diff --git a/cmd/abapAddonAssemblyKitCheckCVs.go b/cmd/abapAddonAssemblyKitCheckCVs.go
index 1a111bb662..eb6ce64e3a 100644
--- a/cmd/abapAddonAssemblyKitCheckCVs.go
+++ b/cmd/abapAddonAssemblyKitCheckCVs.go
@@ -23,7 +23,7 @@ func runAbapAddonAssemblyKitCheckCVs(config *abapAddonAssemblyKitCheckCVsOptions
 	log.Entry().Info("╚══════════════════════════════╝")
 
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils, ""); err != nil {
 		return err
 	}
 
diff --git a/cmd/abapAddonAssemblyKitCheckPV.go b/cmd/abapAddonAssemblyKitCheckPV.go
index 2f97820338..2967fb6b51 100644
--- a/cmd/abapAddonAssemblyKitCheckPV.go
+++ b/cmd/abapAddonAssemblyKitCheckPV.go
@@ -23,7 +23,7 @@ func runAbapAddonAssemblyKitCheckPV(config *abapAddonAssemblyKitCheckPVOptions,
 	log.Entry().Info("╚═════════════════════════════╝")
 
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, utils); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, utils, ""); err != nil {
 		return err
 	}
 
diff --git a/cmd/abapAddonAssemblyKitCreateTargetVector.go b/cmd/abapAddonAssemblyKitCreateTargetVector.go
index c92e1eed41..c115045b32 100644
--- a/cmd/abapAddonAssemblyKitCreateTargetVector.go
+++ b/cmd/abapAddonAssemblyKitCreateTargetVector.go
@@ -29,7 +29,7 @@ func abapAddonAssemblyKitCreateTargetVector(config abapAddonAssemblyKitCreateTar
 
 func runAbapAddonAssemblyKitCreateTargetVector(config *abapAddonAssemblyKitCreateTargetVectorOptions, telemetryData *telemetry.CustomData, client piperhttp.Sender, cpe *abapAddonAssemblyKitCreateTargetVectorCommonPipelineEnvironment) error {
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 
diff --git a/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go b/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
index e8341406e5..b8e7d4ea7a 100644
--- a/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
+++ b/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
@@ -18,10 +18,11 @@ import (
 )
 
 type abapAddonAssemblyKitCreateTargetVectorOptions struct {
-	AbapAddonAssemblyKitEndpoint string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
-	Username                     string `json:"username,omitempty"`
-	Password                     string `json:"password,omitempty"`
-	AddonDescriptor              string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitEndpoint   string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
+	Username                       string `json:"username,omitempty"`
+	Password                       string `json:"password,omitempty"`
+	AddonDescriptor                string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitOriginHash string `json:"abapAddonAssemblyKitOriginHash,omitempty"`
 }
 
 type abapAddonAssemblyKitCreateTargetVectorCommonPipelineEnvironment struct {
@@ -90,6 +91,7 @@ For Terminology refer to the [Scenario Description](https://www.project-piper.io
 			}
 			log.RegisterSecret(stepConfig.Username)
 			log.RegisterSecret(stepConfig.Password)
+			log.RegisterSecret(stepConfig.AbapAddonAssemblyKitOriginHash)
 
 			if len(GeneralConfig.HookConfig.SentryConfig.Dsn) > 0 {
 				sentryHook := log.NewSentryHook(GeneralConfig.HookConfig.SentryConfig.Dsn, GeneralConfig.CorrelationID)
@@ -163,6 +165,7 @@ func addAbapAddonAssemblyKitCreateTargetVectorFlags(cmd *cobra.Command, stepConf
 	cmd.Flags().StringVar(&stepConfig.Username, "username", os.Getenv("PIPER_username"), "User for the Addon Assembly Kit as a Service (AAKaaS) system")
 	cmd.Flags().StringVar(&stepConfig.Password, "password", os.Getenv("PIPER_password"), "Password for the Addon Assembly Kit as a Service (AAKaaS) system")
 	cmd.Flags().StringVar(&stepConfig.AddonDescriptor, "addonDescriptor", os.Getenv("PIPER_addonDescriptor"), "Structure in the commonPipelineEnvironment containing information about the Product Version and corresponding Software Component Versions")
+	cmd.Flags().StringVar(&stepConfig.AbapAddonAssemblyKitOriginHash, "abapAddonAssemblyKitOriginHash", os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"), "Origin Hash for restricted AAKaaS scenarios")
 
