BrowseSAP Business Technology Platform, also named SAP Business AI Platform
Everything in BTP/BAIP
42 of 845
Domain
Signals: SAP and community
Content: 3
More
Group by: Capability
EntryBySignalsLast activity
Serve your application over MCPSAP and community
Agentic CAP: Build MCP servers and enterprise AI agentsAgentic CAP: Build MCP servers and enterprise AI agentsCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCP concern, and SAP AI Core is the LLM integration through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Configure an MCP Server Created from an HTTP EndpointConfigure an MCP Server Created from an HTTP EndpointDocuments configuring API Management’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
MCP Server — SAP Integration SuiteMCP Server — SAP Integration SuiteSAP's own page for the MCP Server artifact in SAP Integration Suite, and where the gateway that runs it is described: MCP clients and API clients reach the same backends through two gateways that share security, traffic management and multi-protocol connectivity. Sets out the three primitives a server may expose — tools derived from API operations with an input and output schema, resources addressed by URI for context rather than action, and prompts as reusable interaction patterns. Says availability depends on the Integration Suite service plan, and points at the three creation paths as separate pages.
Model Context Protocol (MCP)Model Context Protocol (MCP)Frames the Model Context Protocol as the answer to an M-times-N integration problem: one shared protocol turns M agents and N tools into M plus N connections, and one server can be called by any compliant agent. On SAP BTP its implementation section lists an SAP MCP Hub as a no-code way to expose enterprise tools, SAP Integration Suite's MCP Gateway as what it calls the governed path for exposing SAP and non-SAP APIs as MCP-compliant tools, custom SDK-based servers, SAP's MCP servers for development, and an MCP adapter for CDS as a CAP plugin marked coming soon. That is the ground MCP servers covers; for security it points at a separate page.
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Analytic modellingSAP and community
Accelerate agentic planning with trusted data productsAccelerate agentic planning with trusted data productsGoverned data products as the ground for AI planning in SAP Analytics Cloud: using a ready data product or building one in SAP Business Data Cloud, the cataloguing and lineage concern, then agentic AI automating planning tasks and producing insights on top. The abstract names the two products and the data product step and does not say which planning tasks the agents take over. A TechEd 2026 hands-on session (Thursday 29 October, Berlin), presented by Jie Deng, Maximilian Paul Gander and Richard Mooney, written here from SAP's abstract; the recording is not yet published.
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Federated Machine Learning with SAP DatasphereFederated Machine Learning with SAP DatasphereSAP's design for training predictive models on an external machine learning platform against SAP Datasphere data that is not replicated to that platform. The open-source FedML Python library runs in the platform's notebook, connects to Datasphere over Python/SQLDBC and reads the analytic models in which Datasphere unifies SAP and non-SAP sources; a trained model can then be deployed to SAP AI Core, or in several sub-pages to SAP BTP, Kyma runtime, which is the predictive models path where training happens outside SAP. Sub-pages cover Amazon SageMaker, Azure Machine Learning, Google Vertex AI, Databricks, NVIDIA RAPIDS on GPUs and IBM watsonx.published 2025-01-23
Transform business data into AI-supported insightsTransform business data into AI-supported insightsBusiness metrics turned into insights, narratives and recommendations by SAP Joule's agents, with People Intelligence, the SAP Snowflake solution extension for SAP Business Data Cloud and SAP Analytics Cloud connected in SAP Business Data Cloud. The abstract names what is connected and what comes out, and does not say what the exercise builds or where the Snowflake extension sits in it; People Intelligence and the extension are not atlas entries. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Babacar Toure, Maximilian Paul Gander, Neetha Pucknat and San Tran, written here from SAP's abstract; the recording is not yet published.
Cataloguing and lineageSAP and community
Accelerate agentic planning with trusted data productsAccelerate agentic planning with trusted data productsGoverned data products as the ground for AI planning in SAP Analytics Cloud: using a ready data product or building one in SAP Business Data Cloud, the cataloguing and lineage concern, then agentic AI automating planning tasks and producing insights on top. The abstract names the two products and the data product step and does not say which planning tasks the agents take over. A TechEd 2026 hands-on session (Thursday 29 October, Berlin), presented by Jie Deng, Maximilian Paul Gander and Richard Mooney, written here from SAP's abstract; the recording is not yet published.
Building custom Joule Agents with SAP Knowledge GraphBuilding custom Joule Agents with SAP Knowledge GraphCustom Joule Agents built in a hands-on with SAP Knowledge Graph and Joule Studio: discovering APIs from a user's intent, grounding an agent's answers in business context, and integrating data products for SAP Business Data Cloud. The agents are SAP Joule's; the Knowledge Graph is not an atlas entry, and the abstract does not say which Joule Studio edition the exercises use. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Jan Portisch, Lucas Kiesow, Pavithra G K and Rafael Martin, written here from SAP's abstract; no recording is announced.
