BrowseSAP Business Technology Platform, also named SAP Business AI Platform
Everything in BTP/BAIP
106 of 835
Domain: 2
Signals
Content
More: SAP Community
Group by: Capability
EntryBySignalsLast activity
Analytic modellingSAP and community
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
AttachmentsSAP only
Configure Journal Entry Posting Approval from Store Template in Build Process AutomationConfigure Journal Entry Posting Approval from Store Template in Build Process AutomationWalks through deploying SAP's Journal Entry Posting Approval template from the SAP Build Process Automation Store against an on-premise S/4HANA system that has no Secure Network Connection: destinations for S/4HANA via Cloud Connector, for SAP Document Management service, integration option to hold the approval's supporting documents, and for the BPA service and its SMTP mail. It then swaps the template's SNC action groups for basic-connection BAPI calls and deploys the approval's UI5 applications so the task lands in My Inbox, with a Desktop Agent registered to run the unattended document-check and document-post automations.published 2025-01-28
Extend Upload Set to Fiori Elements and utilize Document Management ServiceExtend Upload Set to Fiori Elements and utilize Document Management ServiceWritten two months before there was an official plugin, and the author has left the record of that in the page: an update dated 2024-04-04 noting the CAP team released @cap-js/attachments, and another dated 2024-05-21 saying they tested it and wrote up the Object Store variant separately. The hand-built version underneath is still the answer when the plugin's storage choices do not fit.published 2024-02-25
Extend Upload Set to Fiori Elements and utilize Document Management Service
Attachments has changed 3 times since this was published, most recently in @cap-js/sdm 1.0.0, 2024-06-26. Affects Runnable code.
Extend Upload Set with Table to Fiori Elements and utilize Object StoreExtend Upload Set with Table to Fiori Elements and utilize Object StoreThe Object Store variant of the author's earlier Document Management post, written after testing @cap-js/attachments — a sample managing text and file information together, and offered as something for people new to BTP rather than as a pattern.published 2024-05-21
Extend Upload Set with Table to Fiori Elements and utilize Object Store
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects Runnable code.
Unlocking Efficiency: Leveraging SAP BTP Document Management Service in Fiori Applications # 2Unlocking Efficiency: Leveraging SAP BTP Document Management Service in Fiori Applications # 2Document Management's own Attachment Reuse UI dropped into a Fiori elements List Report, in two variants — OData V2, and OData V4 in a CAP application. The CAP half is one of the two scenarios rather than the subject; the rest of the series is about custom Fiori apps and a process task UI, with no CAP in them.published 2024-12-10
Database connectorsSAP only
[BTP HANA Cloud Database] : How to access HANA Cloud Database & HDI Container in BTP[BTP HANA Cloud Database] : How to access HANA Cloud Database & HDI Container in BTPGetting at the database your application already deployed to, which sounds trivial until the HDI container is the only thing that has credentials for it. Guidance for the case where the account is already configured and the question is only how to look inside.showkath_naseem, published 2023-01-18
2024/01最新版！Productivity Toolsを使ったCAPバックエンド開発②~HANA Cloud編~2024/01最新版！Productivity Toolsを使ったCAPバックエンド開発②~HANA Cloud編~In Japanese, and the second of a pair — database connection through to calling the API from outside, with authorisation in between. The author dates the screenshots explicitly and warns that the UI may have moved since, which is the right disclaimer for a click-through guide.takayuki_tanaka, published 2024-01-09
2024/01最新版！Productivity Toolsを使ったCAPバックエンド開発②~HANA Cloud編~
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Accelerating Your Analytics with Delta Table Replication into SAP HANA CloudAccelerating Your Analytics with Delta Table Replication into SAP HANA CloudStarting with QRC 04/2025, SAP HANA Cloud can replicate a Delta Lake table from an external Delta Sharing source directly into a native HANA table, rather than only querying it live through a virtual table. The post walks through creating a remote subscription, running a chunk-based initial load, and setting up change data capture on a schedule or on demand, each with the SQL statements and monitoring views involved, plus the simpler virtual-table-toggling and HANA Cloud Central UI alternatives.SeungjoonLee, published 2025-12-22
Automate Recurring Data Updates in SAP HANA CloudAutomate Recurring Data Updates in SAP HANA CloudA walkthrough for marking inventory rows stale after 30 days using SAP HANA Cloud's own scheduler: a SQLScript procedure, a CREATE SCHEDULER JOB statement with its 7-field cron pattern, the M_SCHEDULER_JOBS monitoring view, and the matching DROP statements to remove both. It then names where that approach stops and lists the alternatives for scheduling outside the database: SAP Integration Suite's Timer Event, the SAP Job Scheduling service, SAP Automation Pilot for infrastructure commands, and a custom approach for triggering scheduled REST calls from an application.Joni, published 2026-06-11
