NewSAP Business Technology Platform, also named SAP Business AI Platform
In the last 90 days
205 changes
Today
Audit loggingcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door.Audit logging
Authenticationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present.Authentication
Authorizationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door.Authorization
Certificate managementcore coverage, coverage by ecosystem revisedReassessed against the graph (check:capabilities): the note was an absence claim about providers; the new SAP provider btp-custom-domain is sap-official, so core-only still holds.Certificate management
Show 5 more
Documentationcore coverage, coverage by ecosystem, coverage by flavor revisedReassessed against the graph (check:capabilities): absence claims about providers go stale as providers arrive. The flavor states are unchanged.Documentation
Identity provisioningcore coverage revisedReassessed against the graph (check:capabilities): the note claimed every repository behind the entry is a sample, which stopped being true when the SAP-official service entry arrived. State stays core-only.Identity provisioning
Rate limitingcore coverage revisedReassessed against the graph (check:capabilities): API Management, an SAP-official service on the BTP door, lists CAP in serves_ecosystems and provides this capability, so the core is present for CAP beside the in-process community plugins. The relationship stays unassessed for lack of documentary evidence on the history.Rate limiting
Secrets rotationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): SAP Credential Store is sap-official and lists cap in serves_ecosystems, so SAP is present for CAP.Secrets rotation
Vulnerability scanningecosystems, description revisedPublic feedback issue #10. CAP and UI5 coverage assessed as unmapped: no atlas artifact provides the dependency-tree check there yet.Vulnerability scanning
Mon 19
🔴 Your Agent Wants to Call SAP. Now What?publishedDevtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp inside SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and Rate limitingRate limitingCapping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.SAP and community, unassessed hold. For totals across all sales orders they send the agent to SAP Business Data CloudSAP Business Data CloudSAP's umbrella over the data estate: installed intelligent content and data products, a governed catalog they are published through, and a path out to SAP Databricks.sap official, btp instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.Rate limiting
MCP Gateway in Practice: Architecture, configuration, and hands-onpublishedA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systemsAgent access to your systemsGiving an AI agent access to the business data, configuration or operations of systems you run through an MCP server. Serving your application over MCP exposes your own service contract; system access reaches the systems behind it, and one implementation may do both. Development assistance belongs to agent access to your code.SAP and community, narrow by design edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.Rate limiting
Powering Enterprise-Ready Agentic AI with SAP Integration SuitepublishedA Devtoberfest 2026 session (INT-31) from SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposureServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and the tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed the edges rest on. Three AI features inside Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.Rate limiting
@marianfoo/sap-mcp-authdescription, type properties, connects revisedRe-read against the README as it stands today. "No token endpoint" and "there is no client-credentials flow to use instead" were absence claims about SAP's portals that no source makes, so they are gone and the paragraph now says what the module does and whom it serves. The maintainer's own unofficial caveat, and the origins password login refuses, are in when_not_to_use. The package block states that it is imported into the caller's own program and installed from npm. The README names Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the tenant the login goes to, which is an edge rather than a phrase in a paragraph.Authentication
Show 1 more
Authenticationecosystems revisedui5-middleware-oidc was staged in intake-20261019-bestofui5 under ui5-build-tooling because this capability was not open on the UI5 door. The UI5 reading comes from the README of SAP's backend-proxy-middleware.Authentication
Sat 17
SAP-samples/digital-manufacturing-extension-samplesadded to the atlasSamples for the six extension types of SAP Digital Manufacturing
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Show 40 more
API Composition: Seamless Enterprise Data Access for Developers and AI Agentsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
Authenticationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Authentication
Authorization Management Service in SAP Cloud Identity Serviceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Dynamic authorisation with user attributes in SAP CAP and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrievalexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Evolving the identity lifecycle for an AI-first futureexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
