onedevatlasBeta
Browse the atlas
AllCAPBTPUI5ABAP
ServiceServicetypeA BTP service you subscribe to and bind, rather than install. It has plans and regions, not versions, and may deliver a product that lives outside the atlas.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →

SAP Authorization and Trust Management service

The OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.

Homepage
Docs
What’s New

Where it sits

Lives in
BTP/BAIP
Provides
AuthenticationBTPCAPAuthenticationcapabilityEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.AuthorizationBTPCAPAuthorizationcapabilityDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.
Serves
CAP
Designs
Generative AI on SAP BTPGenerative AI on SAP BTPreference architectureuser authorizations and trust to identity providers

What it declares

Every artifact

Type
Service
Origin
By SAP

As a service

Plans
4
Regions
46
Support component
BC-CP-CF-SEC-IAM

For authentication

Supports
Token with no userPasses the user onCorporate IdP behind it
property statedstated nonot said

Tasks this contributes to3Beta

Authentication3
Get a token for a protected BTP endpoint with no user signed inA script, a job or another service calls a protected endpoint of a deployed SAP BTP application and is accepted, with nobody at a browser.Coversauthorization server
What it does

Issues the token. SAP's architecture page separates the API client from the browser user: the client gets its credentials from this service and authenticates against it directly, and the client credentials grant is among the grant types the environment supports.

Remaining work

Create the service instance and its OAuth client, keep the client secret somewhere the caller can read, call the token endpoint on each run and handle expiry. The endpoint being called still validates the JWT and checks its scopes itself.

All options on the Authentication page →
Put the company's own identity provider behind a BTP application's loginPeople sign in to a BTP application with their corporate account, under the company's own password and multifactor policy rather than SAP's.Coversthe trust the subaccount holds
What it does

Holds the subaccount's side of the trust. Identity federation is what frees the platform and its applications from storing credentials and authenticating people themselves, and the trust is established by cross-configuring the endpoints of both systems.

Remaining work

Cross-configure the endpoints, and move the subaccount off the trust it starts with: that is SAP ID service, where SAP states there is no mechanism to enforce multifactor authentication on its users.

All options on the Authentication page →
Sign a browser user in to a BTP application and have its backends accept the resultA person opens a deployed SAP BTP application in a browser, logs in once, and each of the application's own backend endpoints accepts the request as that person.Shown workingauthorization server
What it does

Turns the successful login into the token the application reads. The identity provider's SAML bearer assertion is presented to this service, it determines that user's authorizations, and it signs the JWT with the key whose public half arrives in each app's binding.

Remaining work

Cross-configure the trust with the identity provider, declare the application's authorizations in its security descriptor, and bind every app of the application to the one service instance.