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Transform business data into AI-supported insightsTransform business data into AI-supported insightsBusiness metrics turned into insights, narratives and recommendations by SAP Joule's agents, with People Intelligence, the SAP Snowflake solution extension for SAP Business Data Cloud and SAP Analytics Cloud connected in SAP Business Data Cloud. The abstract names what is connected and what comes out, and does not say what the exercise builds or where the Snowflake extension sits in it; People Intelligence and the extension are not atlas entries. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Babacar Toure, Maximilian Paul Gander, Neetha Pucknat and San Tran, written here from SAP's abstract; the recording is not yet published.
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Loading a warehouseSAP and community
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Medallion Reference Architecture for Big Data Processing in SAP HANA CloudMedallion Reference Architecture for Big Data Processing in SAP HANA CloudSAP's medallion layout for SAP HANA Cloud: structured, semi-structured and unstructured data lands raw in HANA Cloud, data lake files as the bronze layer, is cleansed into a common structure in silver, held in data lake files or the HANA database, and is curated and read-optimised in gold, from where it can also be exposed as a Delta Share. The staged path from raw to consumable is the ground loading a warehouse covers, with Spark jobs and SAP Datasphere data flows named as ways to move data between layers and SAP Analytics Cloud among the consumers of gold. It leaves the ingestion method open, to be chosen by source, freshness and performance, and names no pipeline or schedule beyond that.published 2025-04-03
Agent access to your codeSAP and community
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Don't Wait for SAP: Unlocking MCP Servers in BAS Right NowDon't Wait for SAP: Unlocking MCP Servers in BAS Right NowA workaround post with a grievance behind it: MCP servers were promoted heavily at SAP TechEd, most IDEs support them, and Business Application Studio limits you to Joule. This is how to run them there anyway. Worth reading as evidence of where the tooling gap sits rather than only for the recipe, which by nature has a shelf life.published 2025-11-27
Evaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceEvaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceSomeone trying SAP's three new MCP servers rather than repeating the announcement. It sets the official positioning first — MCP as the bridge from coding assistants to SAP tooling across Cursor, Windsurf, Copilot, Cline and Claude Code, with best-practice scaffolds and BTP-aligned guardrails — and then reports what using them is actually like. The rare kind of post that tests a vendor claim.published 2025-09-04
Agent guidanceSAP and community
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Document groundingSAP and community
Building agentic applications with SAP HANA CloudBuilding agentic applications with SAP HANA CloudA CAP application extended with semantic search and agent features on top of SAP HANA Cloud's vector engine and SAP AI Core, built in a hands-on workshop. The abstract names the parts, CAP, the vector engine and AI Core, and the two additions: semantic search, the retrieval half of retrieval-augmented generation, and LLM-supported agent capabilities inside the application, which is agent tooling. Which embedding model, which CAP runtime and how the agent calls its tools are not stated. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Hui Li, Ritty Joseph, Shraddha Shetty and Tanuja Jadhav, written here from SAP's abstract; the recording is not yet published.
Document GroundingDocument GroundingDocument Grounding is a managed retrieval-augmented-generation service under the Generative AI Hub on BTP, which SAP's page on SAP AI Core places inside that service: it ingests documents from Amazon S3, SharePoint, SAP Document Management Service, SAP Work Zone or an SFTP server, and handles chunking, embedding and retrieval itself, refreshing content automatically when a source document changes. The page states this managed path is recommended for most enterprise scenarios because it covers the whole lifecycle end to end, and offers a separate Document Grounding Vector API for data that is already chunked and embedded, for cases that need finer control over chunking and metadata.
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
Tool governanceSAP and community
A Clearer View of Your SAP Integrations Under the New API PolicyA Clearer View of Your SAP Integrations Under the New API PolicyThe SAP API Policy Evidence Skill assesses one SAP interface or usage pattern at a time against SAP API Policy v.4.2026a, reading evidence from five MCP servers, among them servers for the Business Accelerator Hub and SAP Notes, mcp-sap-docs and a read-only ARC-1, and returns one of four labels with a confidence level, an evidence table, residual risk and questions for SAP. It gives no compliant or not compliant answer on purpose, because SAP's FAQ (Q49) declines to publish a binding decision matrix, and it sends legal, commercial and roadmap questions to SAP and lowers its confidence when a source is not connected. Four sample runs show the method, among them ODP-RFC extraction labelled likely not aligned under SAP Note 3255746 and the same API_SALES_ORDER_SRV assessed differently for an autonomous agent behind a custom gateway and for a Boomi middleware flow; the SAP Notes and Business Accelerator Hub servers read SAP sites through a browser login, which the post says to use at your own risk.published 2026-06-02
Agentic AI Security & GovernanceAgentic AI Security & GovernanceNames seven threat categories agentic AI introduces beyond ordinary application security: prompt injection, excessive agency, supply-chain and model-integrity compromise, memory poisoning, improper output handling, resource abuse and agent-to-agent communication poisoning. Its answer is a defence-in-depth structure of security controls, input validation, privilege management, supply-chain checks, memory segmentation, output validation, execution quotas, secure communication, paired with governance and oversight: audit logging, explainability, human-in-the-loop review, fairness assessment and continuous monitoring. States the reason plainly: an agent decides, chains actions across turns, keeps memory between them and can act on real systems, a different risk profile from a single request-response call. That is the authorisation and audit-trail question tool governance is named for.
