Show Menu

SAP XI/PI/PO Cheat Sheet by

This is a SAP XI/PI/PO cheatsheet by Raffael Herrmann

XI/PI/­PRO/CPI - CheatSheet

Product Overview

(Formerly known as: SAP XI, SAP Exchange Infrastructure); stands for SAP Process Integration.
It is a NetWeaver coponent which acts as an EAI and lets you build interfaces with mapping and routing.
(Formerly known as: SAP PO); stands for SAP Process Orchestration.
SAP PRO is a bundle of SAP PI, SAP BRM and SAP BPM.
(Formerly known as: SAP HCI, SAP HCP-IS, SAP Hana Cloud Platform Integration); stands for SAP Cloud Platform Integration.
The CPI is a cloud-based (hosted in SAP Cloud Platform) integration platform built up on the OSS Apache Camel framework.

SSL, TLS, PGP, ... (All Stacks)

How to check quickly if TLS 1.2 is enabled?
A good indicator is the version of the used iSaSiLk library. If version is 4.5, the PI doesn't support TLS 1.1/1.2. If iSaSiLk has version 5.104 there are good chances, that TLS 1.2 is supported (because 5.104 usually will be installed, when doing the TLS 1.2 patches).
How to activate TLS 1.2 in AS Java?
To enable TLS 1.1 and TLS 1.2 support for SAP PI (AS Java) read the contents of SAP note 2417205. It contains further notes which explain to check and update TLS support.
How to activate TLS 1.2 in AS ABAP
Ensure that the used Common­Cry­ptoLib has release or later. (Update infos in note 1848999.) If you want to force TLS 1.2, read note 2384243.
How to force TLS 1.2?
If your SAP PI is TLS 1.2 ready, and you want the HTTP receiver channel to use explicitly TLS 1.2, then you can add the parameter
with value
in the channels module tab. Further explan­ation can be found in note 2393811.
How to support ECDHE chipher suites?
As explained in Note 2538934 none of the SAP PI/PRO releases supports any kind of ECDHE cipher­suites. Either ask the partner to allow a non-ECDHE cipher suite or use an external SSL-ha­ndler like mitmproxy (https:­//g­oo.g­l/­yemrrV) for example.
What cipher suites are supported by SAP PI?
The cipher­suites which are activated by default can be seen in SAP note 2538934. Instru­ctions on how to change the supported cipher­suites can be found in note 2616983.
How to get SSL certif­icate from...
HTTP; open the website in a browser, click the lock-icon and save certif­icate or use the Realcore Support Tools for SAP PI/PO.
Mail, SFTP; use the OpenSSL comman­dline utilities or the Realcore Support Tools for SAP PI/PO.
FTPs; use the OpenSSL comman­dline utilities with command:
openssl s_client -connect <ip­-of­-se­rve­r>:­<po­rt> -showcerts -starttls ftp

Other; try to use OpenSSL toolset. Otherwise Google.
How to convert OpenSSH key to PKCS12?
To create a PKCS12 keystore from OpenSSH key, you need the OpenSSL comman­dline tools.
First create a certif­icate from the private key:
openssl req -new -x509 -key <pr­iva­te-­key­-fi­len­ame> -days 3650 -out x509_c­ert­ifi­cat­e.pem

Now create PKCS12 from private key and certif­icate:
openssl pkcs12 -export -in <x5­09-­cer­tif­ica­te-­fil­ena­me> -inkey <pr­iva­te-­key­-fi­len­ame> -out pkcs12­_ke­yst­ore.p12
How to update Truste­dCAs?
AS Java; open /nwa/k­ey-­storage, select TrustedCAs keystore and click import. After import, stop and start the affected commun­ication channel.
AS ABAP; open transa­ction
and add the certif­icate to the (Trust­edCAs). If there's no store like that, choose SSL (anony­mou­s/d­efa­ult).
What is "peer certif­icate rejected by chainv­erifier"­-error?
This error usually occurs, when at least one certif­icate in the chain is invalid. Keep in my, that server certif­icates are chained (=trusted by higher author­ities). You have to import the whole chain into SAP PI!
What is a "SSL common name mismatch"­-error?
This error occurs if the value of the field
(common name) doesn't match the hostname. E.g. server has a cert that matches
, but is called via IP address. Either call service with matching hostname or change the certif­icate on the server.
Can a SSL certif­icate be issued for an IP address?
In theory SSL/TLS certs can be issued for IP addresses. Nevert­heless this is "bad practi­ce" and should be avoided in any case.
How to set-up PGP?
Create PGP keypair; To create a PGP keypair you can use Kleopatra which can be downloaded at https:­//g­nup­
Save key on PI; the private key has to be stored in SAP PI's filesy­stem. The standard path is:
/usr/s­ap/­<System ID>­/<I­nstance ID>/sec

