BrowseSAP Business Technology Platform, also named SAP Business AI Platform
Everything in BTP/BAIP
129 of 835
Domain
Signals: Last 12 months
Content
More: 2
Group by: Capability
EntryBySignalsLast activity
OpenAPISAP only
SAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecSAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecA tutorial on generating a type-safe client library for the SAP Job Scheduling service's REST API from its OpenAPI specification, using the OpenAPI Generator CLI to target Node.js, TypeScript, Java, Python, Go or C#. It walks through OAuth 2.0 client-credentials authentication and the generated client's Jobs API, listing, creating and reading jobs with their cron schedules, and lists what the service's error statuses (400, 401, 404, 409, 429, 503) mean to a caller. It states that the official @sap/jobs-client will be deprecated and tells readers to use a generated client for now.DenisDuev, published 2026-05-04
Use REST services in GraphUse REST services in GraphSAP Graph turns a REST service into a business data graph by pairing a data destination with a metadata destination that supplies its OpenAPI document, since plain REST has no $metadata endpoint of the kind OData exposes. It walks through creating both destinations on SAP BTP, including the OAuth2ClientCredentials authentication needed when the OpenAPI file is hosted through an API artifact, and shows how Graph flattens each REST operation's path and method into an unbound OData action or function, such as turning a DELETE on /users/pets into a POST to users_pets__delete.florian_moritz, published 2026-01-20
Serve your application over MCPSAP and community
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
BTP Cloud Foundry MCP Server: Managing CF Environments with AIBTP Cloud Foundry MCP Server: Managing CF Environments with AIWalks through a server built on odata-mcp-proxy that exposes the Cloud Foundry V3 API's 28 entity sets — apps, orgs, spaces, services, networking, quotas — as MCP tools from a JSON config with no application code. It shows the config shape that bridges the API's snake_case paths to PascalCase tool names via a urlPath field, and the OAuth2 client-credentials destination setup an assistant needs to reach a CF landscape.published 2026-03-13
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
MCP Servers on SAP Integration Suite : Build Your First MCP Server from an APIMCP Servers on SAP Integration Suite : Build Your First MCP Server from an APIWalks through building an MCP server on SAP Integration Suite from an existing managed API — SAP S/4HANA's Purchase Order API — rather than from an HTTP endpoint or an RFC, which the same creation wizard supports but a later post in the series is left to cover. Selected API operations become MCP Tools with generated input and output schemas, the server inherits its Authentication policy from the source API, and a Process Integration Runtime service instance supplies the OAuth credentials an external client needs to invoke it. Ends by connecting the deployed server to Cline in VS Code and having it chain tool calls to answer a natural-language purchase-order query.published 2026-07-15
RFC/BAPIs Meet AI Agents: Why SAP Integration Suite MCP Server MattersRFC/BAPIs Meet AI Agents: Why SAP Integration Suite MCP Server MattersExplains that SAP Integration Suite's MCP Server artifact can expose RFC-enabled BAPIs, alongside API artifacts and HTTP endpoints, as MCP tools — letting BAPIs on SAP ECC or on-premise S/4HANA participate in agentic workflows without rewriting business logic or waiting for a full ERP transformation. Frames RFC support as a bridge for organisations still modernising rather than a recommendation to build new RFC-based integrations, and notes the exposed BAPIs inherit the server's existing authentication, rate limiting and IP filtering. A demo built against an SAP ECC backend shows an MCP client discovering and invoking several read-only BAPIs from natural-language prompts, with no custom wrapper code.arunmaarirajha_kv, published 2026-07-28
SAP Integration Suite + MCP: A Practical Architecture for AI Agents and SAPSAP Integration Suite + MCP: A Practical Architecture for AI Agents and SAPLays out the runtime chain for exposing S/4HANA APIs to an AI agent through SAP Integration Suite: the agent calls a tool on the MCP Gateway, which is built from a governed API Artifact, which still runs on Cloud Integration for mapping, routing and error handling before reaching the backend. It states that the API-artifact approach requires the Integration Cell runtime rather than the normal CPI message-processing runtime, an OAuth-secured REST or OData artifact on OpenAPI 3.0.0-3.0.3, and an entitlement that is service-plan dependent (citing SAP Note 2903776) — so the architecture question is whether the landscape already has the right MCP entitlement, runtime and API foundation.aayushaggarwal, published 2026-09-02
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13
Analytic modellingSAP and community
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
Database connectorsSAP only
Accelerating Your Analytics with Delta Table Replication into SAP HANA CloudAccelerating Your Analytics with Delta Table Replication into SAP HANA CloudStarting with QRC 04/2025, SAP HANA Cloud can replicate a Delta Lake table from an external Delta Sharing source directly into a native HANA table, rather than only querying it live through a virtual table. The post walks through creating a remote subscription, running a chunk-based initial load, and setting up change data capture on a schedule or on demand, each with the SQL statements and monitoring views involved, plus the simpler virtual-table-toggling and HANA Cloud Central UI alternatives.SeungjoonLee, published 2025-12-22
Automate Recurring Data Updates in SAP HANA CloudAutomate Recurring Data Updates in SAP HANA CloudA walkthrough for marking inventory rows stale after 30 days using SAP HANA Cloud's own scheduler: a SQLScript procedure, a CREATE SCHEDULER JOB statement with its 7-field cron pattern, the M_SCHEDULER_JOBS monitoring view, and the matching DROP statements to remove both. It then names where that approach stops and lists the alternatives for scheduling outside the database: SAP Integration Suite's Timer Event, the SAP Job Scheduling service, SAP Automation Pilot for infrastructure commands, and a custom approach for triggering scheduled REST calls from an application.Joni, published 2026-06-11
Building a CAP App with Fiori Integration – Part 1: Environment & HANA Cloud SetupBuilding a CAP App with Fiori Integration – Part 1: Environment & HANA Cloud SetupA trial account taken from nothing to a CAPM project with a HANA Cloud instance behind it. Everything here is prerequisites, which the author says outright — the application is in the parts that follow.SuryaRamesh, published 2026-04-08