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopThe BTP deployment of ARC-1: one Cloud Foundry app per SAP system, reached by MCP clients through XSUAA and reaching the backend through the SAP Destination service, the SAP Connectivity service and Cloud Connector, with a BasicAuth destination for startup probing and a Principal Propagation destination for per-user requests, and SAP_PP_STRICT=true so a propagation problem fails instead of falling back to the shared user. Tool governance is the three gates it spells out, the server ceiling set by environment variables, the user's permission from XSUAA role collections, OIDC scopes or API-key profiles, and the SAP backend authorisation, all of which must allow an action, and the staged rollout from read-only to writes in $TMP, then selected packages, then transport writes. It recommends the MTA deployment over Docker on Cloud Foundry or a buildpack push, treats BTP ABAP Environment as a separate service-key scenario with no Cloud Connector, and is not a full setup guide: the commands are left to the ARC-1 deployment docs.published 2026-04-29
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the Laptop
arc-1 has been through 3 major lines since this was published: 0.8 (2026-05), 0.9 (2026-05), 1 (2026-07). Affects A recipe.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
AuthenticationSAP and community
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
Account provisioningSAP and community
Define, generate, deploy: AI-driven spec-first TerraformDefine, generate, deploy: AI-driven spec-first TerraformAccount provisioning written as a spec first: the abstract has participants write a structured description of a BTP account, its subaccounts, entitlements, governance, best practices and more, and an AI turns it into Terraform scripts that build it. The abstract does not name the Terraform provider the scripts use, the spec format or the AI behind the generation. A hands-on TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christian Lechner, DJ Adams, Piotr Tesny and Vipin VijayKumar, written here from SAP's abstract; the recording is not yet published.
LoggingSAP and community
SAP Cloud Logging Serviceでコンテナメトリクスを監視するSAP Cloud Logging Serviceでコンテナメトリクスを監視するIn Japanese. Container metrics for a CAP Node.js application into SAP Cloud Logging Service, and the reason it exists is that the obvious route does not apply: Spring Boot Actuator covers the Java side, and Node has no equivalent, so the author reaches for Telegraf instead. The procedure is deliberately independent of application logic — bind the instance, add a startup script and a config file — so it works against an application you already have.kyoneo, published 2024-03-26
Platform migrationSAP and community
Modernisation and migration to SAP Integration Suite made simpleModernisation and migration to SAP Integration Suite made simpleA hands-on platform migration of SAP Process Integration and SAP Process Orchestration scenarios into SAP Integration Suite: the migration assessment run against a legacy landscape to see what converts automatically, the migration tooling in Integration Suite run on the scenarios, and the resulting integration flows adjusted and deployed. What the assessment classifies a scenario by, and which adapters convert, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Claire Tseng, Craig Stasila, Nils Lorenz and Sunny Kapoor, written here from SAP's abstract; the recording is not yet published.
TelemetrySAP and community
SAP Cloud Logging Serviceでコンテナメトリクスを監視するSAP Cloud Logging Serviceでコンテナメトリクスを監視するIn Japanese. Container metrics for a CAP Node.js application into SAP Cloud Logging Service, and the reason it exists is that the obvious route does not apply: Spring Boot Actuator covers the Java side, and Node has no equivalent, so the author reaches for Telegraf instead. The procedure is deliberately independent of application logic — bind the instance, add a startup script and a config file — so it works against an application you already have.kyoneo, published 2024-03-26
Architecture diagramsSAP and community
Creating an ARC-1 BTP Diagram with Codex and a draw.io SkillCreating an ARC-1 BTP Diagram with Codex and a draw.io SkillThe sap-architecture skill from marianfoo/btp-drawio-skill draws architecture diagrams as editable draw.io files in SAP Architecture Center style by copying the closest of 71 bundled SAP reference templates, or a built-in fallback layout, then validating, scoring and rendering the result for the model to inspect; it takes ideas from Wouter Lemaire's btp-solution-diagram-generator and from claude-drawio-btp-diagram. Codex ran it on an L2 diagram of ARC-1 on BTP Cloud Foundry, reached from VS Code over MCP and passing through XSUAA, Destination, Connectivity and Cloud Connector to an on-premise ABAP system, and the first pass validated and scored 100 while labelling the flows HTTPS and OData/REST instead of MCP and ADT REST. The post draws its boundary from that run: the checks read the file's visual structure and cannot tell whether the architecture is right, and a diagram with no close template still needs manual draw.io work.published 2026-07-09
Editor supportSAP and community
Migrating Your CAP Applications from SAP Web IDE to SAP Business Application StudioMigrating Your CAP Applications from SAP Web IDE to SAP Business Application StudioA migration checklist, and a reminder of how much of a CAP project used to be editor-specific: Web IDE configuration files to delete, a build to move to the Cloud MTA Build Tool, a CAP Java version to raise. Historical — Web IDE is gone — but it is the clearest list of what the tooling boundary used to include.liat_b, published 2020-07-09
Migrating Your CAP Applications from SAP Web IDE to SAP Business Application Studio
Editor support changed in @sap/cds-dk 8.8.0, 2025-03-04. Affects A recipe.