Configure bean; set-up the bean as described in this article: https:­//g­oo.g­l/­R325Xv
Common PGP errors
PGP Encryption Module: Could not extract private key (org.b­oun­cyc­ast­le.o­pe­npg­p.P­GPE­xce­ption: checksum mismatch at 0 of 20)

Either the password setup in the parameter
is wrong or the key contains invalid chars. Try to set a simpler key in Kleopatra, re-import the key and try again.
PGP Encryption Module: Could not process message, Internal PGP Error (org.b­oun­cyc­ast­le.o­pe­npg­p.P­GPE­xce­ption: exception encrypting session key)Cause: Illegal key size or default parameters

The JCE unlimited strength policy isn't correct. Check /BC/Ve­rifyJCE if all is green. Otherwise fix like explained here: https:­//g­oo.g­l/­Rt3F7n
You have requested an applic­ation that is currently stopped.

If this occurs when checking /BC/Ve­rifyJCE, enable the applic­ation as explained in note 2606771.

Unix 101

Test HTTP connec­tion; to test a HTTP(S) connec­tion, use the wget-tool:
wget http(s­):/­/<m­yse­rve­r.d­e>:­<po­rt>­/<p­ath>
Test non-HTTP connec­tion; to test a non-HT­TP(S) connec­tion, use the telnet-tool:
telnet <my­ser­> <po­rt>
Test HTTP connection via proxy; to test a HTTP(S) connection via proxy server, use the wget-tool:
wget -e use_pr­oxy=yes -e https_­pro­xy=­<my­pro­xy.d­e>­:<p­rox­y-p­ort> http(s­):/­/<m­yse­rve­r.d­e>:­<po­rt>­/<p­ath>
Test HTTP connection via proxy with auth; to test a HTTP(S) connection via proxy server with user authen­tic­ation, use the telnet-tool:
wget -e use_pr­oxy=yes -e https_­pro­xy=­<my­pro­xy.d­e>­:<p­rox­y-p­ort> -e proxy_­use­r=<­proxy user> -e proxy_­pas­swo­rd=­<proxy pass> http(s­):/­/<m­yse­rve­r.d­e>:­<po­rt>­/<p­ath>
Get SFTP-f­ing­erp­rint; to get the server­-fi­nge­rprint fo an SFTP server, use:
sftp -vv -oPort­=<p­ort> <us­er>­@<m­yse­rve­r.d­e>
Show number of cpus; to show used cpu and number of cores, use:
Show amount of ram; to show amount of ram, swap and current memory status, use:
cat /proc/­meminfo
Show disk space; to show used, free and total diskspace, use:
df -h
Get SSL/TLS certif­icate from a FTPs server; to get the certif­icate, used by an SFTP server, use openssl toolkit:
openssl s_client -connect <server ip>­:<s­erver port> -showcerts -starttls ftp
Delete files older than X days; to delete files (e.g. logs) that are older than X days, use:
find . -name '<f­ile­nam­e>' -type f -mtime +<d­ays> -delete

Hints: In
-tag a
can be used as wildcard. Remove
to do a test-run without deletion.
symbols mark placeh­olders. You have to replace them with the actual values of your use-case.