All options on the Authentication page →

Connections32

Download
SAP Authorization and Trust Management service connectionsSAP Authorization andTrust Management servicePROVIDES→ provides2provides stated Acts as the OAuth 2.0 authorization server of a business application. A subaccount cross-configures trust with an identity provider, the provider's SAML bearer assertion is presented to this service once the user has authenticated, and the service determines that user's authorizations and signs the JWT whose signature the application verifies with the public key in its binding. An API client skips the browser and authenticates against the service directly. What Is the SAP Authorization and Trust Management Service? — OAuth 2.0, Resource Owner, Client, Resource Server: https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only: https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md What Is the SAP Authorization and Trust Management Service? — JSON Web Tokens: https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.mdAuthenticationprovides authoredAuthorizationUSED BY← connected from4connected from derived Logging a user in on the routes that require it: the router runs the OAuth2 authorization code flow against the UAA and takes the redirect back at its login callback endpoint. Through: inverted from its connects edge @sap/approuter 23.0.0 — README, login property: https://unpkg.com/@sap/approuter@23.0.0/README.md @sap/approuter 23.0.0 — README, state parameter and PKCE: https://unpkg.com/@sap/approuter@23.0.0/README.md@sap/approuterconnected from derived Validating the JWT a request carries against the keys XSUAA publishes, and fetching tokens from it. Through: inverted from its connects edge @sap/xssec 4.15.0 — README: https://unpkg.com/@sap/xssec@4.15.0/README.md @sap/xssec 4.15.0 — README, JWKS: https://unpkg.com/@sap/xssec@4.15.0/README.md @sap/xssec 4.15.0 — README, JWKS: https://unpkg.com/@sap/xssec@4.15.0/README.md@sap/xssecconnected from derived Reads the definition of the role collections to be transported from the source subaccount and posts them to the target subaccount. Through: inverted from its connects edge Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community: https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208 Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community: https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208auth-transportconnected from derived If: the HTTP transport with the `calmcp-xsuaa` service bound has XSUAA sign the caller in and issue the token the `/mcp` endpoint checks for the `Viewer` scope, with OAuth discovery and client registration proxied to it Through: inverted from its connects edge consetto/calmcp — README, Endpoint authentication: https://raw.githubusercontent.com/consetto/calmcp/main/README.md consetto/calmcp — README, Endpoint authentication: https://raw.githubusercontent.com/consetto/calmcp/main/README.mdcalmcpif← needed by12needed by derived the bound XSUAA service instance whose credentials and application URL the facade reads from the environment, and the authorization server the OAuth proxy fronts Through: inverted from its requires edge arc-mcp/xsuaa-auth — README: https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md@arc-mcp/xsuaa-authneeded by derived The XSUAA binding of the target app, whose client credentials it reads from VCAP_SERVICES and exchanges for a client_credentials token. Through: inverted from its requires edge dongitran/saptools — packages/cf-xsuaa/README.md: https://github.com/dongitran/saptools/blob/main/packages/cf-xsuaa/README.md@saptools/cf-xsuaaneeded by derived The project declares its uaa binding as kind xsuaa, and the MTA deploys an xsuaa instance from the project's own xs-security.json: outside a local run, that instance is where the roles the restrict rules name live. Through: inverted from its requires edge miyasuta/auth-samples — salesorders/package.json: https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/package.json miyasuta/auth-samples — salesorders/mta.yaml: https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/mta.yamlauth-samplesneeded by derived The API the tool calls in both subaccounts, to read a role collection's definition in the source and to create or update it in the target. Its apiaccess plan is what the calls are made with. Through: inverted from its requires edge Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community: https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208 Transporting role