Building an SAP BTP Agent Architecture from Scratch: Python + CAP + HANABuilding an SAP BTP Agent Architecture from Scratch: Python + CAP + HANAA first-person build log of a Flask orchestrator on Cloud Foundry that reduces a question to keywords, searches a Node.js service's Documents entity, and passes what it finds to Claude for a grounded answer. Getting there means learning that HANA's fuzzy .search() matches one word but not a full sentence, fixed by splitting the query into terms and merging the per-term hits, and that provisioning SAP HANA Cloud hits a database-level free-tier quota rather than an HDI-container one, with a stopped instance needing to be resumed first. It also covers @sap/cds-dk needing to sit in dependencies rather than devDependencies, since Cloud Foundry's buildpack skips the latter, before cds deploy --to hana can run as part of the push.neilaspin, published 2026-07-28
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Create a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud FoundryCreate a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud FoundryThe whole lifecycle in one post rather than a series — model, service, HANA binding, build, deploy. Useful as a single reference for the order things have to happen in, which is the part that is easy to get wrong when it is spread over six posts.MaheshSirsat1708, published 2025-11-19
Create a CAP Application with SAP HANA Cloud from Scratch and Deploy to Cloud Foundry
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-3]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-3]The cloud database appears: a HANA Cloud instance created on BTP and mapped to a Cloud Foundry space. No application code — this is the part where the platform has to be right before the next part can connect to it.sanjucs, published 2026-05-08
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]The switch from SQLite to HANA and the first deploy of the back end to Cloud Foundry — the point in the series where the persistence stops being a file and the build starts producing HDI artifacts.sanjucs, published 2026-05-12
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-4]
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)Opens with the observation the whole series rests on — CAP is usually demonstrated locally, and the interesting part starts when it is deployed. Part one of the run that continues into PostgreSQL and Work Zone.yashbhosle789, published 2026-02-25
Part 1: Creating and Deploying a SAP CAP Application with SAP HANA on SAP BTP (Cloud Foundry)
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Setting Up PostgreSQL for SAP BTP Development: A Practical GuideSetting Up PostgreSQL for SAP BTP Development: A Practical GuideOpens with the premise the rest of this bucket mostly assumes away — not every BTP application needs HANA Cloud — and then sets up PostgreSQL on the hyperscaler option. Part one of a series that continues into XSUAA.michal_majer, published 2026-01-20
Loading a warehouseSAP and community
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
Object storageSAP only
Integrating Using Google Cloud Storage Adapter (GCP Authentication & adapter config)Integrating Using Google Cloud Storage Adapter (GCP Authentication & adapter config)Walks through connecting SAP Integration Suite's Google Cloud Storage adapter to a bucket: creating a GCP service account with the Storage Object Admin role, generating its JSON or P12 key, converting it into a key-pair alias, and using that alias and the service account email in the adapter's authentication. It covers configuring the receiver adapter's upload operation (directory, object name, content type, and override, ignore or fail handling for an existing file) and the sender adapter's read, including post-processing to archive, delete or keep the object after an iFlow fetches it.MirunaliniV, published 2026-02-20
Async processingSAP only
Automate BTP Custom Domain certificates using Let's EncryptAutomate BTP Custom Domain certificates using Let's EncryptCertificate lifecycle management as an application: a CAP backend, a Fiori elements UI, the Custom Domain service, Cloud Foundry routes and the Job Scheduler, so requests, renewals and cleanup stop being manual. Part two of the author's BTP Toolbox.Ben, published 2026-03-19
Event Mesh + AMQP: The Retry Trap Nobody Warns You AboutEvent Mesh + AMQP: The Retry Trap Nobody Warns You AboutWorks through two patterns for retrying failed messages from Event Mesh's AMQP sender adapter on Cloud Integration, whose native retry has no configurable delay or backoff: bridging into a JMS queue for full exponential-backoff control, or looping messages through a dedicated retry queue with a TTL and a Dead Message Queue. Compares both against a Groovy sleep() workaround that blocks the adapter's connection and the runtime's worker thread, and shows that Advanced Event Mesh's own adapter ships configurable retry interval, backoff and broker-side redelivery without either workaround.MateuszPiotrowski, published 2026-03-09
DestinationsSAP only
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]The consequence of decoupling: with the back end live on its own Cloud Foundry route, the front end needs a BTP destination to reach it rather than a relative path. Short, and it is the join the architecture creates.sanjucs, published 2026-05-18
Implementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsImplementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsWhy environment variables are the wrong place for backend endpoints in a CAP application, and what replaces them: cockpit destinations resolved at runtime, with the subaccount or instance identified as the request is handled. The argument is about redeployment — an endpoint kept in the environment means a deploy every time it moves — and the shape it produces is one codebase serving several landscapes without a build per landscape.Dnyaneshwar Salve, published 2026-03-18
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
UI for the BTP Application Vulnerability ReportUI for the BTP Application Vulnerability ReportAn open-source SAPUI5 front end for SAP's Application Vulnerability Report API, backed by a CAP Node.js service that projects the external findings as an OData V4 entity and forwards each query with api.run(req.query). The CAP service reaches that API through a Destination service instance configured with OAuth2ClientCredentials authentication from a service key, so the address and credentials stay out of the application code.published 2026-02-10
Use REST services in GraphUse REST services in GraphSAP Graph turns a REST service into a business data graph by pairing a data destination with a metadata destination that supplies its OpenAPI document, since plain REST has no $metadata endpoint of the kind OData exposes. It walks through creating both destinations on SAP BTP, including the OAuth2ClientCredentials authentication needed when the OpenAPI file is hosted through an API artifact, and shows how Graph flattens each REST operation's path and method into an unbound OData action or function, such as turning a DELETE on /users/pets into a POST to users_pets__delete.florian_moritz, published 2026-01-20