API & Automation (Both Stacks)

Directory API
What? The Direct­oryAPI provides a set of over 50 SOAP webser­vices to control, monitor and edit Integr­ation Directory objects.
Where? To browse through the available APIs open the path
on your Java stack, switch to Provid­er-­System and click search. On the following wizard pages, you can retrieve the WSDL to test the API e.g. in SoapUI.
When? Use the DirAPI when you want to download payloads, get monitoring results, edit channels, ...
Tutorial: https:­//g­oo.g­l/­6hgNFP
Simple Query
What? The Simple Query is an unofficial HTTP/P­ost­-based web-api that allows to view and download Integr­ation Directory as also Enterprise Service Repository objects.
Where? To browse through the available methods open the path
for Directory objects or
for Respos­itory objects on your Java stack.
When? Use the Simple Query when you want to access repository objects like Mappings, etc.
Tutorial: https:­//g­oo.g­l/­js6Tde
To use the API, the API user needs the roles
Channel Control
What? The Channe­lAd­min­-Se­rvlet is a subset of DirAPI that allows to start and stop channels via webservice call.
Where? Call the following url:
. Replace
with channe­lname and
with either start, stop or status.
When? Use this API to progra­mma­tically start/­sto­p/query channels.
General tutorial: https:­//g­oo.g­l/­9ML4Vn
Use in ABAP: To use the API, the API user needs the roles
What? RFC isn't a real API but a protoc­ol/­tec­hnique to access the ABAP stack from outer systems. You can either call specific function modules via RFC or use generic modules like
to read any table.
Where? Use a platfo­rm-­spe­cific RFC connector library like SAP JCO for Java or SAP NCO for .NET-applications.
When? Use it e.g. to call function or retrieve data from ABAP stack in C# or Java applications.
NCO tutorial: https:­//g­oo.g­l/­DhvUAM
JCO tutorial: https:­//g­oo.g­l/­K2SyEC
SAP Gui Script
What? SAP GUI scripting allows to write scripts which automate tasks in the SAP GUI. Scripts can either be written manually or recorded via a macro recorder.
Where? Open SAP Logon, log into SAP system, click Customize Local Layout button (
) and choose Script Recording and Playba­ck....
When? Use it for recurring tasks in SAP GUI, which can't be handled with an Z-program or via another API.
Base setup: https:­//g­oo.g­l/­V4dwkc
Macro tutorial: https:­//g­oo.g­l/­eqgVwK
What? The sapshc­ut.exe is comman­dline tool, which allows to launch SAP Gui with predefined commands and parameters.
Where? The sapshc­ut.exe is placed in SAP Logon install dir, which is usually located in:
C:\Program Files (x86)­\SAP­\Fr­ont­End­\SAPgui
. To see all parameters call sapshcut with -?-parameter from comman­dline like:
sapshc­ut.exe -?

When? Use it to launch SAP GUI with a predefined transa­ction and (optional) predefined input data.
sapshc­ut.exe usage: https:­//g­oo.g­l/­WYWqgP
Shortcut file tutorial: https:­//g­oo.g­l/­jM5A5y
What? The OData-API is a REST-based web api to control, manage and edit Cloud Integr­ation Content. It can be seen as counte­rpart to SAP PI's Directory API.
Where? The api endpoint itself can be reached via
whereby the <tm­n> has to be replaced by your tenant's hostname. API testing can be done with REST-API tools like Postman.
When? Use it to build your own monitoring or automate admini­station tasks.
Docume­nta­tion: https:­//g­oo.g­l/­t4u3dB
API discovery tool: https:­//g­oo.g­l/­Wy8Y1B
*OS = Operat­ional stack; system where the API is available. JS = Java stack, AS = ABAP stack, CPI = Cloud Platform Integr­ation.

Monitoring (ABAP Stack)

Transa­ction code
Integr­ation engine message monitoring tools.
Message monitor entry.
Integr­ation process monitoring tools for Business Processing Engine (BPE) / ccBPM.
Config­uration of user-d­efined custom search.
(Re-)index messages after changing the user-d­efined custom search parame­ters.
Monitor outbound message queue.
Monitor inbound message queue.
Check if queues are registered correctly.
Transa­ctional RFC monito­ring.
Internet Commun­ication Manager (ICM) monitoring tools.
SAP Gateway monitoring tools.
Monitoring of system resources. For checking e.g. database space.