From Concept to action: Hands-On with the CAP Operator and the Partner Reference Applicationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Reference apps
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based Authorizationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
How SAP secures enterprise AI agents with identity propagationexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
IPS provisioning to ABAP Cloud Developer Trialexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Identity provisioning
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integrationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Principal Propagation from BTP Web App to S/4HANA via SAP Integration Suiteexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features Tourexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP BTP Audit Log Access Just Got Easier - Here’s What’s Newexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP Audit log Enable and retrieve logsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approachesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP Business Technology Platform: Authorization and Trust Management Serviceexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP CAP JWT Token Flow in codeexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP IAM integration with SAP Cloud Identity Servicesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Secrets rotationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Secrets rotation
Secure Service Consumption Across Hyperscalersexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
Securing a CAP Node.js App with SAP AMS on BTP Cloud Foundryexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Securing CAP Applications with SAP Cloud Identity Services and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and Playwrightexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Useful CAP CDS and Fiori Commands to Accelerate Development and Deploymentexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Using Postman for API Testing with XSUAAexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why developers should care about credential-types for xsuaa?explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
XSUAA Based Authentication - Using Managed Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Based Authentication - Using Standalone Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Local Testingexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Fri 16
SAP BTP Platform Technical User for CTMS IntegrationpublishedWalks through creating a technical user in Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Authentication
Thu 15
@saptools/cf-xsuaaadded to the atlasOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingAuthentication
@arc-mcp/xsuaa-authprovides[capability:authentication] revisedThe BTP door now compares its authentication options on whether the signed-in identity reaches the next system. The README's sentence about the
./btp entrypoint states it for this package, and it was read again on this date.Authentication@saptools/cf-xsuaaprovides[capability:authentication] revisedOn a capability page the edge put a token command line beside an OAuth server and an identity provider with nothing to tell them apart. The edge now says which part of the concern it answers, that it validates nothing, and states the property the BTP door compares on: a token with no user present.Authentication
Authenticationcoverage by ecosystem, facets, framing by ecosystem revisedThe paragraph counted two services while seven entries stand behind the door, the router and the Cloud Connector among them, so it told a reader the door was smaller than it is.Authentication
Show 3 more
Cloud Identity Servicesprovides[capability:authentication] revisedThe only sentence about this service was its one-liner, so the capability page listed it beside the OAuth server with nothing to tell the two apart. SAP's trust and federation page states what the service is and what a tenant's own policies cover, and the default identity provider page states the corporate identity provider behind it, which is the property the BTP door now compares on.Authentication
OAuth 2.0 on SAP BTPlifecycle, provides[capability:authentication] revisedThe BTP door now compares its authentication options on whether a token can be had with no person present. The catalogue sentence about the client credentials grant states it for this service, and it was read again on this date.Authentication
SAP Authorization and Trust Management serviceprovides[capability:authentication] revisedThe edge said only that the service answers authentication, so the page could not say which part of the concern it answers. SAP's architecture page states the three: the trust, the assertion it receives, and the token it signs. The two properties the BTP door now compares options on are stated from the same page: a token with no user present, and a corporate identity provider behind it.Authentication
Tue 13
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarpublishedWalks through pulling entries from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a
data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only entry arrive in QRadar as an offense.Audit loggingNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixpublishedWritten after the SAPwned disclosure in SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry RuntimeSAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp and SAP BTP, Kyma runtimeSAP BTP, Kyma runtimeA fully managed Kubernetes runtime on SAP BTP, based on the open-source project Kyma, where extensions to SAP solutions run as containerised microservices and serverless Functions.sap official, btp app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.Audit logging