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
Event MeshSAP only
Clean Core by Design: Event Enablement Cockpit as a Core Integration Enabler in SAP S/4HANAClean Core by Design: Event Enablement Cockpit as a Core Integration Enabler in SAP S/4HANAWalks through wiring an on-premise SAP S/4HANA system into Event Mesh as an event producer, using the Enterprise Event Enablement framework: creating the service instance and its service key, then an RFC destination and OAuth 2.0 client configuration in SPRO so a channel can publish native S/4 business events over AMQP or MQTT. Covers the channel's reconnect and quality-of-service parameters and activating the Event Discovery Service, and notes that SAP ECC needs a third-party add-on for the same events since S/4's native Business Events are not available there.HammadSharif1, published 2026-06-01
Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23
Event Mesh + AMQP: The Retry Trap Nobody Warns You AboutEvent Mesh + AMQP: The Retry Trap Nobody Warns You AboutWorks through two patterns for retrying failed messages from Event Mesh's AMQP sender adapter on Cloud Integration, whose native retry has no configurable delay or backoff: bridging into a JMS queue for full exponential-backoff control, or looping messages through a dedicated retry queue with a TTL and a Dead Message Queue. Compares both against a Groovy sleep() workaround that blocks the adapter's connection and the runtime's worker thread, and shows that Advanced Event Mesh's own adapter ships configurable retry interval, backoff and broker-side redelivery without either workaround.MateuszPiotrowski, published 2026-03-09
How to use a CAP application to manage DMQ messages on SAP Advanced Event MeshHow to use a CAP application to manage DMQ messages on SAP Advanced Event MeshA CAP application built for the failure path rather than the happy one. Messages that land in a Dead Message Queue are deleted for good when their TTL expires, so this pulls them out first and holds them in quarantine, where a Fiori elements UI lets someone inspect a payload, correct it and reinject it. An operations tool, and a rare write-up of what to do after delivery has already failed.stefan-keuker, published 2025-12-31
How to use a CAP application to manage DMQ messages on SAP Advanced Event Mesh
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects Runnable code.
Implementing Event-Driven Architecture in CAP Java using SAP Event MeshImplementing Event-Driven Architecture in CAP Java using SAP Event MeshPublish and consume from the Java stack, which most of the Event Mesh writing on the community does not cover. The MTA declaration and the credentials come first, then the emit and the handler, then the two sections that make it worth keeping: error handling with retries, and securing the events with OAuth.Soumya-Pirlamarla, published 2025-11-26
Implementing Event-Driven Architecture in CAP Java using SAP Event Mesh
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Migrating from ASANWEE to ASAAEMEE: From SAP Event Mesh to SAP Advanced Event MeshMigrating from ASANWEE to ASAAEMEE: From SAP Event Mesh to SAP Advanced Event MeshA migration walkthrough for switching an SAP ERP or S/4HANA on-premise system from classic SAP Event Mesh to SAP Advanced Event Mesh: new RFC destinations to the broker's REST, handshake and token endpoints, trusting its certificate, activating the AEM business configuration set, and re-pointing the NetWeaver Add-On for Event Enablement's outbound object and dynamic topic mapping at the new instance. It assumes the Event Add-On for ERP (ASAAEMEE) is already installed and covers only the technical cut-over, not setting up event publishing from scratch.Benedikt_Sprung, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration SuitePublish events from CAP Node.js applications to Event Mesh of Integration SuiteThe smallest complete example: cds init, a service with one function, cds.connect.to('messaging') and an emit to a topic. Deliberately scoped — the Event Mesh setup is skipped and the subaccount is assumed to be the same one — so what remains is the handful of lines on the CAP side and the binding that makes them reach the broker.KevinWang_ST_Consultancy, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration Suite
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Receive Events from Event Mesh of Integration Suite to CAP Node.js ApplicationsReceive Events from Event Mesh of Integration Suite to CAP Node.js ApplicationsWalks a CAP Node.js application through consuming events from SAP Integration Suite, Event Mesh: adding the messaging and xsuaa services with cds add, writing messaging.on handlers for named topics, and building and deploying the service as an MTA to Cloud Foundry. Documents a mismatch between Cloud Foundry's automatic queue provisioning and Event Mesh's management API, worked around by pointing the service key's management URI at a mock endpoint that always returns 201.KevinWang_ST_Consultancy, published 2026-02-13
SAP Codejam on Event Driven Build ProcessSAP Codejam on Event Driven Build ProcessA hands-on CodeJam walkthrough of an event-driven flow: a Business Partner creation event from a simulated S/4HANA Cloud system is published to SAP Advanced Event Mesh, where the author configures topics, queues and subscriptions and forwards it through a REST Delivery Point to SAP Build Process Automation, which runs a business process with a human approval step and an asynchronous callback to a third-party system. The event producer stays unaware of its consumers, with SAP Build acting purely as an orchestrator reacting to events.Sharathmg, published 2026-02-03
SAP EHS Public Cloud: Extending Your Existing Landscape Side-by-Side - Guidebook (Part 4)SAP EHS Public Cloud: Extending Your Existing Landscape Side-by-Side - Guidebook (Part 4)Two custom iFlows in SAP Integration Suite subscribe over AMQP to Event Mesh queues, triggered by SAP S/4HANA On-Premise's Enterprise Event Enablement channels publishing Equipment and Functional Location changes; each flow calls the on-premise OData API, maps the result, and pushes it into SAP S/4HANA Cloud Public Edition through the SAP_COM_0395 communication scenario. The synchronized Plant Maintenance data feeds SAP EHS Public Cloud's risk management, incident management and emissions management processes, which otherwise have no asset master data of their own.duynguyendeloitte, published 2025-11-28
Integration flowsSAP only
Batch File Pickup and Dynamic ZIP Creation in SAP Integration SuiteBatch File Pickup and Dynamic ZIP Creation in SAP Integration SuiteWalks through configuring a Cloud Integration flow that polls an SFTP server for batches of ten files, using a Content Modifier to preserve each file's name and body before appending them into one temporary file. A Router and Poll Enrich step detect when the batch is complete, a General Splitter breaks the combined payload back into individual messages, and a Gather step reassembles them into a dynamically named ZIP archive that keeps the original filenames, before the archive is sent on to a target SFTP server.sahilminhas, published 2026-05-07
