NewSAP Business Technology Platform, also named SAP Business AI Platform
In the last 30 days
138 changes
Today
Audit loggingcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door.Audit logging
Authenticationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present.Authentication
Authorizationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door.Authorization
Certificate managementcore coverage, coverage by ecosystem revisedReassessed against the graph (check:capabilities): the note was an absence claim about providers; the new SAP provider btp-custom-domain is sap-official, so core-only still holds.Certificate management
Show 6 more
Documentationcore coverage, coverage by ecosystem, coverage by flavor revisedReassessed against the graph (check:capabilities): absence claims about providers go stale as providers arrive. The flavor states are unchanged.Documentation
Identity provisioningcore coverage revisedReassessed against the graph (check:capabilities): the note claimed every repository behind the entry is a sample, which stopped being true when the SAP-official service entry arrived. State stays core-only.Identity provisioning
Rate limitingcore coverage revisedReassessed against the graph (check:capabilities): API Management, an SAP-official service on the BTP door, lists CAP in serves_ecosystems and provides this capability, so the core is present for CAP beside the in-process community plugins. The relationship stays unassessed for lack of documentary evidence on the history.Rate limiting
Secrets rotationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): SAP Credential Store is sap-official and lists cap in serves_ecosystems, so SAP is present for CAP.Secrets rotation
Serve your application over MCPcoverage by ecosystem, coverage by flavor revisedReassessed against the graph (check:capabilities): the note counted providers, and sap-security-mcp no longer provides this capability. The unmapped state is unchanged.Serve your application over MCP
Vulnerability scanningecosystems, description revisedPublic feedback issue #10. CAP and UI5 coverage assessed as unmapped: no atlas artifact provides the dependency-tree check there yet.Vulnerability scanning
Sat 24
Edge Integration Cell : Design, deploy and manage APIspublishedWalks through creating an API artifact in API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPIOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.SAP and community, narrow by design specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.OpenAPI
Fri 23
Expose RFCs as MCP Tools in Integration SuitepublishedWalks through creating an MCP server in SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.Serve your application over MCP
Mon 19
🔴 Your Agent Wants to Call SAP. Now What?publishedDevtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp inside SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and Rate limitingRate limitingCapping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.SAP and community, unassessed hold. For totals across all sales orders they send the agent to SAP Business Data CloudSAP Business Data CloudSAP's umbrella over the data estate: installed intelligent content and data products, a governed catalog they are published through, and a path out to SAP Databricks.sap official, btp instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.Rate limiting
From APIs to Agent Tools: How MCP Gateway changes what Integration meanspublishedThe opening session of the Devtoberfest 2026 integration track, in which two product managers for SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp set out why the suite puts an MCP gateway between agents and backend systems, and then build one. The demo turns an HTTP endpoint and its OpenAPI specification into MCP tools on the integration cell runtime, does the same on top of an existing API-centric integration, and shows the policies tab where authentication through an external provider, quotas, spike arrest and IP filtering sit, plus the trace of the JSON-RPC calls in monitoring and the agent they are earmarked against in analytics. That is where the serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed edges hold; RFCs and BAPIs as sources are stated as supported, and MCP federation, custom domains and edge integration cell as roadmap.Serve your application over MCP
MCP Gateway in Practice: Architecture, configuration, and hands-onpublishedA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systemsAgent access to your systemsGiving an AI agent access to the business data, configuration or operations of systems you run through an MCP server. Serving your application over MCP exposes your own service contract; system access reaches the systems behind it, and one implementation may do both. Development assistance belongs to agent access to your code.SAP and community, narrow by design edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.Rate limiting
Powering Enterprise-Ready Agentic AI with SAP Integration SuitepublishedA Devtoberfest 2026 session (INT-31) from SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposureServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and the tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed the edges rest on. Three AI features inside Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.Rate limiting
Show 2 more
@marianfoo/sap-mcp-authdescription, type properties, connects revisedRe-read against the README as it stands today. "No token endpoint" and "there is no client-credentials flow to use instead" were absence claims about SAP's portals that no source makes, so they are gone and the paragraph now says what the module does and whom it serves. The maintainer's own unofficial caveat, and the origins password login refuses, are in when_not_to_use. The package block states that it is imported into the caller's own program and installed from npm. The README names Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the tenant the login goes to, which is an edge rather than a phrase in a paragraph.Authentication
Authenticationecosystems revisedui5-middleware-oidc was staged in intake-20261019-bestofui5 under ui5-build-tooling because this capability was not open on the UI5 door. The UI5 reading comes from the README of SAP's backend-proxy-middleware.Authentication
Sun 18
CAP in the age of AI #3 - from MCP to A2ApublishedThe episode that finishes @cap-js/mcp@cap-js/mcpA CAP plugin that serves an @mcp-annotated service over MCP with three generated tools, describe, query and call_action, and writes its endpoint into the local agent's configuration in development.sap official, cap with authorisation and then crosses to agents.