SAP BTP Audit log Enable and retrieve logspublishedWalks through enabling and retrieving records from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.Audit logging
SAP Business Technology Platform: Authorization and Trust Management ServicepublishedWalks through how the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.Authorization
Mon 12
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1publishedWalks through subscribing to the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Audit logging
Microsoft Sentinel for SAP goes agentlesspublishedExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp setup together with SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed maintenance view, with a user authorised to call them (RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design). It also covers calling the audit logAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.Audit logging
API Managementprovides[mcp-servers], provides, description revisedIndependent source review supports prompts guiding agent interaction rather than templates; retains both sourced tool-count limits as an explicit MCP-specific discrepancy.Rate limiting
Sun 11
Evolving the identity lifecycle for an AI-first futurepublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design and Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
Future-ready access governance from SAP: Strategy and innovationpublishedStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Identity provisioning
How SAP secures enterprise AI agents with identity propagationpublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design side and the per-hop check the authorisationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar KoscheGunnar Koschegave 1 talk, contributed to 1 entry and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.Authentication
Identity lifecycle and governance with SAP services and Microsoft EntrapublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
Show 2 more
Road map for SAP Integration Suite: What ships next across all capabilitiespublishedSAP's road map for SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp across its capability areas: API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.Rate limiting
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicespublishedThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.Authentication
Thu 8
btp-ui5-show-userinfoadded to the atlasUI5 app reading the signed-in user via launchpad and approuter
Wed 7
Making the Case for Enhanced REST Adapter in SAP Integration SuitepublishedCatalogues what SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's native HTTP adapter supports for authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handlingError handlingTurning a failure into a response a client can act on — protocol-correct error payloads, correlation, and a boundary between internal detail and what a caller sees.SAP and community, unassessed (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPIOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.SAP and community, narrow by design import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.Authentication
Sat 3
IPS provisioning to ABAP Cloud Developer TrialpublishedWalks through provisioning users and groups from SAP Cloud Identity Services' Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Identity provisioning
Wed 30
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1publishedFirst of a three-part series on designing a CAP application on BTP that uses the platform's data privacyData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp, SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp, SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp and SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18 and Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18.Data privacy
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?publishedExplains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp already generates the SCIM ID and Global User ID in uuid format for each record.Identity provisioning
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerpublishedWalks through wiring an Identity Authentication tenant of Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp into the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Audit logging
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingpublishedOpens with the question compliance teams ask about Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.Data privacy
Show 1 more
What Happens to Your Data When You Enable SAP's AI Features?publishedTraces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration@sap-ai-sdk/orchestrationThe Orchestration Service client of SAP's AI SDK, which applies templating, grounding, filtering and masking around a model call rather than in the application.sap official, cap client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.Data privacy
Tue 29
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIpublishedA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only — getting a user out of every system that holds them once they leave — by chaining
btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.Identity provisioningSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewpublishedAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.Audit logging
Mon 28
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentpublishedA command-by-command walkthrough of
@sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA CloudSAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp. cds add mta and fiori add deploy-config, from @sap/generator-fiori@sap/generator-fioriThe single entry point for generating a Fiori application — the user picks a template and the generator produces the project around it.sap official, cap, build the Cloud FoundrySAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.AuthorizationSun 27
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!publishedWalks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.Authentication
Audit loggingcore coverage revisedcapire audit 2026-09-27: a page this capability owns was cited nowhere.Audit logging
Authenticationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: the security overview and the product security overview were cited nowhere; the first carries a boundary SAP draws itself.Authentication
Authorizationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: a page this capability owns was cited nowhere.Authorization
Show 2 more
Data privacycore coverage revisedcapire audit 2026-09-27, judgement pages read a fifth time: the description says data privacy is doing what the law requires, and the security index's table calls data privacy a legal concept and data protection a suite of security measures; the row is quotable as written.Data privacy
Documentationcore coverage revisedPackage pass 2026-09-27: the capability had no paragraph and no source at all.Documentation
Sat 26
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDpublishedA step-by-step configuration walkthrough for wiring SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the trust and user-correlation layer behind SAP Task CenterSAP Task CenterOne inbox across SAP applications: tasks from S/4HANA, SuccessFactors, Ariba and BTP workflows in one list, with a public API for a custom task provider.sap official, btp: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp jobs, and the principal-propagation trust the cloud connectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp needs to pass it through to an on-premise task provider.Authentication
Fri 25
@marianfoo/sap-mcp-authadded to the atlasBrowser login and session module for SAP MCP serversAuthentication
@marianfoo/sap-mcp-authentry revisedEntered with the three servers of the same monorepo that name it. It publishes on its own and answers a question of its own — how a tool outside SAP gets an authenticated session against an SAP portal — so it is an entry rather than an implementation detail of the three.Authentication
Tue 22
API Composition: Seamless Enterprise Data Access for Developers and AI AgentspublishedAPI CompositionAPI CompositionOne API over the business data in a landscape: a business data graph queried with OData V4 or GraphQL, instead of each source system's own API.sap official, btp (formerly Graph, a capability of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP serversServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design coverage.Rate limiting
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphpublishedA hands-on walkthrough of Graph, the API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp feature of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp Content Enricher would otherwise merge.Rate limiting
Information Map – Introduction Series: Graph in SAP Integration SuitepublishedIntroduces Graph, an enhancement to API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp within SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.Rate limiting
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSpublishedPart 4 of a five-part beginner series on API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rate limiting
Show 1 more
SAP Authorization and Trust Management serviceconnects[0] revisedThe second reader read the connects batch of 2026-09-19 on 2026-09-22, after its acceptance, and found: neither quote names this service, and only one names Cloud Identity Services, so the page's title, which names both parties, is quoted beside them.Authentication
Sun 20
API Managementadded to the atlasAPI proxies with security and traffic policies and Developer HubRate limiting
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationpublishedA central BTP application that manages Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp and SAP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.Authentication
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitepublishedWalks through configuring principal propagation from a BTP web app, through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp and Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp uses OAuth2JWTBearer to exchange the user's Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Authentication
API Managementprovides revisedMoved here from SAP Integration Suite. SAP files MCP Server under API Management in its documentation, and every creation path read lists the activated API Management capability as a prerequisite.Rate limiting
Show 1 more