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Beyond REST: Exploring GraphQL API Integration in SAP BTP Integration SuiteBeyond REST: Exploring GraphQL API Integration in SAP BTP Integration SuiteBecause Cloud Integration in SAP Integration Suite ships no native GraphQL adapter, the author builds a GraphQL integration flow on the standard HTTP adapter: a Groovy script assembles the query or mutation payload and sets the JSON content type, and a JSON-to-XML converter turns the response into something message mapping can consume. The walkthrough uses the public Countries API to stand in for a real order-synchronisation flow between an e-commerce platform and SAP S/4HANA.Avinash_Vaidya, published 2025-11-11
Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)A step-by-step build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter accepts JSON, a content modifier stores the currencies and amount as exchange properties, and a Request-Reply step calls an external rate API before a Groovy script renders the result as an HTML table. A Global Exception Subprocess centralizes error handling for the whole flow, turning the MPL ID, error type and message into HTML and mailing it as a notification to a support address.RajeshwerRao_G_1, published 2026-04-01
Centralized Error Handling in SAP Cloud IntegrationCentralized Error Handling in SAP Cloud IntegrationBusiness integration flows in Cloud Integration route their runtime errors to a shared Central Error Logger flow through an Exception Subprocess and a ProcessDirect adapter, instead of each flow handling failures on its own. The logger normalises the incoming error data — flow name, message ID, correlation ID, timestamps — and formats it into an HTML email sent through a Mail Receiver Adapter. The author validated the same logger flow, unchanged, against a second, more complex business flow with routers and multiple email notifications.vishaladhikari, published 2026-03-27
Cloud Integration- Activating Enterprise Messaging Capabilities for JMS Queue - CFCloud Integration- Activating Enterprise Messaging Capabilities for JMS Queue - CFTraces a JMS iFlow deployment failure on Cloud Integration (Cloud Foundry) — ERROR_MISSING_SERVICE_KEY — to the Message Queues (Enterprise Messaging) capability being switched off on the tenant rather than a missing service key, since an edition upgrade does not turn it on by itself. Resolves it by enabling Message Queues under Manage Capabilities, which restarts the tenant, then redeploying the affected iFlows.Pavan_Koppula1, published 2026-07-21
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
End to End Currency Conversion Integration using SAP Integration Suite (SAP CPI)End to End Currency Conversion Integration using SAP Integration Suite (SAP CPI)A hands-on build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter takes JSON input, a Request-Reply step calls an external exchange-rate API, and a Groovy script converts the amount and formats it as an HTML table before a Mail Adapter delivers the result. Most of the walkthrough is the Exception Subprocess added after hitting HTTP 500 and 429 errors in testing, which captures the error message, response code and message-processing-log ID and turns them into a readable response instead of a raw stack trace.shahabaz, published 2026-04-09
End-to-End Mail Adapter Setup in SAP CPI Using Gmail (Step-by-Step Guide)End-to-End Mail Adapter Setup in SAP CPI Using Gmail (Step-by-Step Guide)Walks through configuring Cloud Integration's Mail Receiver Adapter against a personal Gmail account: enabling 2-Step Verification and an app password in Gmail, storing it as CPI security material user credentials, and testing the SMTP connection (smtp.gmail.com, port 587, STARTTLS) before wiring the adapter into an integration flow. A content modifier builds the message body, and a Postman call triggers the flow to send mail through the configured Gmail account.srivallivasamsetti, published 2026-03-09
Intelligent Error Handling in SAP CPI Using AI AdapterIntelligent Error Handling in SAP CPI Using AI AdapterAdds an AI Receiver Adapter to an Exception Subprocess in Cloud Integration, so a failed iFlow sends its captured exception text to an LLM over a chat-completions endpoint and gets back an error summary, cause and resolution for the sender. The walkthrough is concrete about the flow's own mechanics — Security Material for the API key, the adapter's address and request body, a Content Modifier to extract and return the response — which is why it explains Integration flows rather than only the AI feature riding on top of them.Jayesh8909, published 2026-05-21
Managing JMS Queues Programmatically with the new SAP Cloud Integration JMS OData APIManaging JMS Queues Programmatically with the new SAP Cloud Integration JMS OData APIThe new JMS OData API on Cloud Integration exposes MessagingQueues and MessagingMessages entities, letting a client list, inspect, retry and move JMS messages without opening the monitoring UI, from Cloud Integration 7.52.x on Cloud Foundry and 8.41 on the Edge Integration Cell runtime. It works through OAuth 2.0 client-credentials authentication against a Process Integration Runtime service instance, a fixed row cap with time-window slicing used in place of offset paging because queues change between requests, and a consistent OData error envelope for the codes the surface returns.MarcoKoch, published 2026-06-01
Message Mapping in SAP Integration Suite - Custom Scripts and Conditional MappingMessage Mapping in SAP Integration Suite - Custom Scripts and Conditional MappingWalks through two ways to extend a message mapping step in SAP Integration Suite's Cloud Integration: a custom Groovy function added in the Mapping Expression editor's Scripts section, and a graphical equals/if node pair built from the standard function library, each suited to logic the other cannot express cleanly. Shows the Simulate tool's Generate button building a test payload from the source structure, then editing individual field values to exercise both the true and false branch of a condition before deployment.jirifridrich, published 2026-04-03
Microsoft GRAPH API - Read and extract attachments of Outlook email from Cloud IntegrationMicrosoft GRAPH API - Read and extract attachments of Outlook email from Cloud IntegrationBuilds an integration flow in Cloud Integration that authenticates to the Microsoft Graph API with an OAuth2 Client Credentials credential and an HTTP Receiver Adapter, then calls the Outlook inbox by MessageID to retrieve an email's attachment. A Groovy script using the pdfbox and fontbox libraries extracts the text from a PDF attachment, as an alternative to placing the attachment on SFTP unchanged or fetching the whole message with its attachment through the $value query.ChaithraShanmugam, published 2025-12-09