Monitoring (Java Stack)

/pimon Adapter Engine Message Monitor
AAE message monito­ring.
/pimon Adapter Engine Commun­ication Channel Monitor
New commun­ication channel monito­ring.
Classic runtime workbench
RWB-based channel monito­ring.
"­Cla­ssi­c" message system monito­ring.
Java proxy runtime (JPR) monitoring
Cache monitoring status.
Show status of background jobs (e.g. clean-up, ...)
Java scheduler monito­ring.
Pt. I - Java scheduler monitoring (fallb­ack).
Pt. II - Java scheduler monitoring (fallb­ack).
CPA cache monito­ring.
View locked messages in Java stack.
AAE log viewer.
Quick status overview of system logs.
Paths on the left column, beginning with / have to be appended to the base uri of the PI/PRO system: http(s­):/­/<h­ost­nam­e>:­<po­rt>

Admini­str­ation Tools (Both Stacks)

View and remove ESR object locks.
View general Java locks.
User admini­str­ation (Java).
Identity management and user admini­str­ation.
Starting, stopping and re-sta­rting of Java instances, services and processes.
Certif­icate handling and keystore admini­str­ation. (Java)
Configure and admini­strate destio­nations (e.g. HTTP, IDOC, etc.) in Java stack.
Tool to check supported keysize / encryption strength of PI. Needed e.g. for PGP.
Powerful logging and analysis. More inform­ation in S-Note 0001514898. Setup files in S-Note 0002010715
Trigger CPA cache delta refresh.
Trigger CPA cache full refresh.
JDBC-, FTP- and XML-Parser test tools. Can be used to show JDBC driver version for example. (You need note 1085539.)
Transa­ction code
User admini­str­ation (ABAP).
Certif­icate handling and keystore admini­str­ation. (ABAP)
Configure and admini­strate destio­nations (e.g. HTTP, IDOC, etc.) in ABAP stack.
Test SLD connec­tion.
Configure SLD connec­tion.
Admini­str­ation of Integr­ation Engine.
Paths on the left column, beginning with /, have to be appended to the base uri of the PI/PRO system: http(s­):/­/<h­ost­nam­e>:­<po­rt>

Useful Reports (ABAP Stack)

Transa­ction code
Re-indexes messages for user-d­efined custom search.
Cancel non-re­sta­rtable messages.
Cancel messages which are missing their
Execute a system command (OS level).
Show profile parame­ters.
Be aware: If you are not sure how the programs behave, you should open them first in
and check their source code. Only run them directly via
if you know, what you are doing!

Configure system proxy (Both Stacks)

How to
To do a quick check of the global proxy settings, open the following path on your PI/PO/PRO: /proxy­_se­tti­ngs.jsp

To configure the global proxy settings, open the path: /nwa/m­idd­lew­are­-se­ttings
Check & Configure:
Open transa­ction
and press
. Go to the Client-menu entry and then select Proxy-­Set­tings.

Readout Passwords (Both Stacks)

Passwords from SAP PI users
There is no universal way to grab passwords from PI users, but as long as there is an interface, sending data to the PI via SOAP or HTTP there is a good chance of getting the password. Even here you have two options:
Open the receiving SOAP sender channel in the Integr­ation Direct­ory­/NWDS. Switch to the Modules-tab and add a parameter to the adapter's own module with the following values: Parameter Name=
, Parameter Value=
. The resulting logs with all header data can be found in /nwa/logs. Search for the
-header which should contain the user's password as Base64 string.
If the adapte­rmodule isn't available, you could trace the incoming requests with /xpi_i­nsp­ector. After creating the traces, search for the
-header as explained above.

NWDS Lifesaver

Where can I get NWDS 7.5 quick and easy?
Following the click instru­ctions from this article: https:­//g­oo.g­l/­RQ7fW3
NWDS doesn't start and does not show anything while opening.
The NWDS can't find a suitable JRE/JDK. Add the
-paramter into the NWDS .ini-file.
NWDS throws an exception during the startup and then closes again.
NWDS needs a 32-bit (x86) jdk. (Even if your Windows instal­lation is x64!)
NWDS complains about a wrong JDK (non-SAP) version.
Either click "­can­cel­" and simply ignore the error or search in OneNote for the "JVM vendor not suppor­ted­" article.
NWDS crashes with "­Unh­andled event loop exception - Java heap space" exception.
Raise the values
in the NWDS .ini-file which lays beneath the NWDS-/­Ecl­ips­e.exe file.
How to avoid the annoying re-login dialogs?
Open NWDS and follow the menu path: Prefer­ences PI Tools Config­uration Tool-S­pecific Sessio­n-T­imeout. Raise the timeout value.
How to set-up a Java mapping?
Read the following step-b­y-step tutorial: https:­//g­oo.g­l/­n9JCaU
Using "­XPath containing whites­pac­es" doesn't work.
Be sure to just add one XPath by double­-cl­icking. This is necessary to add the namesp­aces. (You can remove the added XPath after the action.)

