CDS pluginCDS plugintypeInstalls into a CAP project and extends the runtime. CAP loads it through cds.requires or the plugin hook.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
@cap-js/audit-logging
Integration with the SAP Audit Log serviceSAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.
LoggingCAPLoggingcapabilitySeeing what a running service did, in a form something can read afterwards — levels, a formatter that suits a laptop and one that suits a log service.Audit loggingCAPAudit loggingcapabilityRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.
@sap/cds≥ 9@sap/cdsartifactThe peer range, as published.
Optional
SAP Audit Log serviceSAP Audit Log serviceartifactThe service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Who is behind it
SAP Cloud Application Programming ModelSAP Cloud Application Programming ModelOrganisationMaintains this In the atlas: maintains 34@cap-jsmaintainerAjinkya PatilPersonContributes to this In the atlas: contributes to 112@ajinkyapatil8190Arley Triana MorinPersonContributes to this In the atlas: contributes to 9, wrote 1@arleytmChristian GeorgiPersonContributes to this In the atlas: maintains 1, contributes to 53@chgeoChristian SchüringsPersonContributes to this In the atlas: contributes to 25@cschueringsDaniel HutzelPersonContributes to this In the atlas: contributes to 32, wrote 3@danjoaDr. David A. KunzPersonContributes to this In the atlas: contributes to 16@David-KunzGuilherme DellagustinPersonContributes to this In the atlas: contributes to 27@dellagustin-sapNikolay GrechanovPersonContributes to this In the atlas: contributes to 1@grenikHeiko WitteborgPersonContributes to this In the atlas: contributes to 18@hm23Johannes VogelPersonContributes to this In the atlas: contributes to 25@johannes-vogel25 contributors
Before choosing this
crawled
Conditions
LicenceSAP Developer License Agreement 3.2 CAP§ 1, 2, 3A cds-plugin is used with SAP CAP materials, or an artifact is explicitly identified as a CAP plugin or application.
Derived: the instrument's applicability matches this artifact, checked
§ 1License. Productive customer applications are limited to SAP BTP or another SAP-licensed platform, and mass extraction to a non-SAP product is restricted except where solely required for SAP interoperability.
§ 2Intellectual Property. The agreement retains SAP's rights in the covered materials and limits making APIs, tools or software available to third parties, while preserving ownership of customer applications subject to SAP's underlying rights.
§ 3Artificial Intelligence Training. The agreement prohibits use of the covered materials and customer applications for training artificial-intelligence models or systems.
declared, How the plugin is installed into a CAP project, as its documentation says., read npm add @cap-js/audit-logging — @cap-js/audit-logging — README, 2026-10-18
Connections4
Group by
NodeRelationConditionBasis
Functional2
Audit loggingAudit loggingcapabilityRecording who touched personal or sensitive data, for auditorsSAP only
→provides
none
authored
provides Audit logging
Functional, authored
Recording who touched personal or sensitive data, for auditors
LoggingLoggingcapabilitySeeing what a running service did, in a readable formSAP only
→provides
none
authored
provides Logging
Functional, authored
Seeing what a running service did, in a readable form
Technical2
SAP Audit Log serviceSAP Audit Log serviceserviceIngests and retains compliance audit data from BTPsap official, btp
→connects to
if The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead
connects to SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
Writing the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.
Basis
“`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.”@cap-js/audit-logging — README, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
stated
connects to SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
Writing the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.
Basis
“`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.”@cap-js/audit-logging — README, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
Ingests and retains compliance audit data from BTP
SAP Audit Log serviceSAP Audit Log serviceserviceIngests and retains compliance audit data from BTPsap official, btp
→optionally needs
if The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead
optionally needs SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
The service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Basis
“requires a paid-for instance of the [SAP Audit Log service for customers]”cap-js/audit-logging — README, In Production, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
stated
optionally needs SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
The service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Basis
“requires a paid-for instance of the [SAP Audit Log service for customers]”cap-js/audit-logging — README, In Production, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
Ingests and retains compliance audit data from BTP
Derived from the package name. No recipe recorded; the README has the configuration.
Learn more2
Readings
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsblogWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09gopalanand, SAP Community
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationblogThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01KrishnaSharma7, SAP Community
What changed
v1.3.0
Support for @sap/cds 8 is dropped; the plugin needs @sap/cds 9 or later.
Makes stale:
Setup notes that add the plugin to a CAP 8 project.
1 earlier
v0.1.0
Logs are written with audit.log() and audit.logSync() against the SAP Audit Log Service REST API instead of through the @sap/audit-logging client library. The events dataAccessLog, dataModificationLog, configChangeLog and securityLog are removed, @AuditLog.Operation annotations are ignored, and reading sensitive data is logged only when cds.requires['audit-log'].handle includes READ.
Makes stale:
Guides that set cds.features.audit_personal_data: true, annotate entities with @AuditLog.Operation, or expect reads of sensitive data to be logged by default.