 	cmd.MarkFlagRequired("abapAddonAssemblyKitEndpoint")
 	cmd.MarkFlagRequired("username")
@@ -225,6 +228,15 @@ func abapAddonAssemblyKitCreateTargetVectorMetadata() config.StepData {
 						Aliases:   []config.Alias{},
 						Default:   os.Getenv("PIPER_addonDescriptor"),
 					},
+					{
+						Name:        "abapAddonAssemblyKitOriginHash",
+						ResourceRef: []config.ResourceReference{},
+						Scope:       []string{"PARAMETERS"},
+						Type:        "string",
+						Mandatory:   false,
+						Aliases:     []config.Alias{},
+						Default:     os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"),
+					},
 				},
 			},
 			Outputs: config.StepOutputs{
diff --git a/cmd/abapAddonAssemblyKitPublishTargetVector.go b/cmd/abapAddonAssemblyKitPublishTargetVector.go
index dc9ed1c4ca..b86b8295a9 100644
--- a/cmd/abapAddonAssemblyKitPublishTargetVector.go
+++ b/cmd/abapAddonAssemblyKitPublishTargetVector.go
@@ -23,7 +23,7 @@ func abapAddonAssemblyKitPublishTargetVector(config abapAddonAssemblyKitPublishT
 func runAbapAddonAssemblyKitPublishTargetVector(config *abapAddonAssemblyKitPublishTargetVectorOptions, telemetryData *telemetry.CustomData, utils *aakaas.AakUtils) error {
 
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 	conn.MaxRuntime = (*utils).GetMaxRuntime()
diff --git a/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go b/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
index 4d9fe8629a..f492413cb4 100644
--- a/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
+++ b/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
@@ -16,13 +16,14 @@ import (
 )
 
 type abapAddonAssemblyKitPublishTargetVectorOptions struct {
-	AbapAddonAssemblyKitEndpoint string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
-	Username                     string `json:"username,omitempty"`
-	Password                     string `json:"password,omitempty"`
-	TargetVectorScope            string `json:"targetVectorScope,omitempty" validate:"possible-values=T P"`
-	MaxRuntimeInMinutes          int    `json:"maxRuntimeInMinutes,omitempty"`
-	PollingIntervalInSeconds     int    `json:"pollingIntervalInSeconds,omitempty"`
-	AddonDescriptor              string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitEndpoint   string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
+	Username                       string `json:"username,omitempty"`
+	Password                       string `json:"password,omitempty"`
+	TargetVectorScope              string `json:"targetVectorScope,omitempty" validate:"possible-values=T P"`
+	MaxRuntimeInMinutes            int    `json:"maxRuntimeInMinutes,omitempty"`
+	PollingIntervalInSeconds       int    `json:"pollingIntervalInSeconds,omitempty"`
+	AddonDescriptor                string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitOriginHash string `json:"abapAddonAssemblyKitOriginHash,omitempty"`
 }
 
 // AbapAddonAssemblyKitPublishTargetVectorCommand This step triggers the publication of the Target Vector according to the specified scope.
@@ -61,6 +62,7 @@ For Terminology refer to the [Scenario Description](https://www.project-piper.io
 			}
 			log.RegisterSecret(stepConfig.Username)
 			log.RegisterSecret(stepConfig.Password)
+			log.RegisterSecret(stepConfig.AbapAddonAssemblyKitOriginHash)
 
 			if len(GeneralConfig.HookConfig.SentryConfig.Dsn) > 0 {
 				sentryHook := log.NewSentryHook(GeneralConfig.HookConfig.SentryConfig.Dsn, GeneralConfig.CorrelationID)
@@ -136,6 +138,7 @@ func addAbapAddonAssemblyKitPublishTargetVectorFlags(cmd *cobra.Command, stepCon
 	cmd.Flags().IntVar(&stepConfig.MaxRuntimeInMinutes, "maxRuntimeInMinutes", 16, "Maximum runtime for status polling in minutes")
 	cmd.Flags().IntVar(&stepConfig.PollingIntervalInSeconds, "pollingIntervalInSeconds", 60, "Wait time in seconds between polling calls")
 	cmd.Flags().StringVar(&stepConfig.AddonDescriptor, "addonDescriptor", os.Getenv("PIPER_addonDescriptor"), "Structure in the commonPipelineEnvironment containing information about the Product Version and corresponding Software Component Versions")
+	cmd.Flags().StringVar(&stepConfig.AbapAddonAssemblyKitOriginHash, "abapAddonAssemblyKitOriginHash", os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"), "Origin Hash for restricted AAKaaS scenarios")
 