Authorizationcore coverage revisedTwo independent artifacts provide this on CAP beside the SAP-official ones: cds-entra-id (vobu) and cap-toolkit (eyupbaycol). The state says who is present, so core-only no longer held. relationship is unassessed: no retrieved document gives the history between them and the core.Authorization
Sat 19
🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetpublishedSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning ServiceSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Identity provisioning
abap_cloud_platformadded to the atlasTypeScript library reaching ABAP service instances on Cloud FoundryAuthentication
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourpublishedA features tour of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limitingRate limitingCapping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.SAP and community, unassessed's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rate limiting
SAP Authorization and Trust Management serviceconnects revisedThe two security services had no edge between them, although most BTP diagrams draw one. SAP's administration guide states the trust and the protocol it is established with.Authentication
Show 1 more
SAP Cloud Identity Services - Identity Provisioningpart of revisedSAP's catalogue names Identity Provisioning as one of the services SAP Cloud Identity Services include. The first
part_of on an artifact.Identity provisioningFri 18
@arc-mcp/xsuaa-authadded to the atlasXSUAA authentication stack for an MCP server on SAP BTPAuthentication
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationpublishedWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp (IAS) and SAP Cloud LoggingSAP Cloud LoggingAn instance-based observability service built on OpenSearch that stores and analyses logs, metrics and traces from Cloud Foundry, Kyma, Kubernetes and other runtime environments.sap official, btp so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Authentication
sap-api-hub-mcpadded to the atlasRead-only MCP server over the SAP Business Accelerator HubDocumentation
sap-note-search-mcpadded to the atlasMCP server searching and fetching SAP Notes and KBAsDocumentation
Show 4 more
sap-roadmap-mcpadded to the atlasMCP server over SAP Road Map ExplorerDocumentation
sap-api-hub-mcpentry revisedThe SAP API Policy Evidence SkillSAP API Policy Evidence SkillAssesses whether a described SAP API usage aligns with the SAP API Policy, gathering live evidence from SAP's own sources and returning a sourced assessment with a stated confidence — and routing the legal questions away from itself.independent, btp was entered on 2026-09-10 naming this server as what proves an API's Published-API status, and the server itself was not in the corpus. Entered as its own package, from its own README, because the monorepo publishes each server to npm independently.Documentation
sap-note-search-mcpentry revisedThe decline recorded for candidate:marianfoo/mcp-sap-notes on 2026-09-10 named this as the successor and as an open gap: "SAP Notes search is a real gap in the corpus and the thing that fills it has to be found some other way." Entered from the monorepo package rather than the archived repository, and from the package's own README.Documentation
sap-roadmap-mcpentry revisedNamed in the SAP API Policy Evidence SkillSAP API Policy Evidence SkillAssesses whether a described SAP API usage aligns with the SAP API Policy, gathering live evidence from SAP's own sources and returning a sourced assessment with a stated confidence — and routing the legal questions away from itself.independent, btp's prerequisites as the source for replacement APIs, and absent from the corpus. Entered as its own package, from its own README, because the monorepo publishes each server to npm independently.Documentation
Tue 15
Application Vulnerability Reportadded to the atlasTracks vulnerabilities in open-source components of BTP appsVulnerability scanning
Before You Upgrade S/4HANA: Static UI5 Checks with MCPpublishedA UI5 version upgrade checked against one app by pairing two MCP servers: the
ui5_version_diff tool added to mcp-sap-docsmcp-sap-docsAn MCP server over seventeen cloned SAP documentation repositories — ABAP keyword docs, capire, OpenUI5, Cloud SDK, BTP — searched with BM25 and prebuilt embeddings fused by reciprocal rank fusion.independent, cap, which reads a bundle from ui5-lib-diff downloaded once at setup and filters it by version range, change type, library or query text, and @ui5/mcp-server@ui5/mcp-serverSAP's MCP server for UI5 development: ten tools that scaffold an app or a card, read the project in front of the agent, and run the linter and the manifest validator against it.sap official, ui5, whose get_project_info, get_version_info, run_ui5_linter and run_manifest_validation say what the app uses and what fails. Run with a ui5-versions-upgrade.md skill on the legacy app from From SEGW and Legacy UI5 to RAP with ARC-1From SEGW and Legacy UI5 to RAP with ARC-1Three ARC-1 skills, run in Cursor with Composer-2 against a deliberately rough demo on an S/4HANA 2023 trial system, turn the SEGW service ZDEMO_MIG_PROJECTS_SRV into a managed, draft-enabled RAP business object published as OData V4, replace its ApproveProject function import and its direct UPDATE ... COMMIT WORK with the action approve_project written in EML in local mode, and rebuild the freestyle UI5 JavaScript app once in UI5 TypeScript and once as a Fiori