@requires and @restrict are the same annotations CAP already has, and the plugin reads them to filter the tool list and the describe output per user and per request, so a model is not told about entities the caller cannot reach — where the OData metadata of the same service lists every exposed entity regardless. The second half annotates a service with @agent from @cap-js/agents@cap-js/agentsSAP's own CDS plugin for building agents inside a CAP service, wired to audit logging and telemetry through peer dependencies rather than leaving observability to the author.sap official, cap, which serves it over A2A with an agent card and a chat preview, runs first against a mocked response and then against SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp bound with cds bind and a hybrid profile, and reuses the MCP adapter's tools rather than defining new ones.Serve your application over MCPSat 17
SAP-samples/digital-manufacturing-extension-samplesadded to the atlasSamples for the six extension types of SAP Digital Manufacturing
#BTP #SAPCAP: Quirky Nuggets (N03-N04)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OData
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
Show 60 more
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
Agentic AI on BTP: a Single Agent with LangGraphexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
Agentic CAP: Build MCP servers and enterprise AI agentsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
API Composition: Seamless Enterprise Data Access for Developers and AI Agentsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
Authenticationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Authentication
Authorization Management Service in SAP Cloud Identity Serviceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
BTP Audit Log MCP Server: Security Monitoring with AI Assistantsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
BTP Cloud Foundry MCP Server: Managing CF Environments with AIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication Flowexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
Dynamic authorisation with user attributes in SAP CAP and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Dynamic OData from "any" API through SAP BTP Kymaexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OData
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrievalexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Evolving the identity lifecycle for an AI-first futureexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
Exposing Calculation View with Dynamic Client via OData APIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OData
From Concept to action: Hands-On with the CAP Operator and the Partner Reference Applicationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Reference apps
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI Agentsexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based Authorizationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
HANA AI Toolkit — Local MCP Serverexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
How SAP secures enterprise AI agents with identity propagationexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
IPS provisioning to ABAP Cloud Developer Trialexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Identity provisioning
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integrationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
OData entity as a governed query surface for agents, not a toolexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).OData
OpenAPIdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.OpenAPI
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Principal Propagation from BTP Web App to S/4HANA via SAP Integration Suiteexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
RFC/BAPIs Meet AI Agents: Why SAP Integration Suite MCP Server Mattersexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features Tourexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP BTP Audit Log Access Just Got Easier - Here’s What’s Newexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP Audit log Enable and retrieve logsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approachesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP Business Technology Platform: Authorization and Trust Management Serviceexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP CAP JWT Token Flow in codeexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP IAM integration with SAP Cloud Identity Servicesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP Walkthroughexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
Secrets rotationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Secrets rotation
Secure Service Consumption Across Hyperscalersexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
Securing a CAP Node.js App with SAP AMS on BTP Cloud Foundryexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Securing CAP Applications with SAP Cloud Identity Services and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Serve your application over MCPdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Serve your application over MCP
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and Playwrightexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Swagger UI | SAP BTP Extension Generators | Hands-on Video Tutorialsexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OpenAPI
Third-Party MCP Server Access to SAP Solutions on BTPexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Serve your application over MCP
UI for the BTP Application Vulnerability Reportexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OData
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Use REST services in Graphexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).OpenAPI
Useful CAP CDS and Fiori Commands to Accelerate Development and Deploymentexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Using Postman for API Testing with XSUAAexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why developers should care about credential-types for xsuaa?explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
XSUAA Based Authentication - Using Managed Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Based Authentication - Using Standalone Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Local Testingexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Fri 16
SAP BTP Platform Technical User for CTMS IntegrationpublishedWalks through creating a technical user in Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Authentication
Thu 15
@saptools/cf-xsuaaadded to the atlasOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingAuthentication
Third-Party MCP Server Access to SAP Solutions on BTPpublishedDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Serve your application over MCP
@arc-mcp/xsuaa-authprovides[capability:authentication] revisedThe BTP door now compares its authentication options on whether the signed-in identity reaches the next system. The README's sentence about the
./btp entrypoint states it for this package, and it was read again on this date.Authentication@saptools/cf-xsuaaprovides[capability:authentication] revisedOn a capability page the edge put a token command line beside an OAuth server and an identity provider with nothing to tell them apart. The edge now says which part of the concern it answers, that it validates nothing, and states the property the BTP door compares on: a token with no user present.Authentication