collections between BTP subaccounts Part1 : Custom tool — SAP Community: https://community.sap.com/t5/technology-blog-posts-by-members/transporting-role-collections-between-btp-subaccounts-part1-custom-tool/ba-p/13538208auth-transportneeded by derived Each of the three projects deploys its own xs-security.json as an xsuaa service instance; the role collection exists because the parent's instance declares it, and the role templates because the children's do. Through: inverted from its requires edge miyasuta/auth-transport2 — parent/mta.yaml: https://raw.githubusercontent.com/miyasuta/auth-transport2/master/parent/mta.yaml miyasuta/auth-transport2 — parent/xs-security.json: https://raw.githubusercontent.com/miyasuta/auth-transport2/master/parent/xs-security.jsonauth-transport2needed by derived The UI module's xs-app.json sets authenticationType xsuaa for the HTML5 Application Repository route, so an xsuaa instance built from the project's xs-security.json is bound to the approuter. Through: inverted from its requires edge Developing a Fiori elements app with CAP and Fiori Tools — SAP Community: https://community.sap.com/t5/technology-blog-posts-by-members/developing-a-fiori-elements-app-with-cap-and-fiori-tools/ba-p/13487547 miyasuta/blog-bookshop — mta.yaml: https://raw.githubusercontent.com/miyasuta/blog-bookshop/master/mta.yamlblog-bookshopneeded by derived the OAuth2 authentication in front of the server and the three role templates that separate read, write and administrative access Through: inverted from its requires edge BTP CF MCP Server — README: https://github.com/lemaiwo/btp-cf-mcp-serverBTP CF MCP Serverneeded by derived the one XSUAA instance the agent and all four MCP modules share, carrying the MCPViewer, MCPEditor and MCPAdmin role templates and the token that is forwarded downstream Through: inverted from its requires edge Agentic AI on BTP: a Single Agent with LangGraph — SAP Community, the shell: https://community.sap.com/t5/technology-blog-posts-by-members/agentic-ai-on-btp-a-single-agent-with-langgraph/ba-p/14388025 Agentic AI on BTP: a Single Agent with LangGraph — SAP Community, Why: https://community.sap.com/t5/technology-blog-posts-by-members/agentic-ai-on-btp-a-single-agent-with-langgraph/ba-p/14388025btp-agentneeded by derived The sign-in in front of the application, and the user JWT the agent's requests to the repository run under while setup runs on the SDM service key's client credentials. Through: inverted from its requires edge Reports Assistant with SAP Document Management — README, Setup: https://raw.githubusercontent.com/mi8y/cap-agents-addons/main/examples/cap-agents-sdm-backend/README.md Reports Assistant with SAP Document Management — README, Setup: https://raw.githubusercontent.com/mi8y/cap-agents-addons/main/examples/cap-agents-sdm-backend/README.mdReports Assistant with SAP DocumentManagementneeded by derived the authentication the deployed application runs behind, and the two role collections it defines Through: inverted from its requires edge SAP-samples/btp-ai-core-consumption-monitor — README, Requirements: https://github.com/SAP-samples/btp-ai-core-consumption-monitor SAP-samples/btp-ai-core-consumption-monitor — README, Security – Roles & Authorization: https://github.com/SAP-samples/btp-ai-core-consumption-monitorSAP-samples/btp-ai-core-consumption-monitorneeded by derived the token that protects the status, config and trigger endpoints on BTP Through: inverted from its requires edge SAP-samples/btp-ai-core-usage-monitor — README, Prerequisites: https://github.com/SAP-samples/btp-ai-core-usage-monitorSAP-samples/btp-ai-core-usage-monitorneeded by derived the authentication the deployed application runs behind, and the role collections assigned to its users Through: inverted from its requires edge SAP-samples/btp-resource-consumption-monitor — README, Requirements: https://github.com/SAP-samples/btp-resource-consumption-monitorSAP-samples/btp-resource-consumption-monitor← optionally used by8optionally used by derived If: XSUAA is selected as the authentication method SAP BTP native authentication with an automatic token proxy for MCP clients Through: inverted from its requires edge arc-1 README: https://github.com/arc-mcp/arc-1arc-1ifoptionally used by derived If: the HTTP transport, which refuses to start unless XSUAA or a static API key is configured the authorization server behind the `/mcp` endpoint, whose `Viewer` and `Writer` scopes decide who may call the tools Through: inverted from its requires edge consetto/calmcp — README, Endpoint authentication: https://raw.githubusercontent.com/consetto/calmcp/main/README.md consetto/calmcp — README, Using `cf push`: https://raw.githubusercontent.com/consetto/calmcp/main/README.mdcalmcpifoptionally used by derived If: JWT authentication selected with a service key (ABAP or XSUAA) browser-based JWT authentication issued via an XSUAA service key Through: inverted from its requires edge mcp-abap-adt README: https://github.com/fr0ster/mcp-abap-adtfr0ster/mcp-abap-adtifoptionally used by derived If: deployed to SAP BTP Cloud Foundry, the production path the XSUAA login that proves the caller's identity before the JWT is propagated to SAP Through: inverted from its requires edge ClementRingot/LISA — README, Prerequisites: https://raw.githubusercontent.com/ClementRingot/LISA/main/README.md ClementRingot/LISA — README, Part 2: https://raw.githubusercontent.com/ClementRingot/LISA/main/README.mdLISAifoptionally used by derived If: HTTP transport running on SAP BTP Cloud Foundry with an xsuaa service binding (XSUAA auth mode) authenticating MCP/API clients against [SAP Authorization and Trust Management service](artifact:btp-authorization-and-trust-management) on SAP BTP Through: inverted from its requires edge rosa: docs/ARCHITECTURE.md: https://raw.githubusercontent.com/ClementRingot/ROSA/main/docs/ARCHITECTURE.mdROSAifoptionally used by derived If: The dm-custom-api in-app service extension sample is deployed. The sample's endpoints are protected by an XSUAA instance, and the same client credentials configure the destination that Digital Manufacturing production processes call. Through: inverted from its requires edge Digital Manufacturing Extension: Custom protected BTP service calling DM APIs — Protecting endpoints: https://raw.githubusercontent.com/SAP-samples/digital-manufacturing-extension-samples/main/dm-inapp-service-extensions/dm-custom-api/README.mdSAP-samples/digital-manufacturing-extension-samplesifoptionally used by derived If: the agent needs OAuth2 authentication securing the agent with OAuth2 via XSUAA Through: inverted from its requires edge joule-a2a-agent-toolkit: skills/joule-a2a-agent/references/cf-deployment-cap-typescript.md: https://raw.githubusercontent.com/SAP-samples/joule-a2a-agent-toolkit/main/skills/joule-a2a-agent/references/cf-deployment-cap-typescript.mdSAP-samples/joule-a2a-agent-toolkitifoptionally used by derived If: the SAP BTP / xsuaa credential provider is configured fetching an OAuth2 client_credentials token from xsuaa before a run Through: inverted from its requires edge sap-bruno README: https://github.com/dongitran/sap-brunosapbrunoif← used by5used by derived Authenticating the user on the routes configured to require it: the router binds to it as the UAA server, or to [Cloud Identity Services](artifact:btp-cloud-identity-services) instead. Through: inverted from its requires edge @sap/approuter 23.0.0 — README, user authentication: https://unpkg.com/@sap/approuter@23.0.0/README.md@sap/approuterused by derived Through: inverted from its requires edge@sap/xssecused by derived the APIs the microservice calls to manage users and their authorizations. Through: inverted from its requires edge SAP-samples/btp-user-management-microservice — README: https://github.com/SAP-samples/btp-user-management-microservicebtp-user-management-microserviceused by derived The API the generated client calls: the specification in the project is that service's own Authorization API, and the handlers read and create role collections through it. Through: inverted from its requires edge miyasuta/cap-openapi — AuthorizationAPI.yaml: https://raw.githubusercontent.com/miyasuta/cap-openapi/main/srv/api-specs/AuthorizationAPI.yamlcap-openapiused by derived Through: inverted from its requires edgecom.sap.cds:cds-feature-identityNEEDS→ connects to1connects to stated Using a Cloud Identity Services tenant as the identity provider of a subaccount, or as a proxy to a corporate one: the trust is established with OpenID Connect, one tenant per subaccount by this method. Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services — SAP BTP documentation (SAP-docs/btp-cloud-platform): https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.md Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services — SAP BTP documentation (SAP-docs/btp-cloud-platform): https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.md SAP-docs/btp-cloud-platform — the page's title: https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.mdCloud Identity Services