elements list report and object page driven by metadata extensions. What the published transcripts add is how the agent got there: it found the generated MPC class names and the custom logic in DPC_EXT only by reading the system, the skills made it print the extracted model and stop for confirmation before writing, and @ui5/mcp-server, mcp-sap-docs and @sap-ux/fiori-mcp-server each had their own job beside it. The demo is small on purpose, and the post says a productive SEGW service that calls BAPIs, carries custom authorisation logic or supports deep inserts is not solved with one prompt.published 2026-05-11, from SAPUI5 1.84.59 to 1.147.2, the diff range held 985 deprecations and 961 What's New entries, and the lintingLintingCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.SAP and community, narrow by design and manifest validation narrowed that to findings in this app, among them jQuery.sap.require, synchronous bootstrap, the sap_belize theme, sap.m.MessagePage and an old manifest _version. The checks read the source in a local checkout and never the deployed app, so the report is a first pass: a changelog entry is not proof that a workaround can be deleted, and the app still has to be run and tested.DocumentationFinally: An MCP Server for ABAPpublishedAnnounces the ABAP variant of mcp-sap-docsmcp-sap-docsAn MCP server over seventeen cloned SAP documentation repositories — ABAP keyword docs, capire, OpenUI5, Cloud SDK, BTP — searched with BM25 and prebuilt embeddings fused by reciprocal rank fusion.independent, cap, published at mcp-abap.marianzeis.de for GitHub CopilotGitHub CopilotAn AI coding assistant built into GitHub, with agents that can use external tools and MCP servers.'s Agent Mode in ADT for Eclipse, which the post names as the trigger, with ABAP knowledge still a recurring problem in the models. Documentation irrelevant to ABAP was removed from the SAP docs server and the ABAP Keyword Documentation, the DSAG ABAP Development Guidelines and the ABAP Style Guide were added, with search reaching past the local index to SAP Community posts and SAP Help. Copilot in Eclipse is where the post puts the weight, because SAP Joule for Developers, ABAP AI capabilitiesSAP Joule for Developers, ABAP AI capabilitiesSAP's AI for ABAP development in ADT for Eclipse and VS Code: chat, code completion, explain, test and CDS generation, RAP logic prediction, and since June 2026 an agentic mode over the ADT MCP Server, metered in AI units through the ABAP AI Hub Service on BTP.sap official, abap in Eclipse is not available for S/4HANA on-premise systems; an update of 2026-02-05 adds Software Heroes as an online source and an
abap_feature_matrix tool that checks feature availability across releases and ABAP Cloud, and the server runs hosted or locally with Node or Docker.DocumentationOAuth 2.0 on SAP BTPadded to the atlasOAuth 2.0 grant flows for applications and APIs in Neo regionsAuthentication
Show 13 more
SAP Cloud Identity Services - Identity Provisioningadded to the atlasProvisioning jobs carrying users and groups between systemsIdentity provisioning
SAP Custom Domain Serviceadded to the atlasServes BTP applications under the customer's own domainCertificate management
SAP Customer Identity and Access Management for B2Cadded to the atlasRegistration, login and consent for customer-facing sitesAuthentication
SAP Data Privacy Integrationadded to the atlasAPIs for retention, deletion and personal data reportsData privacy
SAP Data Retention Manageradded to the atlasRetention rules triggering blocking, deletion and archivingData privacy
SAP Keystore Serviceadded to the atlasKey and certificate repository in SAP BTP's Neo data centresEncryption and signing
SAP Personal Data Manageradded to the atlasService answering data subjects about their stored personal dataData privacy
SAP/architecture-centeradded to the atlasSource repository of SAP's reference architectures
Secure Service Consumption Across HyperscalerspublishedSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.Authentication
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDpublishedSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design draws on BTP: the identity behind the token, not what it is then allowed to do.Authentication
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDpublishedAPI Management in SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.Authentication
Data privacyecosystems, coverage by ecosystem, framing by ecosystem revisedOn BTP the concern is a set of APIs and apps an application connects to, which differs from the CAP framing of annotations on a model and the ABAP framing of anonymising non-production copies.Data privacy
Encryption and signingecosystems, coverage by ecosystem, framing by ecosystem revisedOn BTP the service holds the keys and the application does the operation, which is a different emphasis from the ABAP SSF library.Encryption and signing
Mon 14
analytics-cloud-scim-api-samplesadded to the atlasPostman collections for the SAP Analytics Cloud SCIM API
hana-shine-xsaadded to the atlasSHINE demo application for learning SAP HANA XS Advanced
s4hana-hana-audit-policiesadded to the atlasSQL templates for HANA audit policies of an S/4HANA tenantAudit logging
sap-concur-user-provisioning-service-apisadded to the atlasPostman collection for the SAP Concur User Provisioning Service APIs
Show 11 more
