The Web service runtime executes an authority check for every Web service invocation; this is similar to authority checks for starting a transaction or remotely calling an RFC function. For Web service calls, the authorization object S_SERVICE is used. Users are granted permissions by assigning the Web service operations to a role in transaction PFCG.

Due to a length restriction, the fields of authorization object S_SERVICE cannot include a meaningful name of the Web service and of the operation. Therefore, the Web service authorizations cannot be manually assigned to a role, but must be assigned through transaction PFCG. Instead of Web service name and operation names, the fields include only hash values. For each combination of Web service name and operation, a hash value is generated the first time a Web service call is performed, based on the specific authorization.

In order to be able to maintain operation-specific authorization for Web service calls, you need to know the hash values for the different combinations of Web service and operation.