Learn more2

Readings
  1. Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalYogananda, SAP Community
  2. SAP Business Technology Platform: Authorization and Trust Management ServiceSekhuteTK, SAP Community

What’s New64

from SAP Help Portal, read
help.sap.com/whats-new, Authorization and Trust Management ServiceOn SAP Help Portal
64entries since , per month
Deprecated or Deleted, SAP’s label

  1. Deactivation of Default Identity Provider

    NewGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  2. Custom Platform Identity Provider Support for Chinese SAP BTP Universe

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2026-08-28

  3. Critical Security Authorizations Now Marked in Role Collections

    NewGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  4. SameSite=None Cookie Support Now Required

    ChangedGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2026-08-17

  5. Deprecate GET Method for Token Retrieval

    ChangedDeprecatedRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2026-02-02

  6. Resilience Improvement for Retrieval of Authorized Accounts

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  7. Replacement of Library for the Security Assertion Markup Language (SAML)

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  8. Change Priority of Security Recommendation BTP-UAA-0003 to Critical

    ChangedGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2026-02-27

  9. Automatic Signing Key Rotation for Access Tokens as Default

    ChangedGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-08-07

  10. End-of-Life for Synchronous Creation or Update of Service Instances

    ChangedDeprecatedRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-08-07

  11. End-of-Life for Instance Secret Credential Type

    ChangedDeprecatedRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-11-13

  12. End-of-Life for Service Plans

    ChangedDeprecatedRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-08-07

  13. New and Existing Custom Trusts for Business Users Changed to Token-Based Authentication

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  14. Replacement of Library for JSON Web Tokens (JWT)

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-10-02

  15. Principal propagation from SAP BTP to an On-Premise Cloud Connector with a Token From a Corporate Identity Provider

    NewGeneral AvailabilityInfo onlyCloud Foundry, Kyma

  16. Automatic Signing Key Rotation for Access Tokens

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  17. Existing Custom Trusts for Platform Users Changed to Token-Based Authentication

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  18. New Custom Trusts for Platform Users Changed to Token-Based Authentication

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  19. Update Security Recommendation BTP-UAA-0003 for Default Credential Types for Bindings

    AnnouncementGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Other

  20. Increased Priority of Security Recommendation BTP -UAA-0008 for Custom Identity Providers

    ChangedGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Neo, Other

  21. Deprecation of the xsenableasyncservice Element for Service Instances

    ChangedDeprecatedInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-04-03

  22. Deprecation of the instance-secret Credential Type for Service Instances

    ChangedDeprecatedInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-04-03

  23. Security Hardening for Redirect URIs

    AnnouncementGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-04-03

  24. Trust Configuration (New)

    NewGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-03-17

  25. Existing Custom Trusts for Business Users Changed to Token-Based Authentication

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-02-11

  26. New Custom Trusts for Business Users Changed to Token-Based Authentication

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Neo, Otherrevised 2025-02-11

  27. Delay Between Operations for Token Signing Keys Increased

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2025-01-09

  28. Deprecation of SAML for User-Interactive Authentication in Customer-Owned Accounts

    ChangedDeprecatedInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2025-05-28

  29. No Default Values for Redirect URIs in New Cloud Foundry Landscapes

    AnnouncementGeneral AvailabilityRequiredCloud Foundry, Otherrevised 2024-10-18

  30. Change of Default Credential Type to binding-secret

    AnnouncementGeneral AvailabilityRequiredCloud Foundry, Otherrevised 2024-10-18

  31. Creation and Update of xsuaa Service Instances Becomes Asynchronous by Default

    AnnouncementGeneral AvailabilityRequiredCloud Foundry, Otherrevised 2024-10-18

  32. Changed Behavior When Multitenant Applications Remove Predefined Role Collections

    AnnouncementGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2024-10-18

  33. Provisioning of Members in the Cloud Foundry Environment (Organizations and and Spaces) Using SAP Cloud Identity Services - Identity Provisioning

    NewGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2024-10-28

  34. Removal of Security Recommendation BTP-UAA-0009

    ChangedDeletedInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2024-10-11

  35. Preservation of Case for Shadow Users in New Subaccounts

    AnnouncementGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Otherrevised 2024-04-16

  36. Deprecation of Third-Party Cookies

    ChangedGeneral AvailabilityRequiredABAP, Cloud Foundry, Kyma, Other

  37. Deprecation of Service Plans

    ChangedDeprecatedInfo onlyABAP, Cloud Foundry, Kyma, Other

  38. Deprecation of /check_token Endpoint for Online Token Validation

    ChangedDeprecatedInfo onlyABAP, Cloud Foundry, Kyma, Other

  39. Own Origin Key at Creation of Trust (OpenID Connect) for Subaccounts

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Other

  40. Pattern for Naming Application When Establishing Trust for Subaccounts

    ChangedGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Other

  41. Management of API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service

    NewGeneral AvailabilityInfo onlyABAP, Cloud Foundry, Kyma, Otherrevised 2024-01-11