SAP-samples/concur-joule-ips-jobsadded to the atlasIdentity Provisioning jobs syncing SAP Concur users for Joule
teched2022-XP260added to the atlasTechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vadded to the atlasHands-on applying SAP BTP security recommendations to a trial account
teched2025-XP261added to the atlasHands-on integrating Cloud Identity Services with Microsoft Entra
Audit loggingecosystems revisedSAP-samples' s4hana-hana-audit-policies defines HANA audit policies for the database tenant under S/4HANA, recording security-relevant actions at database level, the same concern one layer below the application.Audit logging
Authenticationecosystems revisedabap_jwt_generator, abapOAuthAzure, abap2oauth2, abapNTLM and abap-aws-sigv4 in this batch authenticate an ABAP system to external APIs with JWT, OAuth 2.0, NTLM and AWS Signature v4, and abap-pwnedpasswords checks a password against a breach list, so the concern is decided on the ABAP door.Authentication
Authorizationecosystems revisedsap-usi-authority-check in this batch is an ABAP class that checks whether the user may run the current transaction, which is this concern on the ABAP door.Authorization
Data privacyecosystems revisedWidened to ABAP: vlutsas/DST anonymises PII and PHI irreversibly in non-production SAP systems, from a template the user maintains.Data privacy
Documentationcoverage by flavor revisedThe only UI5-ecosystem artifact that states web-components in its flavors is ui5-webcomponents-mcp-server, sap-official, and no other UI5-ecosystem provider of this capability names the flavor at all — core-only per the reading rule. framing_by_flavor was left unset: framing_by_ecosystem.ui5 already describes this same artifact, and it already reads as the web-components flavor's own paragraph rather than a cross-flavor one, so a second copy would restate it rather than say something different.Documentation
Malware scanningcoverage by ecosystem revisedOnly SAP Malware Scanning serviceSAP Malware Scanning serviceScans an uploaded file over a REST call, with ClamAV behind it — the check an attachments plugin runs before a file is served back.sap official, btp provides this capability, and its own ecosystem is btp, not cap — it serves CAP rather than being one of CAP's own providers. With no own CAP provider, CAP's map borrows the BTP reading rather than asserting a separate community answer.Malware scanning
Secrets rotationecosystems revisedIts only provider is the BTP Credential Store, which serves CAP, so BTP is the door whose own answer this is (docs/DOORS.md D9.3). The BTP reading becomes the core reading; the CAP assessment moves to coverage_by_ecosystem.cap unchanged.Secrets rotation
Sun 13
btp-service-metadataadded to the atlasMachine-readable catalogue of SAP BTP pay-as-you-go services
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalpublishedEffective June 30th 2026, the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Authorization
SAP-samples/ams-samples-javaadded to the atlasJava apps showing policy-based authorization with AMS on SAP BTP
SAP-samples/ams-samples-nodeadded to the atlasNode.js apps showing policy-based authorization with AMS on SAP BTP
Show 1 more
Documentationdescription revisedWidened rather than forked into abap-code-documentation: producing a document of a custom package is the same concern from the writing side. The ABAP coverage moved from community-only to core-and-community because ADT's ABAP Doc export is the core's answer for custom code. Done so abap-doc (staged in intake-20260913-mariokernich) can provide it.Documentation
Fri 11
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2publishedWalks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level
@PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Data privacy#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3publishedThird of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Data privacy
mcp-sap-docsdescription revisedCorrected against the README: its offline-sources table lists seventeen repositories, abap-docs-standard through wdi5.Documentation
Thu 10
sap-ai-docs-mcpadded to the atlasMCP server with semantic search over SAP AI Core documentationDocumentation
sap-btp-docs-mcpadded to the atlasMCP server with semantic search over SAP BTP documentationDocumentation
Cloud Identity Servicesserves ecosystems revisedABAP authorisation is authorisation objects and roles, a different concern that an identity service does not answer, and on UI5 token validation happens in the router or the service rather than in the frontend. Listed behind both doors, it grouped under nothing on either.Authentication
Documentationecosystems revisedArtifacts that answer this concern sat behind the ABAP door with no tile to appear under, so browse counted them and rendered nothing. The concern is one a ABAP developer actually decides there, which is the test for opening a door rather than trimming a serves claim.Documentation
Show 3 more
SAP Authorization and Trust Management serviceserves ecosystems revisedThe same as Cloud Identity Services: ABAP's authorisation model is not XSUAA's, and a UI5 frontend does not validate the JWT — the router and the service do.Authentication
sap-ai-docs-mcpentry revisedTriaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README.Documentation
sap-btp-docs-mcpentry revisedTriaged out of data/crawled/mcp-candidates.json, the sap-ai-mcp-servers sweep. Written from the repository's own README.Documentation
Wed 9