 	cmd.MarkFlagRequired("abapAddonAssemblyKitEndpoint")
 	cmd.MarkFlagRequired("username")
@@ -225,6 +228,15 @@ func abapAddonAssemblyKitPublishTargetVectorMetadata() config.StepData {
 						Aliases:   []config.Alias{},
 						Default:   os.Getenv("PIPER_addonDescriptor"),
 					},
+					{
+						Name:        "abapAddonAssemblyKitOriginHash",
+						ResourceRef: []config.ResourceReference{},
+						Scope:       []string{"PARAMETERS"},
+						Type:        "string",
+						Mandatory:   false,
+						Aliases:     []config.Alias{},
+						Default:     os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"),
+					},
 				},
 			},
 		},
diff --git a/cmd/abapAddonAssemblyKitRegisterPackages.go b/cmd/abapAddonAssemblyKitRegisterPackages.go
index ab684f1bb8..0c513319f3 100644
--- a/cmd/abapAddonAssemblyKitRegisterPackages.go
+++ b/cmd/abapAddonAssemblyKitRegisterPackages.go
@@ -40,7 +40,7 @@ func runAbapAddonAssemblyKitRegisterPackages(config *abapAddonAssemblyKitRegiste
 	}
 
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 
@@ -49,7 +49,7 @@ func runAbapAddonAssemblyKitRegisterPackages(config *abapAddonAssemblyKitRegiste
 	}
 
 	conn2 := new(abapbuild.Connector) // we need a second connector without the added Header
-	if err := conn2.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client); err != nil {
+	if err := conn2.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, client, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 
diff --git a/cmd/abapAddonAssemblyKitRegisterPackages_generated.go b/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
index 39c9139d75..8d11b1a338 100644
--- a/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
+++ b/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
@@ -18,10 +18,11 @@ import (
 )
 
 type abapAddonAssemblyKitRegisterPackagesOptions struct {
-	AbapAddonAssemblyKitEndpoint string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
-	Username                     string `json:"username,omitempty"`
-	Password                     string `json:"password,omitempty"`
-	AddonDescriptor              string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitEndpoint   string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
+	Username                       string `json:"username,omitempty"`
+	Password                       string `json:"password,omitempty"`
+	AddonDescriptor                string `json:"addonDescriptor,omitempty"`
+	AbapAddonAssemblyKitOriginHash string `json:"abapAddonAssemblyKitOriginHash,omitempty"`
 }
 
 type abapAddonAssemblyKitRegisterPackagesCommonPipelineEnvironment struct {
@@ -91,6 +92,7 @@ For Terminology refer to the [Scenario Description](https://www.project-piper.io
 			}
 			log.RegisterSecret(stepConfig.Username)
 			log.RegisterSecret(stepConfig.Password)
+			log.RegisterSecret(stepConfig.AbapAddonAssemblyKitOriginHash)
 
 			if len(GeneralConfig.HookConfig.SentryConfig.Dsn) > 0 {
 				sentryHook := log.NewSentryHook(GeneralConfig.HookConfig.SentryConfig.Dsn, GeneralConfig.CorrelationID)
@@ -164,6 +166,7 @@ func addAbapAddonAssemblyKitRegisterPackagesFlags(cmd *cobra.Command, stepConfig
 	cmd.Flags().StringVar(&stepConfig.Username, "username", os.Getenv("PIPER_username"), "User for the Addon Assembly Kit as a Service (AAKaaS) system")
 	cmd.Flags().StringVar(&stepConfig.Password, "password", os.Getenv("PIPER_password"), "Password for the Addon Assembly Kit as a Service (AAKaaS) system")
 	cmd.Flags().StringVar(&stepConfig.AddonDescriptor, "addonDescriptor", os.Getenv("PIPER_addonDescriptor"), "Structure in the commonPipelineEnvironment containing information about the Product Version and corresponding Software Component Versions")
+	cmd.Flags().StringVar(&stepConfig.AbapAddonAssemblyKitOriginHash, "abapAddonAssemblyKitOriginHash", os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"), "Origin Hash for restricted AAKaaS scenarios")
 