@cap-js/audit-loggingcds-pluginIntegration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.sap official, cap
SAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp
@cap-js/audit-logging → SAP Audit Log serviceStated in the document, data, under a conditionWriting the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.If The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
SAPnot SAP's, or the project's ownstated in the document
@cap-js/audit-logging is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.
The information in this file is by no means complete but enables you to get started quickly. Make sure to read the provided documentation at cap.cloud.sap to get the full picture.
Preliminaries
In this guide, we use the Incidents Management reference sample app as the base to add change tracking to. Clone the repository and apply the step-by-step instructions:
git clone https://github.com/cap-js/incidents-appcd incidents-appnpm i
Setup
To enable audit logging, simply add this self-configuring plugin package to your project:
npm add @cap-js/audit-logging
Annotate Personal Data
Identify entities and elements (potentially) holding personal data using @PersonalData annotations. Create a db/data-privacy.cds file and add the following:
using { sap.capire.incidents as my } from './schema';annotate my.Customers with @PersonalData : { DataSubjectRole : 'Customer', EntitySemantics : 'DataSubject'} { ID @PersonalData.FieldSemantics: 'DataSubjectID'; firstName @PersonalData.IsPotentiallyPersonal; lastName @PersonalData.IsPotentiallyPersonal; email @PersonalData.IsPotentiallyPersonal; phone @PersonalData.IsPotentiallyPersonal; creditCardNo @PersonalData.IsPotentiallySensitive;};annotate my.Addresses with @PersonalData: { EntitySemantics : 'DataSubjectDetails'} { customer @PersonalData.FieldSemantics: 'DataSubjectID'; city @PersonalData.IsPotentiallyPersonal; postCode @PersonalData.IsPotentiallyPersonal; streetAddress @PersonalData.IsPotentiallyPersonal;};annotate my.Incidents with @PersonalData : { EntitySemantics : 'Other'} { customer @PersonalData.FieldSemantics: 'DataSubjectID';};
The end-to-end out-of-the-box functionality provided by this plugin requires a paid-for instance of the SAP Audit Log service for customers. However, it is possible to provide an own implementation that writes the audit logs to a custom store.
This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.
Code of Conduct
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.
Licensing
Copyright 2023 SAP SE or an SAP affiliate company and contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.
Properly encode request body parameters using in audit-log-to-restv2
Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association
await audit.log('<event>', <data>) for asynchronous logs (cf. emit)
await audit.logSync('<event>', <data>) for synchronous logs (cf. send)
New REST API-based schema with auto-filled LogEntry aspect
New events SensitiveDataRead, PersonalDataModified, ConfigurationModified, and SecurityEvent
Full support for OAuth2 plan of SAP Audit Log Service
Changed
Whether reading sensitive data and modifying personal data is logged is determined by cds.requires['audit-log'].handle: [...].
Possible values in the array are READ and/ or WRITE, with WRITE as the sole default entry.
Hence, accessing sensitive data is not logged by default.
Integration with SAP Audit Log Service via REST API instead of client library (@sap/audit-logging)
Fixed
Various glitches in log calculation
Removed
Old events dataAccessLog, dataModificationLog, configChangeLog, and securityLog
@AuditLog.Operation annotations are ignored. Having the plugin as dependency signals the intent to audit log.
cds.features.audit_personal_data: true is no longer necessary. Instead, simply add the plugin as a dependency.
LoggingLoggingcapabilitySeeing what a running service did, in a form something can read afterwards — levels, a formatter that suits a laptop and one that suits a log service.SAP only
ABAP-LoggerABAP-LoggerpackageA logging library for ABAP that records messages into the standard Application Log (BC-SRV-BAL) and displays them from there, installed through abapGit on ABAP 702 or higher.independent, abapLogging library for ABAP over the Application Logfrom ABAP
abap-log-exporterabap-log-exporterappExports SAP NetWeaver logs from the Business Application Log to an external log system such as Graylog or Loki, converting entries to GELF or Loki format through a separately configured reader, converter and connector.independent, abapExports Business Application Log entries to Graylog or Lokifrom ABAP
ABAP-PRCABAP-PRCpackageA framework for custom multi-step ABAP processes: a process class declares the states, and the framework runs each document through them and monitors the run.independent, abapFramework for multi-step ABAP processes with monitoringfrom ABAP
SAP Application Logging service for SAP BTPSAP Application Logging service for SAP BTPserviceCollects an application's log lines from Cloud Foundry or Kyma into a searchable Kibana, for the retention the plan sets.sap official, btpCollects Cloud Foundry or Kyma logs into a searchable Kibanafrom BTP/BAIP
SAP Cloud LoggingSAP Cloud LoggingserviceAn instance-based observability service built on OpenSearch that stores and analyses logs, metrics and traces from Cloud Foundry, Kyma, Kubernetes and other runtime environments.sap official, btpOpenSearch-based store for logs, metrics and tracesfrom BTP/BAIP