Parallel Data Filtering and Dropbox Integration Using SAP Cloud IntegrationParallel Data Filtering and Dropbox Integration Using SAP Cloud IntegrationA step-by-step build of an integration flow in Cloud Integration: a Start Timer triggers the flow, a Parallel Multicast splits student records by gender through XPath filters, and each branch uploads its file to Dropbox over a Receiver Adapter authorized against a Dropbox app's OAuth2 credentials. An Exception Subprocess captures the error message and a Mail Adapter sends it over SMTP, centralizing error handling and an email notification for the whole flow.Vurumind03, published 2025-12-10
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP - CI - Building Open-Source Custom Adapter EventSmartKafka from Zero with SAP ADK - Part IISAP BTP - CI - Building Open-Source Custom Adapter EventSmartKafka from Zero with SAP ADK - Part IIPart II of a series on EventSmartKafka, an open-source Kafka adapter for Cloud Integration in SAP Integration Suite built with the SAP Adapter Development Kit, walks through the runtime behind a custom adapter: how metadata.xml's fields map onto Java Endpoint properties, how the Component class creates the Endpoint, and how the Consumer's doStart() and doPoll() poll Apache Kafka, convert Avro payloads and dispatch the record into the iFlow pipeline. Its central point is that the Kafka offset must be committed only after the pipeline has processed the message successfully, with a worked table of which failure scenarios (missing Confluent magic byte, invalid schema ID, payload over the configured limit) withhold the commit versus let it through, to avoid poison-pill loops and silent message loss. The adapter is published as a community demo and not SAP-certified or production-validated; Part III covers building the SAP ADK project itself.rhviana, published 2026-06-03
SAP BTP - CI - EventSmartKafka - Custom Kafka Adapter - Part V FINALSAP BTP - CI - EventSmartKafka - Custom Kafka Adapter - Part V FINALEventSmartKafka is an open-source Kafka Consumer/Sender adapter for SAP Cloud Integration in SAP Integration Suite, built with the SAP Adapter Development Kit; it reaches Apache Kafka over SASL, SASL_SSL and mutual TLS, with on-premise brokers reached through Cloud Connector. This final release adds Avro-to-JSON/XML conversion, schema registry integration, message recovery by timestamp and Kafka producer support. The author reports the consumer validated past 6.5 million processed messages with zero failures and the producer run continuously for more than 20 hours, with deployment lifecycle testing — deleting, upgrading and redeploying the adapter — showing no runtime interruption.rhviana, published 2026-07-28
SAP BTP - CI - EventSmartKafka - Custom Kafka Adapter From .ESA v1.1.0 - Validated Runtime - Part IVSAP BTP - CI - EventSmartKafka - Custom Kafka Adapter From .ESA v1.1.0 - Validated Runtime - Part IVPart IV of a series on EventSmartKafka, an open-source Kafka Consumer adapter for SAP Cloud Integration in SAP Integration Suite, built with the SAP Adapter Development Kit. The v1.1.0 release adds mutual TLS client-certificate authentication against the broker, fixes an OSGi classloader bug where a redeployed bundle's static registry lost track of a still-open relay socket from the previous classloader (fixed with a JVM-wide System-property registry instead), replaces infinite retry loops on fatal configuration errors with a fail-fast stop, corrects two offset-handling bugs in timestamp-based message recovery, adds a parallel-consumer option, and drops a planned OAuth2 strategy because no tier of the tested broker services (Confluent Cloud, Redpanda Cloud, Aiven) exposed it for testing on a free plan. The author reports the release validated across 3,000,000 messages over four simultaneous listeners (PLAINTEXT, SASL, SASL_SSL, mTLS) on an SAP BTP Trial tenant with zero failures, closing the adapter's Consumer side before a planned Producer adapter.rhviana, published 2026-06-29
SAP BTP - CI - How I Built an Open-Source Enterprise Custom Kafka Adapter from Scratch - Part ISAP BTP - CI - How I Built an Open-Source Enterprise Custom Kafka Adapter from Scratch - Part IPart I of a series on EventSmartKafka, an open-source Apache Kafka adapter the author built with the SAP Adapter Development Kit to extend SAP Cloud Integration in SAP Integration Suite past the standard adapter's offset management, security options and Avro handling. It covers the architecture: granular offset control via seek(), a security UI that switches between SASL, mutual TLS and OAuth profiles, native Avro-to-JSON/XML conversion against a Schema Registry, configurable resilience policies, and on-premise reach through Cloud Connector. The adapter already runs against a live Confluent Cloud Kafka topic in a real tenant; the source code follows from Part II onward.rhviana, published 2026-05-29
SAP BTP - CI - Immutable Event Routing per Domain with Metadata-Driven Consumer OrchestrationSAP BTP - CI - Immutable Event Routing per Domain with Metadata-Driven Consumer OrchestrationDescribes a metadata-driven "Smart Router" pattern for Cloud Integration in SAP Integration Suite: one Kafka Sender Adapter per domain reads a wildcard topic, and a single immutable router iFlow resolves single, multiple or both consumers at runtime from Value Mapping entries and a Groovy script, instead of one adapter and iFlow per consumer added. It compares three candidate architectures — a two-layer router/dispatcher split, the recommended single-layer router, and a rejected global cross-domain router — and covers AVRO payload handling through Base64 and an externalized schema parameter, and consolidating the routing logic into one cached Groovy class to limit JVM class-loading overhead. The piece continues the author's earlier immutable Kafka topic routing post and names SAP Event Mesh as one of several broker-agnostic alternatives to the Kafka adapter used here.rhviana, published 2026-05-25
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
SAP EHS Public Cloud: Extending Your Existing Landscape Side-by-Side - Guidebook (Part 4)SAP EHS Public Cloud: Extending Your Existing Landscape Side-by-Side - Guidebook (Part 4)Two custom iFlows in SAP Integration Suite subscribe over AMQP to Event Mesh queues, triggered by SAP S/4HANA On-Premise's Enterprise Event Enablement channels publishing Equipment and Functional Location changes; each flow calls the on-premise OData API, maps the result, and pushes it into SAP S/4HANA Cloud Public Edition through the SAP_COM_0395 communication scenario. The synchronized Plant Maintenance data feeds SAP EHS Public Cloud's risk management, incident management and emissions management processes, which otherwise have no asset master data of their own.duynguyendeloitte, published 2025-11-28