 	cmd.MarkFlagRequired("abapAddonAssemblyKitEndpoint")
 	cmd.MarkFlagRequired("username")
@@ -226,6 +229,15 @@ func abapAddonAssemblyKitRegisterPackagesMetadata() config.StepData {
 						Aliases:   []config.Alias{},
 						Default:   os.Getenv("PIPER_addonDescriptor"),
 					},
+					{
+						Name:        "abapAddonAssemblyKitOriginHash",
+						ResourceRef: []config.ResourceReference{},
+						Scope:       []string{"PARAMETERS"},
+						Type:        "string",
+						Mandatory:   false,
+						Aliases:     []config.Alias{},
+						Default:     os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"),
+					},
 				},
 			},
 			Outputs: config.StepOutputs{
diff --git a/cmd/abapAddonAssemblyKitReleasePackages.go b/cmd/abapAddonAssemblyKitReleasePackages.go
index ec78e414b5..0c97842f4c 100644
--- a/cmd/abapAddonAssemblyKitReleasePackages.go
+++ b/cmd/abapAddonAssemblyKitReleasePackages.go
@@ -24,7 +24,7 @@ func abapAddonAssemblyKitReleasePackages(config abapAddonAssemblyKitReleasePacka
 func runAbapAddonAssemblyKitReleasePackages(config *abapAddonAssemblyKitReleasePackagesOptions, telemetryData *telemetry.CustomData, utils *aakaas.AakUtils,
 	cpe *abapAddonAssemblyKitReleasePackagesCommonPipelineEnvironment) error {
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 	var addonDescriptor abaputils.AddonDescriptor
diff --git a/cmd/abapAddonAssemblyKitReleasePackages_generated.go b/cmd/abapAddonAssemblyKitReleasePackages_generated.go
index cb8fce72cd..bba08aa32f 100644
--- a/cmd/abapAddonAssemblyKitReleasePackages_generated.go
+++ b/cmd/abapAddonAssemblyKitReleasePackages_generated.go
@@ -18,12 +18,13 @@ import (
 )
 
 type abapAddonAssemblyKitReleasePackagesOptions struct {
-	AbapAddonAssemblyKitEndpoint string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
-	Username                     string `json:"username,omitempty"`
-	Password                     string `json:"password,omitempty"`
-	AddonDescriptor              string `json:"addonDescriptor,omitempty"`
-	MaxRuntimeInMinutes          int    `json:"maxRuntimeInMinutes,omitempty"`
-	PollingIntervalInSeconds     int    `json:"pollingIntervalInSeconds,omitempty"`
+	AbapAddonAssemblyKitEndpoint   string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
+	Username                       string `json:"username,omitempty"`
+	Password                       string `json:"password,omitempty"`
+	AddonDescriptor                string `json:"addonDescriptor,omitempty"`
+	MaxRuntimeInMinutes            int    `json:"maxRuntimeInMinutes,omitempty"`
+	PollingIntervalInSeconds       int    `json:"pollingIntervalInSeconds,omitempty"`
+	AbapAddonAssemblyKitOriginHash string `json:"abapAddonAssemblyKitOriginHash,omitempty"`
 }
 
 type abapAddonAssemblyKitReleasePackagesCommonPipelineEnvironment struct {
@@ -89,6 +90,7 @@ For Terminology refer to the [Scenario Description](https://www.project-piper.io
 				log.SetErrorCategory(log.ErrorConfiguration)
 				return err
 			}
+			log.RegisterSecret(stepConfig.AbapAddonAssemblyKitOriginHash)
 
 			if len(GeneralConfig.HookConfig.SentryConfig.Dsn) > 0 {
 				sentryHook := log.NewSentryHook(GeneralConfig.HookConfig.SentryConfig.Dsn, GeneralConfig.CorrelationID)
@@ -164,6 +166,7 @@ func addAbapAddonAssemblyKitReleasePackagesFlags(cmd *cobra.Command, stepConfig
 	cmd.Flags().StringVar(&stepConfig.AddonDescriptor, "addonDescriptor", os.Getenv("PIPER_addonDescriptor"), "Structure in the commonPipelineEnvironment containing information about the Product Version and corresponding Software Component Versions")
 	cmd.Flags().IntVar(&stepConfig.MaxRuntimeInMinutes, "maxRuntimeInMinutes", 5, "Maximum runtime for status polling in minutes")
 	cmd.Flags().IntVar(&stepConfig.PollingIntervalInSeconds, "pollingIntervalInSeconds", 30, "Wait time in seconds between polling calls")
+	cmd.Flags().StringVar(&stepConfig.AbapAddonAssemblyKitOriginHash, "abapAddonAssemblyKitOriginHash", os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"), "Origin Hash for restricted AAKaaS scenarios")
 