Building a CAP App with Fiori Integration – Part 1: Environment & HANA Cloud SetupBuilding a CAP App with Fiori Integration – Part 1: Environment & HANA Cloud SetupA trial account taken from nothing to a CAPM project with a HANA Cloud instance behind it. Everything here is prerequisites, which the author says outright — the application is in the parts that follow.SuryaRamesh, published 2026-04-08
Building an SAP BTP Agent Architecture from Scratch: Python + CAP + HANABuilding an SAP BTP Agent Architecture from Scratch: Python + CAP + HANAA first-person build log of a Flask orchestrator on Cloud Foundry that reduces a question to keywords, searches a Node.js service's Documents entity, and passes what it finds to Claude for a grounded answer. Getting there means learning that HANA's fuzzy .search() matches one word but not a full sentence, fixed by splitting the query into terms and merging the per-term hits, and that provisioning SAP HANA Cloud hits a database-level free-tier quota rather than an HDI-container one, with a stopped instance needing to be resumed first. It also covers @sap/cds-dk needing to sit in dependencies rather than devDependencies, since Cloud Foundry's buildpack skips the latter, before cds deploy --to hana can run as part of the push.neilaspin, published 2026-07-28
Configure an SAP CAP Application to Connect to an SAP HANA Cloud Database in Another Global Account or SubaccountConfigure an SAP CAP Application to Connect to an SAP HANA Cloud Database in Another Global Account or SubaccountThe case the tooling does not cover: the database is in a different global account, so there is no HDI container to bind and cds deploy cannot do its usual job. Written for exactly that, and it says so in the subtitle — without HDI.JhoelAnthonyRamosRomeroPE, published 2024-10-08
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Create a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud FoundryCreate a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud FoundryThe whole lifecycle in one post rather than a series — model, service, HANA binding, build, deploy. Useful as a single reference for the order things have to happen in, which is the part that is easy to get wrong when it is spread over six posts.MaheshSirsat1708, published 2025-11-19
Create a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud Foundry
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Creating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application StudioCreating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application StudioHybrid testing is documented for HANA; this is the same profile against a PostgreSQL instance on BTP, driven from a BAS dev space rather than a laptop. Proposed under editor support because of where it runs, but the subject is the binding: what cds bind writes, and what has to be true of the service instance and the tunnel for a local process to reach it.valentincadart, published 2025-10-02
Creating a Hybrid CAP (Node.js) Profile with PostgreSQL on BTP from Business Application Studio
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
Deploying CAP services with the in-memory SQLite databaseDeploying CAP services with the in-memory SQLite databaseIn-memory, deployed to Cloud Foundry — so the data is gone on restart, on purpose. For a service whose datastore does not need to survive anything, which is a narrower case than it sounds and a real one.liam_mischewski, published 2021-05-24
Distributed Resiliency of SAP CAP applications using SAP HANA Cloud (Multi-Zone Replication)Distributed Resiliency of SAP CAP applications using SAP HANA Cloud (Multi-Zone Replication)Resilience defined the way an operator would — failures happen in a complex landscape and should go unnoticed by the user — and then what multi-zone replication on HANA Cloud means for the CAP application in front of it.shanthakumar_krishnaswamy, published 2022-11-12
Exposing Calculation View with Dynamic Client via OData APIExposing Calculation View with Dynamic Client via OData APIGetting a HANA Cloud calculation view — built in Business Application Studio and deployed to an HDI container, which is the recommended way to build native HANA artifacts — out through an OData API. The gap it fills is the one between HANA-native development and a service a client can call, which CAP does not cover for artifacts it did not generate.published 2023-10-04
Extend SAP SuccessFactors on SAP BTP with CAP - Deploy to SAP HANA CloudExtend SAP SuccessFactors on SAP BTP with CAP - Deploy to SAP HANA CloudThe deployment instalment of the author's SuccessFactors extension series — the project already exists and the imported service is already modelled, so this is only the move onto HANA Cloud. Depends on the two posts before it and says so.ale_biagi, published 2022-03-29
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-3]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-3]The cloud database appears: a HANA Cloud instance created on BTP and mapped to a Cloud Foundry space. No application code — this is the part where the platform has to be right before the next part can connect to it.sanjucs, published 2026-05-08
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]The switch from SQLite to HANA and the first deploy of the back end to Cloud Foundry — the point in the series where the persistence stops being a file and the build starts producing HDI artifacts.sanjucs, published 2026-05-12
