Figaf is connecting to CPI instances using the S-users or similar defined in the SAP authentication management.
You would need to give the S-user access to the following roles
You can check the S-user works on your landscape by using the following appoach
- Go to https://xxxx-tmn.hci.eu1.hana.ondemand.com/cxf
- Login with the S-user
- Go to https://xxxx-tmn.hci.eu1.hana.ondemand.com/itspaces
- Now you have access as the S-Users to your CPI system
It is the same approach Figaf is using to logon to your system.