 	cmd.MarkFlagRequired("abapAddonAssemblyKitEndpoint")
 	cmd.MarkFlagRequired("username")
@@ -244,6 +247,15 @@ func abapAddonAssemblyKitReleasePackagesMetadata() config.StepData {
 						Aliases:     []config.Alias{},
 						Default:     30,
 					},
+					{
+						Name:        "abapAddonAssemblyKitOriginHash",
+						ResourceRef: []config.ResourceReference{},
+						Scope:       []string{"PARAMETERS"},
+						Type:        "string",
+						Mandatory:   false,
+						Aliases:     []config.Alias{},
+						Default:     os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"),
+					},
 				},
 			},
 			Outputs: config.StepOutputs{
diff --git a/cmd/abapAddonAssemblyKitReserveNextPackages.go b/cmd/abapAddonAssemblyKitReserveNextPackages.go
index 63a8fe8fdd..1142b30818 100644
--- a/cmd/abapAddonAssemblyKitReserveNextPackages.go
+++ b/cmd/abapAddonAssemblyKitReserveNextPackages.go
@@ -30,7 +30,7 @@ func runAbapAddonAssemblyKitReserveNextPackages(config *abapAddonAssemblyKitRese
 
 	log.Entry().Infof("... initializing connection to AAKaaS @ %v", config.AbapAddonAssemblyKitEndpoint)
 	conn := new(abapbuild.Connector)
-	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils); err != nil {
+	if err := conn.InitAAKaaS(config.AbapAddonAssemblyKitEndpoint, config.Username, config.Password, *utils, config.AbapAddonAssemblyKitOriginHash); err != nil {
 		return err
 	}
 
diff --git a/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go b/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
index d925d411d3..d0c031ed3b 100644
--- a/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
+++ b/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
@@ -18,12 +18,13 @@ import (
 )
 
 type abapAddonAssemblyKitReserveNextPackagesOptions struct {
-	AbapAddonAssemblyKitEndpoint string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
-	Username                     string `json:"username,omitempty"`
-	Password                     string `json:"password,omitempty"`
-	AddonDescriptor              string `json:"addonDescriptor,omitempty"`
-	MaxRuntimeInMinutes          int    `json:"maxRuntimeInMinutes,omitempty"`
-	PollingIntervalInSeconds     int    `json:"pollingIntervalInSeconds,omitempty"`
+	AbapAddonAssemblyKitEndpoint   string `json:"abapAddonAssemblyKitEndpoint,omitempty"`
+	Username                       string `json:"username,omitempty"`
+	Password                       string `json:"password,omitempty"`
+	AddonDescriptor                string `json:"addonDescriptor,omitempty"`
+	MaxRuntimeInMinutes            int    `json:"maxRuntimeInMinutes,omitempty"`
+	PollingIntervalInSeconds       int    `json:"pollingIntervalInSeconds,omitempty"`
+	AbapAddonAssemblyKitOriginHash string `json:"abapAddonAssemblyKitOriginHash,omitempty"`
 }
 
 type abapAddonAssemblyKitReserveNextPackagesCommonPipelineEnvironment struct {
@@ -95,6 +96,7 @@ For Terminology refer to the [Scenario Description](https://www.project-piper.io
 			}
 			log.RegisterSecret(stepConfig.Username)
 			log.RegisterSecret(stepConfig.Password)
+			log.RegisterSecret(stepConfig.AbapAddonAssemblyKitOriginHash)
 