Cloud Identity Servicesadded to the atlasIdentity Authentication and Identity Provisioning as one tenantAuthentication
mcp-sap-docsadded to the atlasMCP server searching seventeen SAP documentation repositoriesDocumentation
SAP Audit Log serviceadded to the atlasIngests and retains compliance audit data from BTPAudit logging
SAP Authorization and Trust Management serviceadded to the atlasOAuth server issuing JWTs and holding scopes for BTP appsAuthentication
Show 7 more
SAP Credential Storeadded to the atlasVault for an application's passwords, keys and keyringsSecrets rotation
SAP Malware Scanning serviceadded to the atlasScans uploaded files over REST with ClamAVMalware scanning
Audit loggingecosystems revisedThe BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install.Audit logging
Authenticationecosystems revisedThe BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install.Authentication
Authorizationecosystems revisedThe BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install.Authorization
Documentationcore coverage, ecosystems revisedAn SAP-published MCP server entered from the sap-ai-mcp-servers catalogue answers this concern on the UI5 door, and the door had no tile for it to sit under.Documentation
mcp-sap-docsentry revisedNamed in docs/NEIGHBOURS.md §3.1 as a project of the bestofcapjs author but never entered. It is a documentation retrieval server, not an index of options — the complement posture the same section assigns ARC-1, and hard rule 5 makes it exist here only as an attached entry.Documentation
Tue 8
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instancepublishedOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.Authorization
Authorization Management Service in SAP Cloud Identity ServicepublishedStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.Authorization
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPpublishedAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Authorization
From Concept to action: Hands-On with the CAP Operator and the Partner Reference ApplicationpublishedThe CAP Operator applied to a real application rather than a sample of its own — SAP's Partner Reference Application, taken from plugin integration through containerisation to custom resources. The transition to CRDs is the part that repays attention: it is where the deployment stops being an mta and becomes Kubernetes.Reference apps
Show 12 more
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIpublishedThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.Authorization
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021publishedA year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.Authorization
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachespublishedTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads
req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.AuthorizationSAP CAP JWT Token Flow in codepublishedOne question, answered precisely: at what point does the JWT exist and how does it end up on
req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.AuthenticationSAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)publishedCalling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and
$XSSERVICENAME has to match the scheduler's own instance name.AuthorizationSecuring CAP Applications with SAP Cloud Identity Services and AMSpublishedIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.Authorization
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.publishedThe long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, cap and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.Authorization
Using Postman for API Testing with XSUAApublishedA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.Authorization
Why developers should care about credential-types for xsuaa?publishedRotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.Authorization
XSUAA Based Authentication - Using Managed ApprouterpublishedOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.Authorization
XSUAA Based Authentication - Using Standalone ApprouterpublishedThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.Authorization
XSUAA Local TestingpublishedAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.Authorization
Mon 7
Dynamic authorisation with user attributes in SAP CAP and AMSpublishedThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.Authorization
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationpublishedWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Authorization
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrypublishedThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Authorization
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightpublishedClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.Authentication
Sun 6
SAP IAM integration with SAP Cloud Identity ServicespublishedIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design here says about Cloud Identity Services.Authentication
Mon 31
Audit loggingcore coverage revisedStates renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately.Audit logging
Authenticationcore coverage revisedStates renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately.Authentication
Authorizationcore coverage revisedStates renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately.Authorization
Data privacycore coverage revisedStates renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately.Data privacy