To enable an external system, such as a SOAP client, to send messages to an integration flow endpoint in SAP Cloud Integration, the calling user's credentials must be assigned the ESBMessaging.send role. This standard authorization role grants the necessary permission to post messages to the tenant's messaging runtime engine for processing. Without this specific role, the inbound call will fail with an authorization error (HTTP 403 Forbidden).

A. MessagingsendtoCI: This is not a valid, predefined authorization role in the SAP Cloud Integration security model; it is a fabricated name.

B. MessagingSend: This role is used in on-premise SAP Process Integration/Process Orchestration (PI/PO) systems, not in SAP Cloud Integration.

1. SAP Help Portal

SAP Integration Suite Documentation: In the section on setting up inbound communication

it is explicitly stated: "To process messages on a tenant

a sender system needs to be authorized. For this purpose

the user associated with the sender system needs to have the ESBMessaging.send role."

Source: SAP Help Portal

SAP Integration Suite > Setting Up Inbound Communication > Step 2: Create a Service Instance for the Sender.

2. SAP Help Portal

SAP Integration Suite Documentation: The official list of personas and their required roles details the function of ESBMessaging.send.

Source: SAP Help Portal

SAP Integration Suite > Security > Managing Authorizations and Users > Tasks and Permissions > Predefined Roles and Scopes. The table for "Integration Developer" and "API Consumer" lists the ESBMessaging.send role for the "Process Integration Runtime" service.