 			if len(GeneralConfig.HookConfig.SentryConfig.Dsn) > 0 {
 				sentryHook := log.NewSentryHook(GeneralConfig.HookConfig.SentryConfig.Dsn, GeneralConfig.CorrelationID)
@@ -170,6 +172,7 @@ func addAbapAddonAssemblyKitReserveNextPackagesFlags(cmd *cobra.Command, stepCon
 	cmd.Flags().StringVar(&stepConfig.AddonDescriptor, "addonDescriptor", os.Getenv("PIPER_addonDescriptor"), "Structure in the commonPipelineEnvironment containing information about the Product Version and corresponding Software Component Versions")
 	cmd.Flags().IntVar(&stepConfig.MaxRuntimeInMinutes, "maxRuntimeInMinutes", 5, "Maximum runtime for status polling in minutes")
 	cmd.Flags().IntVar(&stepConfig.PollingIntervalInSeconds, "pollingIntervalInSeconds", 30, "Wait time in seconds between polling calls")
+	cmd.Flags().StringVar(&stepConfig.AbapAddonAssemblyKitOriginHash, "abapAddonAssemblyKitOriginHash", os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"), "Origin Hash for restricted AAKaaS scenarios")
 
 	cmd.MarkFlagRequired("abapAddonAssemblyKitEndpoint")
 	cmd.MarkFlagRequired("username")
@@ -250,6 +253,15 @@ func abapAddonAssemblyKitReserveNextPackagesMetadata() config.StepData {
 						Aliases:     []config.Alias{},
 						Default:     30,
 					},
+					{
+						Name:        "abapAddonAssemblyKitOriginHash",
+						ResourceRef: []config.ResourceReference{},
+						Scope:       []string{"PARAMETERS"},
+						Type:        "string",
+						Mandatory:   false,
+						Aliases:     []config.Alias{},
+						Default:     os.Getenv("PIPER_abapAddonAssemblyKitOriginHash"),
+					},
 				},
 			},
 			Outputs: config.StepOutputs{
diff --git a/pkg/abap/aakaas/targetVector_test.go b/pkg/abap/aakaas/targetVector_test.go
index b797f0c2d9..eb20583d74 100644
--- a/pkg/abap/aakaas/targetVector_test.go
+++ b/pkg/abap/aakaas/targetVector_test.go
@@ -147,7 +147,7 @@ func TestTargetVectorCreate(t *testing.T) {
 		mc := abapbuild.NewMockClient()
 		mc.AddData(AAKaaSHead)
 		mc.AddData(AAKaaSTVCreatePost)
-		errInitConn := conn.InitAAKaaS("", "dummyUser", "dummyPassword", &mc)
+		errInitConn := conn.InitAAKaaS("", "dummyUser", "dummyPassword", &mc, "")
 		assert.NoError(t, errInitConn)
 
 		errInitTV := targetVector.InitNew(&addonDescriptor)
@@ -171,7 +171,7 @@ func TestTargetVectorPublish(t *testing.T) {
 		mc := abapbuild.NewMockClient()
 		mc.AddData(AAKaaSHead)
 		mc.AddData(AAKaaSTVPublishTestPost)
-		errInitConn := conn.InitAAKaaS("", "dummyUser", "dummyPassword", &mc)
+		errInitConn := conn.InitAAKaaS("", "dummyUser", "dummyPassword", &mc, "")
 		assert.NoError(t, errInitConn)
 
 		//act
diff --git a/pkg/abap/build/connector.go b/pkg/abap/build/connector.go
index 87ac2c57e9..6947d5d059 100644
--- a/pkg/abap/build/connector.go
+++ b/pkg/abap/build/connector.go
@@ -130,12 +130,16 @@ func (conn Connector) createUrl(appendum string) string {
 }
 
 // InitAAKaaS : initialize Connector for communication with AAKaaS backend
-func (conn *Connector) InitAAKaaS(aAKaaSEndpoint string, username string, password string, inputclient piperhttp.Sender) error {
+func (conn *Connector) InitAAKaaS(aAKaaSEndpoint string, username string, password string, inputclient piperhttp.Sender, originHash string) error {
 	conn.Client = inputclient
 	conn.Header = make(map[string][]string)
 	conn.Header["Accept"] = []string{"application/json"}
 	conn.Header["Content-Type"] = []string{"application/json"}
 	conn.Header["User-Agent"] = []string{"Piper-abapAddonAssemblyKit/1.0"}
+	if originHash != "" {
+		conn.Header["build-config-token"] = []string{originHash}
+		log.Entry().Info("Origin info for restricted scenario added")
+	}
 
 	cookieJar, _ := cookiejar.New(nil)
 	conn.Client.SetOptions(piperhttp.ClientOptions{
diff --git a/pkg/abap/build/connector_test.go b/pkg/abap/build/connector_test.go
index d3109f9475..94e51822bc 100644
--- a/pkg/abap/build/connector_test.go
+++ b/pkg/abap/build/connector_test.go
@@ -4,13 +4,43 @@
 package build
 
 import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
 	"net/url"
 	"testing"
 	"time"
 