  42. OpenID Connect Authentication

    NewBetaInfo onlyNeo

  43. Limits for Roles, Role Collections, Trust, and Service Broker Instances

    ChangedGeneral AvailabilityInfo onlyCloud Foundry, Kymarevised 2023-10-19

  44. Limits for the Application Security Descriptor and Service Broker Bindings

    ChangedGeneral AvailabilityInfo onlyCloud Foundry, Kymarevised 2023-10-04

  45. Update Security Recommendation BTP-UAA-0005

    ChangedGeneral AvailabilityInfo onlyCloud Foundry, Kyma

  46. Changed Behavior of Token Requests

    ChangedGeneral AvailabilityInfo onlyCloud Foundry, Kyma

  47. Application Login Using a Custom Domain of the Identity Authentication Tenant

    NewGeneral AvailabilityInfo onlyCloud Foundry, Kyma

  48. Migrate SAML-Based Trust of Custom Identity Provider to OpenID Connect

    ChangedGeneral AvailabilityInfo onlyCloud Foundry

  49. Custom Identity Provider Trust with an Identity Authentication Tenant for Multiple Customer IDs

    ChangedGeneral AvailabilityInfo onlyCloud Foundry

  50. Discontinue Support of jwt Format for Refresh Tokens

    NewGeneral AvailabilityInfo onlyCloud Foundry

  51. Restriction in the Validity of Access and Refresh Tokens

    ChangedGeneral AvailabilityRequiredCloud Foundry

  52. Include Tokens from a Trusted Identity Provider in Tokens of the SAP Authorization and Trust Management Service

    NewGeneral AvailabilityInfo onlyCloud Foundry

  53. Update Security Recommendation BTP-UAA-0015

    ChangedGeneral AvailabilityRecommendedCloud Foundry, Kyma

  54. Security Recommendation for Access to REST APIs

    NewGeneral AvailabilityRecommendedCloud Foundry, Kyma

  55. Security Recommendation for Application User Logoff

    NewGeneral AvailabilityRecommendedCloud Foundry, Kyma

  56. Application Login Using a Custom Domain of the Identity Authentication Tenant

    AnnouncementGeneral AvailabilityInfo onlyCloud Foundry, Kyma

  57. Sharing and Unsharing Service Instances

    AnnouncementGeneral AvailabilityRequiredCloud Foundry, Kyma

  58. Update of Planned Restriction in the Validity of Access and Refresh Tokens

    AnnouncementGeneral AvailabilityRequiredCloud Foundry

  59. Planned Restriction in the Validity of Access and Refresh Tokens

    AnnouncementGeneral AvailabilityRequiredCloud Foundryrevised 2022-12-15

  60. Creating Service Instances for API Access Supports Custom Identity Providers for Platform Users

    ChangedGeneral AvailabilityInfo onlyCloud Foundryrevised 2022-11-04

  61. Issuer Change in X.509 Certificates Managed by the Service

    ChangedGeneral AvailabilityRequiredCloud Foundryrevised 2024-01-01

  62. Improvement of Cockpit Roles

    AnnouncementGeneral AvailabilityInfo onlyCloud Foundryrevised 2024-01-01

  63. Rate Limiting Extended

    AnnouncementGeneral AvailabilityInfo onlyCloud Foundryrevised 2024-01-01

  64. Documentation of Token Support

    AnnouncementGeneral AvailabilityInfo onlyCloud Foundryrevised 2024-01-01

titles and labels, read

Others providing28

Authentication
  1. abap_jwt_generatorGenerates signed JSON Web Tokens in ABAPfrom ABAP
  2. @arc-mcp/xsuaa-authXSUAA authentication stack for an MCP server on SAP BTPfrom BTP/BAIP
  3. abap-pwnedpasswordsChecks passwords against Have I Been Pwned from ABAPfrom ABAP
  4. Cloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenantfrom BTP/BAIP