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
How to create an API to run a HANA Cloud Stored Procedure in Cloud FoundryHow to create an API to run a HANA Cloud Stored Procedure in Cloud FoundryReaching past CDS to the database's own machinery — built-in algorithms, SQLScript procedures and functions — and putting an API in front of them. Long, and it is the case where the model is not where the logic belongs.gonzalo_hernan_sendra, published 2022-12-08
How to create an API to run a HANA Cloud Stored Procedure in Cloud Foundry
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
Hybrid testing using PostgreSQL on SAP BTP, hyperscaler optionHybrid testing using PostgreSQL on SAP BTP, hyperscaler optionA short note rather than a guide — the author says they came across the feature reading someone else's post on PostgreSQL with Kyma. Hybrid testing against a real PostgreSQL instance, which until then people assumed meant HANA.martinfrick, published 2023-08-08
Lets Deep dive into CAPM and HANA Cloud --> HANACapLets Deep dive into CAPM and HANA Cloud --> HANACapShort, and framed as what the author does day to day on BTP rather than as a tutorial: where CAPM meets HANA Cloud and which pieces have to agree.shivamshukla12, published 2023-07-16
Lets Deep dive into CAPM and HANA Cloud --> HANACap
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)Opens with the observation the whole series rests on — CAP is usually demonstrated locally, and the interesting part starts when it is deployed. Part one of the run that continues into PostgreSQL and Work Zone.yashbhosle789, published 2026-02-25
Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Run and Deploy SAP CAP (Java) with PostgreSQL on SAP BTP Cloud FoundryRun and Deploy SAP CAP (Java) with PostgreSQL on SAP BTP Cloud FoundrySuperseded by its own author: the post now opens with a notice that @sap/cds 7.0.0 brought native PostgreSQL support and that @cap-js/postgres should be used instead of the packages described below. Kept because that notice is the record of when the community adapter stopped being the answer.shanthakumar_krishnaswamy, published 2023-04-04
Run and Deploy SAP CAP (Java) with PostgreSQL on SAP BTP Cloud Foundry
cds-pg. Affects Runnable code.
Run and Deploy SAP CAP (Node.js or Java) with PostgreSQL on SAP BTP Cloud FoundryRun and Deploy SAP CAP (Node.js or Java) with PostgreSQL on SAP BTP Cloud FoundryBoth runtimes in one walkthrough, and it stops on schema evolution — which is the reason to read it rather than one of the several other PostgreSQL posts here, since that is where the PostgreSQL story diverges from HANA's and the deploy stops being automatic.TiaXu, published 2023-07-12
Run and Deploy SAP CAP (Node.js or Java) with PostgreSQL on SAP BTP Cloud Foundry
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
SAP BTP Showcase - Use SAP Cloud Application Programming to do Native Development on HANA CloudSAP BTP Showcase - Use SAP Cloud Application Programming to do Native Development on HANA CloudThe fifth of a seven-post showcase, and the one where CAP is used to reach HANA-native artifacts rather than to avoid them. Long, and it sits inside a series whose other parts are about Data Warehouse Cloud and CI/CD.former_member271284, published 2021-01-31
SAP BTP Showcase - Use SAP Cloud Application Programming to do Native Development on HANA Cloud
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
SAP BTP Showcase – SAP Continuous Integration and Delivery (SAP CI&D) for SAP HANA CloudSAP BTP Showcase – SAP Continuous Integration and Delivery (SAP CI&D) for SAP HANA CloudA pipeline for the database half of a CAP application, built with cds add pipeline — one command that writes a Jenkinsfile and a .pipeline folder — and then the mta module that makes a database change deploy itself.gcalixtos, published 2021-01-27
SAP BTP Showcase – SAP Continuous Integration and Delivery (SAP CI&D) for SAP HANA Cloud
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
SAP CAP Lessons Learned: Run a CAP app using SQLite on SAP BTP - Cloud FoundrySAP CAP Lessons Learned: Run a CAP app using SQLite on SAP BTP - Cloud FoundrySQLite past the point it is meant to go — deployed, not local. Written as a lesson learned rather than a recommendation, and it pairs with the author's own note that SQLite is single threaded.LucasMagriniRigo, published 2024-12-30
SAP CAP With Prostgres Serice in BTPSAP CAP With Prostgres Serice in BTPA step-by-step walkthrough of a CAP bookshop project on @cap-js/postgres, provisioning PostgreSQL on SAP BTP, hyperscaler option's trial plan through mta.yaml, building the MTA archive and deploying it to Cloud Foundry by hand, then inspecting the deployed database with pgAdmin over an SSH tunnel. It updates an earlier post by Mike Zaschka on the same topic to the package CAP now ships by default, though the manual build-and-deploy sequence it shows predates cds up folding those steps into one command by a day.satya-dev, published 2025-03-30
Setting Up PostgreSQL for SAP BTP Development: A Practical GuideSetting Up PostgreSQL for SAP BTP Development: A Practical GuideOpens with the premise the rest of this bucket mostly assumes away — not every BTP application needs HANA Cloud — and then sets up PostgreSQL on the hyperscaler option. Part one of a series that continues into XSUAA.michal_majer, published 2026-01-20