+	"golang.org/x/exp/slices" //in 1.21 will be a standard package "slices"
+
+	piperhttp "github.com/SAP/jenkins-library/pkg/http"
 	"github.com/stretchr/testify/assert"
 )
 
+type HeaderVerifyingMockClient struct {
+	Header map[string][]string
+}
+
+func (mc *HeaderVerifyingMockClient) SetOptions(opts piperhttp.ClientOptions) {}
+func (mc *HeaderVerifyingMockClient) SendRequest(Method, Url string, bdy io.Reader, hdr http.Header, cookies []*http.Cookie) (*http.Response, error) {
+	for requiredHeaderKey, requiredHeaderValues := range mc.Header {
+		suppliedHeaderValues, existingHeader := hdr[requiredHeaderKey]
+		if existingHeader {
+			for _, element := range requiredHeaderValues {
+				existingValue := slices.Contains(suppliedHeaderValues, element)
+				if !existingValue {
+					return nil, fmt.Errorf("header %s does not contain expected value %s", requiredHeaderKey, element)
+				}
+			}
+		} else {
+			return nil, fmt.Errorf("Expected header %s not part of the http request", requiredHeaderKey)
+		}
+	}
+
+	return &http.Response{Body: io.NopCloser(bytes.NewReader([]byte("")))}, nil
+}
+
 func TestCreateUrl(t *testing.T) {
 	//arrange global
 	conn := new(Connector)
@@ -59,3 +89,36 @@ func TestCreateUrl(t *testing.T) {
 		assert.Equal(t, "/BUILD/CORE_SRV/builds('123456789')?format=json&sap-client=001&top=2", url)
 	})
 }
+
+func TestInitAAKaaSHeader(t *testing.T) {
+	conn := new(Connector)
+
+	client := HeaderVerifyingMockClient{}
+	client.Header = make(map[string][]string)
+	client.Header["Accept"] = []string{"application/json"}
+	client.Header["Content-Type"] = []string{"application/json"}
+	client.Header["User-Agent"] = []string{"Piper-abapAddonAssemblyKit/1.0"}
+	t.Run("InitAAKaaS success no hash", func(t *testing.T) {
+		conn.InitAAKaaS("endpoint", "user", "pw", &client, "")
+		_, err := conn.Get("something")
+		assert.NoError(t, err)
+	})
+	t.Run("InitAAKaaS success with hash", func(t *testing.T) {
+		client.Header["build-config-token"] = []string{"hash"}
+		conn.InitAAKaaS("endpoint", "user", "pw", &client, "hash")
+		_, err := conn.Get("something")
+		assert.NoError(t, err)
+	})
+	t.Run("InitAAKaaS sanity check Header", func(t *testing.T) {
+		client.Header["FAIL"] = []string{"verify HeaderVerifyingMockClient works"}
+		conn.InitAAKaaS("endpoint", "user", "pw", &client, "hash")
+		_, err := conn.Get("something")
+		assert.Error(t, err)
+	})
+	t.Run("InitAAKaaS sanity check wrong Value in existing Header", func(t *testing.T) {
+		client.Header["Accept"] = []string{"verify HeaderVerifyingMockClient works"}
+		conn.InitAAKaaS("endpoint", "user", "pw", &client, "hash")
+		_, err := conn.Get("something")
+		assert.Error(t, err)
+	})
+}
diff --git a/pkg/abap/build/mockClient.go b/pkg/abap/build/mockClient.go
index 573de8aee5..04d1de6aa8 100644
--- a/pkg/abap/build/mockClient.go
+++ b/pkg/abap/build/mockClient.go
@@ -91,7 +91,6 @@ func (mc *MockClient) SetOptions(opts piperhttp.ClientOptions) {}
 func (mc *MockClient) SendRequest(Method, Url string, bdy io.Reader, hdr http.Header, cookies []*http.Cookie) (*http.Response, error) {
 	response, ok := mc.getResponse(Method, Url)
 	if !ok {
-		//return nil, errors.New("No Mock data for given Method+Url")
 		return nil, fmt.Errorf("No Mock data for %s", Method+Url)
 	}
 	return &response, nil
diff --git a/resources/metadata/abapAddonAssemblyKitCreateTargetVector.yaml b/resources/metadata/abapAddonAssemblyKitCreateTargetVector.yaml
