integration flow is the visual model of how a message travels from a sender to one or more receivers. It holds the sender channel, the processing steps and the receiver channel. When you deploy it, CPI turns the diagram into a running process.

Part 2: iFlow Interview Questions

Most interview time goes here. Expect scenario questions rather than definitions.

5. What is the difference between headers and properties in CPI?

Both hold values during processing, but they live differently. Headers travel with the message, and many adapters pass them to the receiver, so a careless header can leak into the outbound HTTP call. Properties stay inside the exchange for the life of the process and are never sent on their own. Use properties for internal values and headers only when the receiver needs them.

6. How does the Content Modifier work?

The Content Modifier sets or changes headers, properties and the message body. Values can come from a constant, an XPath expression, a header, a property or an expression such as ${header.OrderId}. It is the most-used step in CPI, so prepare a real example, such as reading an order number from the payload and storing it in a property for logging.

7. What is the difference between a Router and a Multicast?

A Router sends the message down one path, the first condition that is true, with a default route as fallback. A Multicast sends the same message down every branch, either in sequence or in parallel. Use a Router when a business rule picks one outcome, and a Multicast when several systems need the same data.

8. Explain the Splitter and Gather steps.

A Splitter breaks one large message into smaller ones, for example one order file into single orders using an XPath on the item node. Each piece runs through the same steps, and a Gather joins the results at the end. Parallel processing speeds this up but can change message order.

9. How do you handle errors inside an iFlow?

Use an Exception Subprocess. When a step fails, control moves there, and you can build an error message, send an alert, write to a data store or call another system. Read the failure text with ${exception.message}. Without it, the message simply ends as failed and you depend on monitoring alone.

10. What is the difference between a Data Store, Variables and JMS queues?

A Data Store keeps whole messages or records for later reading, which helps with duplicate checks. A Variable keeps a single value between runs, such as the last successful timestamp for a delta load. A JMS queue holds messages for reliable asynchronous delivery with retry and a dead letter queue. JMS depends on your licence, so check first.

11. What is the ProcessDirect adapter and when do you use it?

ProcessDirect connects two iFlows on the same tenant without leaving the platform. It suits reusable logic: one common iFlow handles logging and alerts, and ten others call it. It avoids an HTTP hop and keeps the design tidy.

12. How do you make an iFlow idempotent?

Idempotent means a message sent twice does not create the data twice. Use the Idempotent Process Call step, which checks a unique ID, such as an order number or message ID, against an internal repository. If the ID was already processed, the step flags the message as a duplicate so the iFlow can skip it or raise an alert.

13. What is the difference between Request-Reply and Content Enricher?

Request-Reply calls an external system and makes its response the new message body, replacing the original. Content Enricher calls a source too, but merges the result into the original message instead of replacing it. Choose Request-Reply when you only need the answer, and Content Enricher when you need both the original data and the lookup data in one payload.

Part 3: Mapping Interview Questions

14. Which mapping options does CPI offer?

CPI offers Message Mapping, a graphical mapper for XML-to-XML and JSON transformations, XSLT Mapping for complex XML restructuring, and Groovy for logic that neither handles cleanly. Pick the simplest option that works.

15. What is a Value Mapping and when do you use it?

A Value Mapping translates codes between systems, for example country "DE" in one system to "GER" in another. It keeps lookups out of the logic, so a business user can change a value without touching the iFlow. Store it in the package next to the iFlow that uses it.

16. How do you debug a mapping that gives the wrong output?

Check the input first, because most mapping bugs start there. Run the iFlow with Trace on to see the payload before and after the mapping step, then compare field by field. Empty nodes, namespaces and repeating structures cause most surprises.

Part 4: Adapter Interview Questions

17. What is the difference between sender and receiver adapters?

A sender adapter starts the flow. It receives a call (SOAP, HTTP) or polls a source (SFTP, Mail, JDBC). A receiver adapter sends the processed message to the target. Some adapters, such as SFTP, exist on both sides but behave differently: on the sender side you worry about polling, file patterns and post-processing, and on the receiver side about the target folder and file naming.