SFSFとHANA Cloudを使用するCAPのアプリケーション開発SFSFとHANA Cloudを使用するCAPのアプリケーション開発In Japanese. A hands-on taking data between SuccessFactors and HANA Cloud through a CAP application — the connection setup, the data and service models, then read and write logic, and a Cloud Foundry deploy. Long enough to carry its own table of contents.rasai, published 2022-12-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Sharing SAP HANA Cloud instance to multiple subaccounts and creating HDI containersSharing SAP HANA Cloud instance to multiple subaccounts and creating HDI containersOne HANA Cloud instance, several subaccounts, an HDI container created from each — the arrangement that keeps a landscape from paying for a database per subaccount. Written against a CAP project, so the container mapping is shown from the side that has to consume it.published 2024-03-23
Sharing SAP HANA Cloud instance to multiple subaccounts and creating HDI containers
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects Runnable code.
Simple steps to deploy your CAP project to HANA cloudSimple steps to deploy your CAP project to HANA cloudWritten from the far side of a failed deploy — the author says these are the troubleshooting steps that ended up working, not a designed procedure. Short, and honest about being a record rather than a recommendation.OmPrakashJha, published 2021-02-11
Testing your CAP HANA Artifacts with jest – including multitenancy, hdbprocedure and hdbviewTesting your CAP HANA Artifacts with jest – including multitenancy, hdbprocedure and hdbviewcds.test covers the service; this covers what is underneath it, where the artifact is an hdbprocedure or an hdbview that CDS never sees. That means a real HDI container, so most of the post is about where to get one and how to give CAP access to it — the tests are the easy part once that is true.Tristan, published 2022-08-30
Testing your CAP HANA Artifacts with jest – including multitenancy, hdbprocedure and hdbview
Testing has changed 3 times since this was published, most recently in @cap-js/cds-test 1.0.0, 2026-04-23. Affects A recipe, Runnable code.
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Loading a warehouseSAP and community
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
Object storageSAP only
Integrating Using Google Cloud Storage Adapter (GCP Authentication & adapter config)Integrating Using Google Cloud Storage Adapter (GCP Authentication & adapter config)Walks through connecting SAP Integration Suite's Google Cloud Storage adapter to a bucket: creating a GCP service account with the Storage Object Admin role, generating its JSON or P12 key, converting it into a key-pair alias, and using that alias and the service account email in the adapter's authentication. It covers configuring the receiver adapter's upload operation (directory, object name, content type, and override, ignore or fail handling for an existing file) and the sender adapter's read, including post-processing to archive, delete or keep the object after an iFlow fetches it.MirunaliniV, published 2026-02-20
Audit loggingSAP only
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
AuthenticationSAP and community
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
AuthorizationSAP only
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
Authorization Management Service in SAP Cloud Identity ServiceAuthorization Management Service in SAP Cloud Identity ServiceStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.kevin_li, published 2024-10-17
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Using Postman for API Testing with XSUAAUsing Postman for API Testing with XSUAAA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.mariusobert, published 2020-03-02
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Data privacySAP only
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1First of a three-part series on designing a CAP application on BTP that uses the platform's data privacy services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data Manager, SAP Data Retention Manager, SAP Data Privacy Integration and SAP Audit Log service. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2 and Part 3.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Identity provisioningSAP only
🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & Target🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning Service, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Yogananda, published 2025-08-30
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?Explains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity Services already generates the SCIM ID and Global User ID in uuid format for each record.1Gunnar, published 2023-09-12
IPS provisioning to ABAP Cloud Developer TrialIPS provisioning to ABAP Cloud Developer TrialWalks through provisioning users and groups from SAP Cloud Identity Services' Identity Provisioning into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud Connector and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Laurence, published 2025-09-04
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Rate limitingSAP only
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13