index 33cfb9ef1f..97974d4945 100644
--- a/resources/metadata/abapAddonAssemblyKitCreateTargetVector.yaml
+++ b/resources/metadata/abapAddonAssemblyKitCreateTargetVector.yaml
@@ -51,6 +51,13 @@ spec:
         resourceRef:
           - name: commonPipelineEnvironment
             param: abap/addonDescriptor
+      - name: abapAddonAssemblyKitOriginHash
+        type: string
+        description: Origin Hash for restricted AAKaaS scenarios
+        scope:
+          - PARAMETERS
+        mandatory: false
+        secret: true
   outputs:
     resources:
       - name: commonPipelineEnvironment
diff --git a/resources/metadata/abapAddonAssemblyKitPublishTargetVector.yaml b/resources/metadata/abapAddonAssemblyKitPublishTargetVector.yaml
index e34cdceabf..a0f88f21fa 100644
--- a/resources/metadata/abapAddonAssemblyKitPublishTargetVector.yaml
+++ b/resources/metadata/abapAddonAssemblyKitPublishTargetVector.yaml
@@ -79,3 +79,10 @@ spec:
         resourceRef:
           - name: commonPipelineEnvironment
             param: abap/addonDescriptor
+      - name: abapAddonAssemblyKitOriginHash
+        type: string
+        description: Origin Hash for restricted AAKaaS scenarios
+        scope:
+          - PARAMETERS
+        mandatory: false
+        secret: true
diff --git a/resources/metadata/abapAddonAssemblyKitRegisterPackages.yaml b/resources/metadata/abapAddonAssemblyKitRegisterPackages.yaml
index 87ea3a4187..c972156c92 100644
--- a/resources/metadata/abapAddonAssemblyKitRegisterPackages.yaml
+++ b/resources/metadata/abapAddonAssemblyKitRegisterPackages.yaml
@@ -53,6 +53,13 @@ spec:
         resourceRef:
           - name: commonPipelineEnvironment
             param: abap/addonDescriptor
+      - name: abapAddonAssemblyKitOriginHash
+        type: string
+        description: Origin Hash for restricted AAKaaS scenarios
+        scope:
+          - PARAMETERS
+        mandatory: false
+        secret: true
   outputs:
     resources:
       - name: commonPipelineEnvironment
diff --git a/resources/metadata/abapAddonAssemblyKitReleasePackages.yaml b/resources/metadata/abapAddonAssemblyKitReleasePackages.yaml
index 876f33b0ef..6d4fb77f5b 100644
--- a/resources/metadata/abapAddonAssemblyKitReleasePackages.yaml
+++ b/resources/metadata/abapAddonAssemblyKitReleasePackages.yaml
@@ -66,6 +66,13 @@ spec:
           - STEPS
           - GENERAL
         default: 30
+      - name: abapAddonAssemblyKitOriginHash
+        type: string
+        description: Origin Hash for restricted AAKaaS scenarios
+        scope:
+          - PARAMETERS
+        mandatory: false
+        secret: true
   outputs:
     resources:
       - name: commonPipelineEnvironment
diff --git a/resources/metadata/abapAddonAssemblyKitReserveNextPackages.yaml b/resources/metadata/abapAddonAssemblyKitReserveNextPackages.yaml
index 311644d38c..50a14b7121 100644
--- a/resources/metadata/abapAddonAssemblyKitReserveNextPackages.yaml
+++ b/resources/metadata/abapAddonAssemblyKitReserveNextPackages.yaml
@@ -72,6 +72,13 @@ spec:
           - STEPS
           - GENERAL
         default: 30
+      - name: abapAddonAssemblyKitOriginHash
+        type: string
+        description: Origin Hash for restricted AAKaaS scenarios
+        scope:
+          - PARAMETERS
+        mandatory: false
+        secret: true
   outputs:
     resources:
       - name: commonPipelineEnvironment