  5. SAP Customer Identity and Access Management for B2CRegistration, login and consent for customer-facing sitesfrom BTP/BAIP
  6. OAuth 2.0 on SAP BTPOAuth 2.0 grant flows for applications and APIs in Neo regionsfrom BTP/BAIP
  7. com.sap.cds:cds-feature-identityOAuth2 token validation from XSUAA and SAP Cloud Identity Servicesfrom CAP
  8. com.sap.cds:cds-feature-xsuaaFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0from CAP
  9. abapOAuthAzureOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAPfrom ABAP
  10. abap2oauth2ABAP API for OAuth 2.0 authenticationfrom ABAP
  11. abapNTLMHTTP NTLM client for ABAPfrom ABAP
  12. abap_cloud_platformTypeScript library reaching ABAP service instances on Cloud Foundryfrom BTP/BAIP
  13. decodesapsso2TypeScript decoder for MYSAPSSO2 logon ticketsfrom ABAP
  14. @marianfoo/sap-mcp-authBrowser login and session module for SAP MCP serversfrom BTP/BAIP
  15. @sap/approuterSAP's Node.js application router in front of business applicationsfrom BTP/BAIP
  16. @sap/cdsCAP Node.js runtimefrom CAP
  17. Cloud ConnectorSAP's on-premises agent linking SAP BTP to customer-network systemsfrom BTP/BAIP
  18. @sap/xssecToken validation and security context for XSUAA and IASfrom CAP
  19. cds-azure-adAzure AD and Azure AD B2C authentication strategy for CAPfrom CAP
  20. @saptools/cf-xsuaaOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingfrom BTP/BAIP
  21. cds-common-jwt-supportJWT authentication for CAP without xsuaa or xssecfrom CAP
  22. abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.from ABAP
Authorization
  1. OAuth 2.0 on SAP BTPOAuth 2.0 grant flows for applications and APIs in Neo regionsfrom BTP/BAIP
  2. com.sap.cds:cds-services-bomMaven bill of materials pinning CAP Java module versionsfrom CAP
  3. cap-toolkitUtility bundle for CAP handlers: builder, roles, validation, queriesfrom CAP
  4. @sap/ams-devCompiler from AMS DCL policies to DCN for local runs and testsfrom CAP
  5. @sap/amsAuthorization from DCL policies for Node.js apps on SAP Cloud Identityfrom CAP
  6. @sap/cdsCAP Node.js runtimefrom CAP
  7. sap-usi-authority-checkAuthority check helper class used across SchwarzIT's USI reportsfrom ABAP
  8. cds-entra-idMaps Microsoft Entra ID groups and app roles onto cds.User rolesfrom CAP

Details

Sources1
SAP-samples/btp-service-metadatadiscovered here, btp-service-metadatachecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
discovered viaSAP-samples/btp-service-metadata · btp-service-metadata
first seen in the atlas
ecosystem and domainbtp, security-and-compliance
History in the atlas5
  1. what it does, sources, two properties
  2. The second reader read the connects batch of 2026-09-19 on 2026-09-22, after its acceptance, and found: neither quote names this service, and only one names Cloud Identity Services, so the page's title, which names both parties, is quoted beside them.
  3. The two security services had no edge between them, although most BTP diagrams draw one. SAP's administration guide states the trust and the protocol it is established with.
  4. The same as Cloud Identity Services: ABAP's authorisation model is not XSUAA's, and a UI5 frontend does not validate the JWT — the router and the service do.
  5. First seen.
For your agent
Ref
artifact:btp-authorization-and-trust-management
JSON
/artifacts/btp-authorization-and-trust-management.json
MCP
Connecting an agent