SAP Integration Suite: Intelligent Integration with AI AdapterSAP Integration Suite: Intelligent Integration with AI AdapterThe AI Adapter adds generative AI as a receiver step inside a Cloud Integration flow, connecting through either AICore-GenAIHub — a single API onto SAP AI Core's Generative AI Hub and its foundation models — or Custom-OpenAI-Rest, a plain REST call out to a provider such as OpenAI. SAP Integration Suite starts the call from the iFlow and feeds the model's response into the next step, which is the mechanics behind the sentiment-analysis, summarisation and routing use cases the piece lists without walking through any one of them.meena_choudhary, published 2026-01-28
SAP Neo Retires – Integration Developers Must Know Before Migrating from Neo to CFSAP Neo Retires – Integration Developers Must Know Before Migrating from Neo to CFWalks through what changes when Cloud Integration moves from the Neo environment to Cloud Foundry under SAP Integration Suite: custom adapters move from an Eclipse-plugin deployment to Integration Adapter artifacts managed in Cloud Integration's Design and Monitor applications, Neo's environment variables (HC_APPLICATION, HC_HOST, HC_REGION and others) map to Cloud Foundry's TENANT_NAME, VCAP_SERVICES and PORT, and OAuth clients for API access move from Neo administration tools to XSUAA under Integration Suite. Covers the same shift for security materials, transport management and monitoring, ahead of Neo's end of maintenance on 31 December 2028.SivaS, published 2025-12-03
SAP集成套件中的Cloud Integration云集成功能概况介绍SAP集成套件中的Cloud Integration云集成功能概况介绍An overview of Cloud Integration within SAP Integration Suite: it positions Cloud Integration as the execution engine that processes and moves messages between systems, working alongside Integration Advisor, Trading Partner Management and API Management. It walks through building an integration flow in the low-code editor — connecting over HTTP/OData or RFC with built-in connectors and prebuilt content, transforming and mapping messages, then deploying and monitoring the flow — and closes by naming PI/PO Move, SAP's tooling to assess and migrate existing PI/PO integration content into the suite.ArthurYang, published 2025-10-28
Stop Building From Scratch: Unlocking SAP Cloud Integration’s Standard ContentStop Building From Scratch: Unlocking SAP Cloud Integration’s Standard ContentArgues against building integrations from scratch by pointing to the Discover space of Cloud Integration: over 700 prebuilt integration packages and nearly 4000 iFlows, covering common scenarios such as S/4HANA-to-Salesforce business-partner and order sync, included at no extra cost under an SAP Integration Suite licence. Walks through where to find and copy a package, and the support trade-off it creates: SAP keeps supporting the standard baseline, but once a flow is directly modified the customer owns the lifecycle of that change, which the author sets against patterns like overlay mappings and wrapper orchestrators that preserve support.Punith_Oswal, published 2025-12-19
Use Datastore to avoid too many duplicate MPL attachments in exception retriesUse Datastore to avoid too many duplicate MPL attachments in exception retriesWalks through an Integration flows design on Cloud Integration: an exception subprocess that writes the source and in-flight payloads to a DataStore entry, keyed by the message's correlation header and overwritten on each retry, instead of a Groovy script attaching both payloads to the message processing log on every run. With unrestricted retries left in place, one interface the author retried 14 times produced two DataStore entries instead of up to 28 message processing log attachments; the post also notes that deleting the DataStore entry for a retrying message marks it Cancelled in monitoring without stopping the retries.pdimri, published 2025-11-26
RFC connectivitySAP only
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
Trading partner agreementsSAP only
Implementing B2B Advisory in SAP Integration Suite for Custom XML EDIFACT Scenario Part - 3Implementing B2B Advisory in SAP Integration Suite for Custom XML EDIFACT Scenario Part - 3Builds the inbound side of a custom EDIFACT-to-IDoc scenario on Trading Partner Management: an iFlow picks a file from SFTP and sets headers for adapter type, document standard, namespace, version and sender and receiver IDs, and a second iFlow assembles them into the agreement's plain partner ID and matches it in the Partner Directory. A Groovy script then calls PartnerDirectoryService.getParameter to read a partner's custom activity parameters and general value-mapping data stored under the agreement, so dynamic field mapping comes from the agreement rather than a flow per partner. Third of a series on setting up trading partner agreements in SAP Integration Suite, after the TPM foundation and the agreement itself in parts 1 and 2.amysh95, published 2026-03-10
Agent access to your codeSAP and community
Don't Wait for SAP: Unlocking MCP Servers in BAS Right NowDon't Wait for SAP: Unlocking MCP Servers in BAS Right NowA workaround post with a grievance behind it: MCP servers were promoted heavily at SAP TechEd, most IDEs support them, and Business Application Studio limits you to Joule. This is how to run them there anyway. Worth reading as evidence of where the tooling gap sits rather than only for the recipe, which by nature has a shelf life.published 2025-11-27
What’s new in Mobile development kit client 26.9What’s new in Mobile development kit client 26.9This Mobile development kit client 26.9 release note explains that @sap/mdk-mcp-server is now reachable from SAP Business Application Studio's AI chat, giving an assistant real knowledge of the MDK metadata schema rather than generic code generation. With it an assistant can scaffold an MDK project, generate pages, actions, rules, i18n, services and styles into it, iterate on it conversationally, and answer schema and client-API questions inline through mdk-docs.published 2026-09-27
Agent access to your systemsSAP and community
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
Agent toolingSAP only
Adapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionAdapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionA custom Joule Agent and Joule Skill, built in Joule Studio, classic edition to extend SAP Joule past its built-in Purchase Order display and change features: a buyer's single sentence naming a Purchase Requisition number becomes a created Purchase Order, with the skill wrapping the Purchase Requisition and Purchase Order OData V4 APIs as Action Packages reached through two destinations. The author anchors the agent's success condition to a PurchaseOrderNumber in the skill's output rather than an HTTP status code, and reports that the Purchase Requisition item structure does not map one-to-one onto the Purchase Order creation payload.jonathanvi59, published 2026-08-19