Adapter Modules (Java Stack)

Module Name
General beans

Used to append, edit or delete entries of the Dynami­cCo­nfi­gur­ation section of the XI3.0 header.

Used to switch the main message payload with an message attach­ment, defined by the module's parame­ters.

Used to zip or unzip a payload. Whn unzipping an archive with multiple files, those will be added as attach­ments.
Pro tip: Use the undocu­mented parameter
to unzip .gz (GZip) files.

Used to transform messages, change the XML, add/edit MIME-t­ypes, etc. The module can load custom­/ex­ternal Java tranfo­rmation classes.

Used to convert XML payload to plain(­text) files. Became obsolete in some way by the

Used to swap the code page of the main payload of the XI message and also convert its content.

Used to validate header inform­ation of outbound messages.

Used to anonymize XML elemen­ts/­att­ributes by removing namespaces or namespace prefixes. Also the encoding attribute of the XML declar­ation can be changed.
Sync-A­syn­c-B­ridge beans

Used in async-sync bridges to convert the asynch­ronous request to a synchr­onous one. Used in combin­ation with Reques­tOn­ewa­yBean.

Used in async-sync bridges to redirect a synchr­onous response to an sync interface.

Used in sync-async bridges to sent out (create) a response message.

Used in sync-async bridges to wait for a response message.
To develop your own module, read the section "­Module Develo­pme­nt" on this SAP page: https:­//g­oo.g­l/­1mmyxz and also check the sources of this open-s­ource project: https:­//g­oo.g­l/­We4ghm

IDOC Handling (Both Stacks)

/pimon Adapter Engine IDOC adapter monitor
IDOC message monito­ring.
/pimon Adapter Engine IDOC adapter monitor Metadata monitor
Mainte­nance of IDOC metadata.
Transa­ction code
Config­uration (including suppre­ssion) of IDOC acknow­led­gem­ents.
Mainte­nance of port config­ura­tion.
Mainte­nance of IDOC metadata.
IDOC message monito­ring.
Display IDOCs.
List IDOCs.
Configure partner agreem­ents. (Mostly done on ERP system side, but nevert­heless helpful.)
To use the Java-stack IDOC monito­ring, you need either the
or the

If Java-I­DOC­-mo­nit­oring doesn't show any messages, you have to activate it first. Go to /nwa Config­uration Infras­tru­cture Applic­ation Resources. Then choose "­Res­ource adapte­rs", then "­Jav­aId­ocA­dap­ter­" and then set the persis­tance-property to true.

IDOC Setup (Java Stack)

SAP PI to ERP (confi­gur­ation on PI)
Create default IDOC destin­ation in /nwa with name scheme
. After creating the destin­ation check it with the ping destin­ation button.
Use this destin­ation in the IDOC receiver channels.
SAP PI to ERP (confi­gur­ation on ERP)
Create a user for the SAP PI system, which can be used in the SAP PI destin­ation. (As explained above.) Usually this user is named:
ERP to SAP PI (confi­gur­ation on PI)
You have to create a IDOC-r­eso­urc­e-a­dapter on PI. Go to /nwa Config­uration Infras­tru­cture Applic­ation Resources. Click Create New Resource New Resource Adapter.
Choose SAPJRA­Tem­plate and name the adapter like this:
Define the values for ProgramId, Gatewa­yServer and Gatewa­ySe­rvice in the resource adapter's proper­ties. Afterwards give those values to the ERP administrator.
Use this resource adapter in the IDOC sender channels.
ERP to SAP PI (confi­gur­ation on ERP)
Open transa­ction
and create a destin­ation of type
Set the fields ProgramId, Gatewa­yServer and Gatewa­ySe­rvice with the values received from the SAP PI administrator.
Activate Unicode in the destin­ation's settings.
Use the newly configured destin­ation in the partner agreem­ent/ALE config­uration in transa­ction

Fight Timeouts (Both Stacks)