18. How does the SFTP sender adapter work, and what can go wrong?

It polls a directory at a set interval, reads files matching a name pattern and then deletes, archives or renames them. Common problems are a wrong host key, an expired private key in the keystore, a firewall blocking the CPI IP range, and files still being written when CPI picks them up. For the last one, ask the sender to write a temporary name and rename the file when complete.

19. How do you connect CPI to an on-premise system?

Install SAP Cloud Connector inside the company network. It opens a secure outbound tunnel to your BTP subaccount, so no inbound firewall port is needed. In the receiver adapter, set the proxy type to On-Premise and use the virtual host and port defined in Cloud Connector.

20. Explain the IDoc adapter and the usual backend setup.

On the receiver side, CPI sends the IDoc over SOAP to the SAP system, which needs a SOAP-based IDoc endpoint with authentication. On the sender side, the SAP system needs an RFC or HTTP destination, a logical system, a partner profile and an outbound port pointing to CPI. An incomplete partner profile is a common mistake and leaves the IDoc in status 30.

Part 5: Groovy Script Interview Questions

Groovy appears whenever standard steps cannot do the job. You do not need to be a full-time programmer, but you must read and write short scripts calmly.

21. Why do we use Groovy scripts in CPI?

For logic that mapping and standard steps cannot handle, such as complex string handling, custom logging, date calculations and deeply nested JSON. Use a standard step when one exists, because scripts are harder to maintain.

22. What does a basic Groovy script look like?

Every script has a processData method that receives and returns a Message object:

import com.sap.gateway.ip.core.customdev.util.Message

def Message processData(Message message) {

def body = message.getBody(String)

def orderId = message.getHeaders().get("OrderId")

message.setProperty("OrderId", orderId)

message.setBody(body.trim())

return message

}

23. How do you read and set headers and properties in a script?

Read a header with message.getHeaders().get("Name") and a property with message.getProperty("Name"). Write them with message.setHeader("Name", value) and message.setProperty("Name", value). Many candidates mix these up, so practise until it feels natural.

24. How do you parse XML and JSON in Groovy?

For XML, use XmlSlurper or XmlParser and read nodes with dot notation, such as root.Order.Item.size(). For JSON, use JsonSlurper to read and JsonOutput to write:

import com.sap.gateway.ip.core.customdev.util.Message

import groovy.json.JsonSlurper

import groovy.json.JsonOutput

def Message processData(Message message) {

def data = new JsonSlurper().parseText(message.getBody(String))

data.status = "PROCESSED"

message.setBody(JsonOutput.toJson(data))

return message

}

25. How do you add custom logging to the message processing log?

Use the messageLogFactory that CPI provides inside scripts. Attach a string so the payload is visible in monitoring, and add custom header properties to search by later. The attachment below is for test systems only. Never log passwords or personal data, and switch payload logging off in production.

def messageLog = messageLogFactory.getMessageLog(message)

if (messageLog != null) {

// TEST ONLY: remove payload attachments before production

messageLog.addAttachmentAsString("Payload", message.getBody(String), "text/plain")

messageLog.addCustomHeaderProperty("OrderId", message.getProperty("OrderId"))

}

26. How do you raise an error on purpose, and what mistakes are common?

Throw an exception with a clear text, such as throw new Exception("Order number is missing"). The flow moves to the Exception Subprocess and the text appears in the monitor. Common mistakes are forgetting to return the message, loading a large body into memory as a string, leaving payload logging on in production and ignoring null values. Script changes need a redeploy.

Part 6: Security Interview Questions

Security comes up in almost every senior round, because one wrong setting can expose business data. Answer calmly and name the real components.

27. What authentication options does CPI support for inbound calls?

The main options are Basic authentication, OAuth 2.0 client credentials and client certificates. SAP recommends OAuth or certificates over Basic). The sender adapter's Authorization setting checks the caller against a role, most commonly ESB Messaging. send. If the caller lacks that role, the call returns a 403 error.

