How To Fix CM_SUB_API009 - Authorizations for object &1 are inconsistent (return value: &2)

SAP Error Message - Details

• Message type: E = Error

• Message class: CM_SUB_API - API Substance

• Message number: 009

• Message text: Authorizations for object &1 are inconsistent (return value: &2)

What causes this issue?

The authorization object or the authorizations stored in your system are
not consistent.
Depending on the return value, the following problem exists (excerpt
from ABAP documentation):
Return Value ,,Meaning
8 ,,: The number of parameters (fields, values) is too great
(maximum 10).
24 ,,: The field names of the check call do not match the
field names of an authorization. Either the authorization (variant) is
incorrect or the call of the authority check.
28, 32 or 36 ,,: A faulty authorization exists in the user master.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

INCLUDE EHS_NA_ADMIN OBJECT DOKU ID TX

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message CM_SUB_API009 - Authorizations for object &1 are inconsistent (return value: &2) ?

  The SAP error message CM_SUB_API009 indicates that there are inconsistencies in the authorizations for a specific object. This error typically arises when a user attempts to perform an action that requires certain authorizations, but the system detects that the authorizations are not properly configured or are inconsistent.
  Cause:
  
  Missing Authorizations: The user may not have the necessary authorizations for the specified object.
  Inconsistent Roles: The roles assigned to the user may not align with the required authorizations for the action being performed.
  Profile Issues: There may be issues with the authorization profiles assigned to the user.
  Changes in Authorization Objects: If there have been recent changes to the authorization objects or roles, it may lead to inconsistencies.
  Transport Issues: If roles or authorizations were transported from one system to another, inconsistencies may arise if not all necessary objects were included.
  
  Solution:
  
  
  Check User Authorizations:
  
  Use transaction code SU01 to check the user’s authorizations.
  Review the roles assigned to the user and ensure they include the necessary authorizations for the object in question.
  
  
  
  Analyze Authorization Objects:
  
  Use transaction code SU53 immediately after the error occurs to analyze the authorization check. This will show which authorization object is missing or inconsistent.
  Review the authorization object in question and ensure that the user has the required values.
  
  
  
  Adjust Roles:
  
  If the user is missing the necessary authorizations, you may need to adjust the roles assigned to the user or create a new role that includes the required authorizations.
  Use transaction code PFCG to modify roles and add the necessary authorization objects.
  
  
  
  Consistency Check:
  
  Perform a consistency check on the roles and profiles using transaction SUIM to identify any inconsistencies.
  
  
  
  Transport Check:
  
  If the issue arose after a transport, verify that all necessary roles and authorizations were included in the transport request.
  
  
  
  Consult with Security Team:
  
  If you are not authorized to make changes, consult with your SAP security team or administrator to resolve the authorization issues.
  
  
  
  Related Information:
  
  
  Transaction Codes:
  
  SU01: User Maintenance
  SU53: Display Authorization Check
  PFCG: Role Maintenance
  SUIM: User Information System
  
  
  
  Authorization Objects: Familiarize yourself with the specific authorization objects related to the transaction or action being performed.
  
  
  Documentation: Review SAP documentation or notes related to authorization management for further insights into best practices and troubleshooting steps.
  
  
  By following these steps, you should be able to identify and resolve the inconsistencies in authorizations that are causing the CM_SUB_API009 error.