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Custom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalCustom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalBuilds a Joule Studio agent that reviews SAP Ariba SLP supplier registration tasks: four custom skills bind to Ariba's API (pending tasks, task detail, questionnaire answers, post a decision), each needing a precisely configured BTP destination and action, and the agent's own Expertise, Instructions and Additional Context sections carry the domain knowledge, the step order, and the scoring rubrics that decide approve, deny or deny-with-resubmit. The author contrasts this with an earlier hand-wired flow on SAP Build Process Automation, where every connection, variable and error path had to be designed and wired manually.Giancarlo-Martinez, published 2026-04-07
Event Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshEvent Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshA prototype, described as one: a plain CAP application made to react to external events on Kyma, with an agent in the loop and the UI refreshing itself rather than being reloaded. Short — it reports what was built and why, not how to rebuild it.Shahid, published 2025-12-01
How Redwood Software and SAP are shaping the next era of automation with Joule StudioHow Redwood Software and SAP are shaping the next era of automation with Joule StudioRedwood's Field CTO describes a tech preview where an SAP Basis administrator tells SAP Joule in natural language to pause background jobs and dependent Integration Suite iFlows for unplanned system maintenance; Joule acts as a control tower, triggering a pre-approved RunMyJobs workflow and asking for approval before the restart proceeds. The integration is built by publishing RunMyJobs operations to the SAP Business Accelerator Hub, securing access through SAP BTP with API keys and role-based permissions, and combining those actions into a skill inside Joule Studio's low-code design canvas.gmblom, published 2025-11-02
SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)Part 3 of a six-part series builds a router agent that classifies incoming SM21 system log errors and SM37 job failures, delegates each to a specialized sub-agent built with LangGraph's create_react_agent, and correlates findings across both logs into a single severity score and escalation list. State moves through a typed dict shared between the router and its sub-agents, with tools that query SAP HANA tables directly; a reactive on-demand mode sits alongside a scheduled monitoring loop that compares error counts to a baseline and escalates automatically past a threshold. The router-plus-sub-agent split carries forward to Part 6, where the same router coordinates the assessment agents built in the series' other parts.DEEPA_DORAIRAJ, published 2026-04-06
SAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingSAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingWalks through building a transactional Joule Skill in Joule Studio, classic edition without writing code: activating an EHS Incident OData service in SAP S/4HANA, wrapping it as an Action Project with chosen input and output fields, then creating, saving and deploying the skill from those fields. Tested against a live system, the deployed skill lets a user create an EHS incident and list reported incidents through Joule's conversational interface or a configured button.Pardhasaradhi_Reddy_Chelikam, published 2026-01-05
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableSAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableWalks through building an Invoice Release Agent in SAP Joule: a custom OData service surfaces supplier invoices whose S/4HANA Flexible Workflow approval is overdue, the agent ranks them by invoice value, aging, payment tenor or a combined score, and a Joule Skill calls the standard SAP AP Invoice OData API to release them, re-prioritizing the remainder after each action. It sets out the detect-prioritize-act loop and the four ranking criteria in enough detail to rebuild the pattern, and leaves authorization, auditability and segregation-of-duty controls to the reader's own design.idc, published 2026-08-11
SAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenSAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenReading SAP's API Policy v.4.2026a and its FAQ against the reference architectures, the piece narrows the widely repeated claim that SAP bans AI to what Section 2.2.2 actually restricts: an agent planning and chaining API calls outside an SAP-endorsed route, closed off further by Section 3's block on bypassing API Controls through custom code. It compares the endorsed and allowed paths — the MCP Gateway on SAP Integration Suite reaching S/4HANA and ECC through RFC-based back ends under a 15-tool, 200,000-token limit, SAP-provided MCP servers through Joule Studio, the A2A protocol, customer-operated MCP servers allowed under FAQ Question 56, and the ADT MCP Server, whose 18 tools work only on development artifacts and are documented as not intended for productive use. It leaves open whether Section 2.2.2 covers ABAP code that calls a model from inside the system, since enforcement is defined at the API-traffic level rather than by a list of tools.published 2026-08-31
Data maskingSAP only
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Document extractionSAP only
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
What a Second Document AI Workshop Taught Me About GovernanceWhat a Second Document AI Workshop Taught Me About GovernanceFrom questions raised at a second SAP Document AI workshop: the retention period for extracted data is a setting in the service's administration rather than a fixed property, with the source file deleted after processing and the decommissioning period for the extracted data configured to the customer's own policy. It also draws a boundary readers kept merging: Document AI extracts across languages but does not translate, so turning a document into a reviewer's own language is a separate step, pointing on BTP at SAP Translation Hub.Nicolas_BacaStorni, published 2026-08-25
Why Our First Document AI Exercise Was a Résumé, Not an InvoiceWhy Our First Document AI Exercise Was a Résumé, Not an InvoiceWorking through a SAP Document AI workshop, the author explains why its exercises teach extraction on a résumé before an invoice: a résumé has no stable layout to map fields against, so it forces the point that the tool extracts from a written description of a schema rather than from position-matched templates. Describing the schema is shown to carry real judgment — what a missing end date should become, what a vague field name like "number" costs the model, who in a company should decide these things — and the piece argues that preparing for a project is chiefly a business task of writing down knowledge that otherwise stays in people's heads.Mariano_BacaStorni, published 2026-09-03
LLM integrationSAP only