28. What is the Keystore and how do you manage certificates?

The Keystore holds the tenant's private keys and certificates along with trusted certificates of other systems. You can upload, renew and back up entries there. Certificates expire, so keep a list of expiry dates and renew before the outage, not after it.

29. What is the difference between transport-level and message-level security?

Transport-level security (HTTPS and TLS) protects the connection while the message travels. Message-level security protects the content itself using signing and encryption, such as PKCS7, PGP or XML signature, so it stays protected even when stored in a file or queue. Banking scenarios usually need message-level security.

30. How do you store passwords and secrets safely?

Create them as Security Material, such as a User Credentials artifact, a Secure Parameter or an OAuth2 Credentials artifact, and refer to them by alias in the adapter. Never hard-code a password in a script, header or property.

31. How do you control who can do what on the tenant?

Through roles and role collections assigned in the BTP cockpit. Typical setups separate design, monitoring and administration. Follow least privilege: developers get design rights, support teams get monitoring rights and only a few people get full access.

Part 7: Monitoring and Transport Interview Questions

32. How do you monitor messages in SAP CPI?

Open Monitor Message Processing, filter by time, status, iFlow name or custom header, and open a message to see its processing log. The common statuses are Completed, Failed, Retry, Escalated, Processing and Abandoned.

33. What are the log levels, and which one do you use in production?

The levels are None, Info, Debug and Trace. Info is the normal choice for production. Debug adds detail for testing. Trace stores the payload after every step, which is excellent for finding mapping errors, but it is active only for a short time because it can slow the system and expose sensitive data.

34. A message failed. How do you find the root cause?

Open the message, read the error text at the top, then find the red step in the Log tab. Check the payload before that step using attachments or a trace. Then ask three questions: was the input wrong, was the mapping wrong, or was the target unavailable? Most failures fall into one of these three buckets.

35. How do you manage retries and stuck messages?

With JMS queues, failed messages go through a retry cycle and then to a dead letter queue, where you can review and restart them from Manage Message Queues. A sender adapter such as SFTP retries on the next poll. For HTTP callers, the sending system must retry.

36. How do you get alerts when an iFlow fails?

The simple way is a Mail step in the Exception Subprocess. Larger setups connect CPI to SAP Cloud ALM or the Alert Notification service, so the support team receives one alert for all failures instead of checking the monitor each morning.

37. How do you move iFlows from test to production?

Export the package and import it into the production tenant, or use a transport service such as Cloud Transport Management for a controlled, auditable path. Then update externalized parameters, such as URLs and credential aliases, for the new environment. Never edit production iFlows directly.

How Should You Prepare at Each Experience Level?

• Beginners: learn the vocabulary (tenant, package, iFlow, adapter, header, property), then build three small flows on a trial account.
• Two to four years: practice scenario answers and be ready to explain one project, including a failure you fixed.
• Five years and above: expect design questions on JMS, large files, splitting work between iFlows, transports and certificate renewals.
• All levels: speak in examples. An answer that starts with "In my last project" beats a textbook line.

Conclusion

SAP CPI interview questions are not about knowing every feature. They test whether you understand how data moves, how it breaks and how you fix it calmly. If you can explain headers versus properties, build a clean Exception Subprocess, choose the right mapping option, write a short Groovy script and read a failed message log without panic, you are ahead of most candidates.

Pick five questions a day, answer them out loud, then try the same thing in a real flow. If you would like guided practice with trainers who work on live integration projects, explore our SAP CPI training program. For product details, the SAP Help Portal for Cloud Integration is the best reference to keep open while you practice.

About the Author

[Author name] is a [job title] at TechBrainz with [number] years of experience on SAP integration projects, including SAP Cloud Integration. This article was reviewed by [Reviewer name] and reflects the product as of November 2026. SAP features, plans and licenses change, so check SAP's documentation before relying on any detail in a project.