Where / What
How to set?
Soap-A­dapter | Sender
Open channel. Add parameter to the adapter's own module at the module tab. If Module Name is
name the parameter
. If Module Name is
then name the parameter
. Give the timeout in millis­econds as parameter value.
Soap-A­dapter | Receiver
Open channel. Add parameter to the adapter's own module at the module tab. Use
as parameter name and set the timeout in millis­econds as parameter value.
JDBC-A­dapter | Receiver
There are two points to configure timeout: 1 - module tab, 2 - Advanced Mode parameters.
1) Switch to module tab, add a paramt­er-set to the adapter's own module. Use
as parameter name and set the timeout in millis­econds as parameter value.
2) Switch to Advanced-tab, check Advanced Mode and add the following two parameters to the Additional Parameters-table:
with timeout in seconds (e.g.
for 10 minutes).
with timeout in seconds (e.g.
for 10 minutes).
Adapter Engine | Sender
Introd­uction: Useful for sync ABAP proxy interface from ERP to Single Stack. SOAP Sender timeout only configures how long the sender channel will wait for response from PI pipeline. To define how long the SOAP sender channel will keep the connection to the sending ERP/ABAP proxy open, you can use the following setup.
Go to /nwa Config­uration Infras­tru­cture Java System Properties Services. Choose the entry
XPI Adapter: XI
, switch to its
-tab and set the timeout in millis­econds for the parameter named
Be careful this affects all incoming synchr­onous SOAP/XI communication!
To trigger the new parameter, restart the adapter. Therefore go to /nwa Operations Systems Start &Stop Java Services. Select
XPI Adapter: XI
and click restart-button.
Integr­ation Engine | Receiver
Introd­uction: If you're sending data from Integr­ation Engine or ERP, etc. systems, usually the default ICM timeout is used. You have two options to raise this timeout.
1) Open transa­ction
, open the approp­riate destin­ation, switch to the Special Options-tab and configure the
Set timeout
2) Raise the global ICM timeout by opening transa­ction
, then open the parameter
and change its value. In addition open the RZ11-p­ara­meter
and set the parameter
TIMEOU­T=<­timeout in s>
Attention: This change is system­-wide and needs a restart of the ABAP-stack afterw­ards.
Integr­ation Engine | Processing
Introd­uction: Besides network timeouts also processing timeouts can occur when processing in IE/AAE takes longer than config­ured.
To raise the global ICM processing timeout, open transa­ction
, then open the parameter
and append the following value-pair to its parameter
PROCTI­MEO­UT=­<ti­meout in s>
Attention: This change is system­-wide and needs a restart of the ABAP-stack afterw­ards. Learn more over here: https:­//g­oo.g­l/­Sh5Jfp
Hint: *If you want to test this changes without restart, you can make them temporary (until next restart) by opening transa­ction
, opening "­Ser­vic­es" (
) and doing the changes there.

Tools to rocket your produc­tivity

Realcore Developer Suite for PI/PO: Helps to compare ESR object or create mapping or interface docume­nta­tions. Available via SAP Appstore or Realcore Sales Team.
Realcore Support Tools for PI/PO: Helps to quickly create suppor­t/error mails with payload attach­ments, download payloads to disk, solve SSL errors and much more. Available via Realcore Sales Team.
SoapUI: Useful for SOAP webservice testing and for creation of SOAP/REST webser­vices (=mockup services). Choose OpenSo­urc­e/C­omm­unity edition. https:­//g­oo.g­l/­qD42Z9
Postman: Helps to test REST apis including header and payload handling. https:­//g­oo.g­l/­7pgbFV
DBeaver: Helps to view, edit and work with nearly any database. Runs without instal­lation. https:­//g­oo.g­l/­zqGDA9
Notepad++ (+ XML Tools): The XML swissk­nif­e/e­ditor. Go to plugin manager and install "XML Tools". https:­//g­oo.g­l/­zAsd4N
Fiddler: Sniffing proxy to view raw HTTP requests. Is even able to decrypt and view HTTPS traffic. Useful for analysis. https:­//g­oo.g­l/­rSWeFA

Helpful Resources

Overview of NWA short links: https:­//g­oo.g­l/­YB3CYU
List of useful transa­ctions and short-­urls: https:­//g­oo.g­l/­ky1m5F
Note: The entries above contain links to helpful web-re­sou­rces. For better readab­ility all links were shortened.


No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.

          Related Cheat Sheets

          Post Office Basics Cheat Sheet