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Autonomous Diagnostics on Kyma Unplugged: Goose + LiteLLM + KRO + SAP AI Core in ProductionAutonomous Diagnostics on Kyma Unplugged: Goose + LiteLLM + KRO + SAP AI Core in ProductionAn in-cluster autonomous diagnostic pipeline on Kyma Unplugged (open-source Kyma, noted to also run on SAP BTP, Kyma runtime): a Goose agent with kubectl access calls SAP AI Core through a LiteLLM proxy, and most of the post is about the quirks of that route — drop_params silently swallowing unrecognised parameters and beta headers, streaming that has to be off when tools are attached, and prompt caching that sits on the Orchestration V2 API rather than the foundation-model path the LiteLLM provider hits. A second Node.js proxy reaches that API, and the author reports caching unconfirmed at production scale, which leaves the roughly $0.004 per static run a target rather than a measured figure. Spend metrics reach SAP Cloud Logging over OTLP through Kyma's Telemetry MetricPipeline while the health analysis itself lands in Kubernetes custom resources read in Busola, and the stack is declared as KRO Resource Group Definitions applied with one Terraform command.quovadis, published 2026-07-09
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Calling Claude from ABAP: How I Wired SAP AI Core into a Real Business ScenarioCalling Claude from ABAP: How I Wired SAP AI Core into a Real Business ScenarioA proof of concept wiring SAP AI Core's Claude deployment directly into ABAP with no CAP layer between them: two SM59 HTTP destinations, a hand-written OAuth 2.0 client-credentials exchange, and a regex to unwrap Claude's system/messages response envelope. Most of the effort goes into a system prompt that constrains the model to return one fixed JSON schema of filter fields, which ABAP deserialises with /UI2/CL_JSON and exposes through a RAP custom action so a Fiori search field can drive an OData V4 filter.PranayGaroo, published 2026-06-04
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
Enhancing Business Processes with SAP BTP AI in SAP Integration SuiteEnhancing Business Processes with SAP BTP AI in SAP Integration SuiteWalks through a post-exit iflow in SAP Integration Suite that calls an LLM through SAP AI Core's Generative AI Hub to turn a customer's free-text return comment into one of a fixed set of SAP rejection-reason codes, so an inbound ORDERS05 IDoc carries a decision (E1EDP01-ABGRU) the ERP can act on without pausing for manual review. The worked example is a Commerce Cloud returns flow into S/4HANA; the piece argues the same bounded-classification pattern fits other narrative fields — delivery-exception remarks, expense-claim justifications — where the cost of an LLM call is repaid by removing a human review step, and points to a colleague's post on the Generative AI Hub orchestration workflow for the guardrailing (prompt templating, data masking) it only names.arunmaarirajha_kv, published 2025-12-15
Integrating a Custom AI Model into SAP CAP Using AI LaunchpadIntegrating a Custom AI Model into SAP CAP Using AI LaunchpadYour own model rather than a hosted one: deployed to AI Core, made callable through AI Launchpad, then reached from CAP. The case a lot of companies ask about and few posts cover.egeAksoyek, published 2026-03-20
Integrating a Custom AI Model into SAP CAP Using AI Launchpad
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
SAP Integration Suite: Intelligent Integration with AI AdapterSAP Integration Suite: Intelligent Integration with AI AdapterThe AI Adapter adds generative AI as a receiver step inside a Cloud Integration flow, connecting through either AICore-GenAIHub — a single API onto SAP AI Core's Generative AI Hub and its foundation models — or Custom-OpenAI-Rest, a plain REST call out to a provider such as OpenAI. SAP Integration Suite starts the call from the iFlow and feeds the model's response into the next step, which is the mechanics behind the sentiment-analysis, summarisation and routing use cases the piece lists without walking through any one of them.meena_choudhary, published 2026-01-28
What an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayWhat an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayA first look at SAP AI Core's Generative AI Hub from someone who builds gateways outside SAP for a living: the orchestration service harmonizes provider calls onto one API (a model name string switches providers, and SAP Note 3437766 carries the current model list, token rates and deprecation dates), runs a fixed, non-reorderable module pipeline — templating, masking through SAP Data Privacy Integration, grounding, content filtering, then the model call — and retries down an ordered fallback list whose entries can each carry their own model and rules. It places @sap-ai-sdk/orchestration among the official JavaScript, Java and Python SDKs, and notes SAP's own LiteLLM provider as a way to put a different gateway in front of it.amishkush, published 2026-09-30
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Predictive modelsSAP only
Decision Logic Modernization in SAP Integrations: Using SAP-RPT-1 for Intelligent Routing DecisionsDecision Logic Modernization in SAP Integrations: Using SAP-RPT-1 for Intelligent Routing DecisionsWalks through embedding SAP-RPT-1 — SAP's foundation model for classification and regression over tabular ERP data, hosted on SAP AI Core — into a Cloud Integration flow that picks the optimal 3PL logistics partner for an outbound delivery. The iflow sends historical deliveries from SAP HANA Cloud plus the new delivery as context rows to the model's in-context learning, with no training step, and routes on the returned prediction and confidence score, the mechanism predictive models's core coverage describes for SAP-RPT-1. The author is explicit that SAP-RPT-1 differs from general-purpose language models trained on text, which keeps this apart from an LLM-integration scenario.arunmaarirajha_kv, published 2026-02-16
SAP-RPT-1.5 Is Now Generally Available: More Accurate Predictions, Better Explainability, What's NewSAP-RPT-1.5 Is Now Generally Available: More Accurate Predictions, Better Explainability, What's NewAnnounces general availability of SAP-RPT-1.5, the next release of SAP's foundation model for predictive models over tabular enterprise data: in-context classification and regression with no training step, now with stronger accuracy on high-cardinality columns, a maximum API batch of 512 rows (up from 128), and an "explain by example" mode that surfaces the historical rows that most influenced a prediction rather than ranking feature importance alone. Two variants ship, a default model and a -large model recommended past 100 columns or where accuracy is the priority, and the post previews a coming "tabular orchestration" workflow, targeted for general availability in August 2026, that is meant to select the relevant context rows from millions of historical records automatically.RanjeetKr, published 2026-08-14
Tool governanceSAP and community
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Audit loggingSAP only
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
AuthenticationSAP and community
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
AuthorizationSAP only
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04