CSRF and connector authentication
Separate target authentication, SAP session state and payload errors.
A target authentication error is separate from authentication to DataMaker. First identify which service produced the error: DataMaker, the identity provider or the target system.
SAP CSRF errors
SAP write requests can require a CSRF token and matching session cookies obtained from the same service and authentication context. A token copied from another host or session may be rejected.
Verify the configured gateway/service URL, credentials and network path, then use the supported SAP connector flow to obtain the write session. If a proxy strips cookies or authentication headers, correct that routing behavior. Avoid repeatedly submitting a write until you know whether the target accepted it.
Basic, OAuth and bearer credentials
Check the credential type selected in the integration, account permissions and token endpoint configuration. For OAuth client credentials, verify client ID, secret and any required scope with your identity provider's administrator. A valid Jira token does not configure Xray; it has separate credentials.
A saved bearer token can expire. Use the supported refresh/configuration mechanism for the integration rather than embedding a copied token in scenario source.
Metadata or payload errors
A metadata authorization failure may mean the account cannot read the service catalogue. It is not fixed by changing generation options. Conversely, a required-property or business-validation error means the target received a payload it could not accept; inspect the target response and revise the mapping.
Safe diagnostics
Record status, hostname, operation and a redacted error. Do not paste authorization headers, session cookies or credential-bearing URLs into logs or tickets. See Connections and Self-hosted authentication.