com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bompackageThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, capMaven bill of materials pinning CAP Java module versionsfrom CAP
abap-logabap-logpackageA logging library for ABAP with one logger interface in front of several targets, from the Application Log and the job log to database tables, files and the Eclipse console.independent, abapABAP logging library with one interface across output targetsfrom ABAP
ABAP_LOGGINGABAP_LOGGINGpackageAn object-oriented wrapper around SAP's Business Application Log (BAL) for ABAP NetWeaver, chaining texts, messages and exceptions onto a log header that persists in its own or the same connection.independent, abapObject-oriented wrapper around the Business Application Logfrom ABAP
abap-cloud-loggerabap-cloud-loggerpackageA logging library for ABAP Cloud that wraps the released class CL_BALI_LOG in a chainable logger, collecting exceptions, messages and tables, with a stopwatch and a sticky context tag.independent, abapChainable logger for ABAP Cloud around CL_BALI_LOGfrom ABAP
abap-fm-loggerabap-fm-loggerpackageA logger for ABAP function modules (RFC) that stores each call's parameters as JSON in one table, with a viewer report to search the log and reprocess a record, akin to WE10 and WE19.independent, abapLogger storing RFC function module call parameters as JSONfrom ABAP
openui5-error-collectoropenui5-error-collectorpackageA UI5 library that collects a running app's JavaScript errors, unhandled Promise rejections and UI5 log events, and can post them to a backend with navigator.sendBeacon.independent, ui5UI5 library collecting an app's JavaScript errorsfrom UI5
open-abap-balopen-abap-balpackageApplication logging for ABAP code transpiled to JavaScript and run on Node.js, one of the runtime libraries open-abap.org lists.community org, abapApplication logging for ABAP transpiled to JavaScript on Node.jsfrom ABAP
@openui5/sap.ui.core@openui5/sap.ui.corepackageThe OpenUI5 core: the module loader, the MVC runtime, data binding, routing, theming and the test stack, which is everything a UI5 app does before a single community package is added.sap official, ui5Framework core: module loader, MVC runtime, binding, routing, themingfrom UI5
abap-fluentdabap-fluentdpackageA Fluentd client written in ABAP for sending log lines from an ABAP system to a Fluentd collector, where entries are flushed with an explicit COMMIT WORK.independent, abapFluentd client in ABAP for sending log lines to a collectorfrom ABAP
@saptools/cf-logs@saptools/cf-logscliA command line and typed Node.js library that fetches and streams the logs of one Cloud Foundry app and parses them into structured rows.independent, btpLog fetcher and parser for one Cloud Foundry appfrom BTP/BAIP
@saptools/cf-tail@saptools/cf-tailcliA command line that tails every started app in a Cloud Foundry space at once and merges their logs into one timeline by timestamp, with filters by level, tenant, router status and time window.independent, btpMerged log tail of every started app in a Cloud Foundry spacefrom BTP/BAIP
sap-usi-logging-apisap-usi-logging-apipackageAn object-oriented encapsulation around SAP's Application Log (transaction SLG1), controlled by customizing, with attachable data containers that SLG1 shows behind a detail button.independent, abapObject-oriented wrapper around SAP's Application Log (SLG1)from ABAP
srbjsloggersrbjsloggerpackageA browser JavaScript logger whose log, warn and error calls write prominent output to the console, loaded into a UI5 app through index.html or the manifest's resources.independent, ui5A browser JavaScript logger whose log, warn and error calls write prominent output to the console, loaded into a UI5 app through index.html or the manifest's resources.from UI5
abap-message-loggerabap-message-loggerpackageA message logger for ABAP Cloud that collects T100 messages, BAPIRET2 structures, exceptions and plain text before saving them to the Application Log.independent, abapMessage logger for ABAP Cloud that saves to the Application Logfrom ABAP
Audit loggingAudit loggingcapabilityRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only
SAP Audit Log serviceSAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btpIngests and retains compliance audit data from BTPfrom BTP/BAIP
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngpackageA CAP Java plugin that sends audit log events to the SAP Audit Log service in the format the Audit Log Event Catalog expects.sap official, capCAP Java plugin sending audit log events to SAP Audit Log servicefrom CAP
com.sap.cds:cds-feature-auditlog-v2com.sap.cds:cds-feature-auditlog-v2packageThe CAP Java handler that sends the SDK's AuditLog events to the SAP Audit Log service over its API version 2, once a service binding is present.sap official, capCAP Java handler for SAP Audit Log service API version 2from CAP
com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bompackageThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, capMaven bill of materials pinning CAP Java module versionsfrom CAP
s4hana-hana-audit-policiess4hana-hana-audit-policiespracticeSQL templates for the SAP HANA audit policies of the database tenant an SAP S/4HANA system uses, in four sets from the mandatory default policies to scenario examples.sap official, btpSQL templates for HANA audit policies of an S/4HANA tenantfrom BTP/BAIP
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
The plugin required the Audit Log service and said nothing of what passes between them.
Integration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.