Show 4 more
Authenticationcoverage by ecosystem, facets, framing by ecosystem revisedThe paragraph counted two services while seven entries stand behind the door, the router and the Cloud Connector among them, so it told a reader the door was smaller than it is.Authentication
Cloud Identity Servicesprovides[capability:authentication] revisedThe only sentence about this service was its one-liner, so the capability page listed it beside the OAuth server with nothing to tell the two apart. SAP's trust and federation page states what the service is and what a tenant's own policies cover, and the default identity provider page states the corporate identity provider behind it, which is the property the BTP door now compares on.Authentication
OAuth 2.0 on SAP BTPlifecycle, provides[capability:authentication] revisedThe BTP door now compares its authentication options on whether a token can be had with no person present. The catalogue sentence about the client credentials grant states it for this service, and it was read again on this date.Authentication
SAP Authorization and Trust Management serviceprovides[capability:authentication] revisedThe edge said only that the service answers authentication, so the page could not say which part of the concern it answers. SAP's architecture page states the three: the trust, the assertion it receives, and the token it signs. The two properties the BTP door now compares options on are stated from the same page: a token with no user present, and a corporate identity provider behind it.Authentication
Tue 13
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarpublishedWalks through pulling entries from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a
data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only entry arrive in QRadar as an offense.Audit loggingNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixpublishedWritten after the SAPwned disclosure in SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry RuntimeSAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp and SAP BTP, Kyma runtimeSAP BTP, Kyma runtimeA fully managed Kubernetes runtime on SAP BTP, based on the open-source project Kyma, where extensions to SAP solutions run as containerised microservices and serverless Functions.sap official, btp app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.Audit logging
SAP BTP Audit log Enable and retrieve logspublishedWalks through enabling and retrieving records from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.Audit logging
SAP Business Technology Platform: Authorization and Trust Management ServicepublishedWalks through how the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.Authorization
Mon 12
Configure an MCP Server Created from an HTTP EndpointpublishedDocuments configuring API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.Serve your application over MCP
Create an MCP Server for Enterprise AI AgentspublishedWraps the preceding supply-risk graph from API CompositionAPI CompositionOne API over the business data in a landscape: a business data graph queried with OData V4 or GraphQL, instead of each source system's own API.sap official, btp as an MCP server in Integration Suite, with API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Serve your application over MCP
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1publishedWalks through subscribing to the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Audit logging
Microsoft Sentinel for SAP goes agentlesspublishedExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp setup together with SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed maintenance view, with a user authorised to call them (RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design). It also covers calling the audit logAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.Audit logging
Show 2 more
API Managementprovides[mcp-servers], provides, description revisedIndependent source review supports prompts guiding agent interaction rather than templates; retains both sourced tool-count limits as an explicit MCP-specific discrepancy.Rate limiting
Serve your application over MCPcore coverage, coverage by ecosystem, core coverage, description, facets revisedThe comparison separates exposed contracts, context mechanisms, execution paths and surface selection; provider explanations retain conditions and restrictions. The capability definition and all nine provider conversions must be published together; accepting only the vocabulary leaves legacy provider strings incompatible.Serve your application over MCP
Sun 11
Agentic CAP: Build MCP servers and enterprise AI agentspublishedCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design concern, and SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp is the LLM integrationLLM integrationCalling a language model from application code with the tenant, destination and credential handling already solved instead using an SDK call with a hand-rolled key.SAP and community, narrow by design through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel HutzelDaniel Hutzelgave 3 talks, contributed to 32 entriessap official, Daniel SchlachterDaniel Schlachtercreated 9 pieces, contributed to 10 entriessap official, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.Serve your application over MCP
Evolving the identity lifecycle for an AI-first futurepublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design and Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
Future-ready access governance from SAP: Strategy and innovationpublishedStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Identity provisioning
How SAP secures enterprise AI agents with identity propagationpublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design side and the per-hop check the authorisationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar KoscheGunnar Koschegave 1 talk, contributed to 1 entry and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.Authentication
Show 4 more
Identity lifecycle and governance with SAP services and Microsoft EntrapublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
OData entity as a governed query surface for agents, not a toolpublishedAn OData entity, generated from the annotations a service already carries, as the surface an agent queries over SAP data: filterable, selectable and sortable fields, authorisation injected on the server side, and a bound query cost, instead of the entity as a tool. SAP's abstract sets this against the MCP gateway in SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp, where exposing an API is the easy part and getting an agent to pick the right one is not, which is the tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed concern read through ODataODataExposing data and operations through OData, including the service model, metadata and protocol versions clients require. Version differences affect which clients can consume a service and which query features they can use.SAP and community, narrow by design. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Aleksandr Ivanov and Evgenii Shirokikh, written here from SAP's abstract; the recording is not yet published.OData
Road map for SAP Integration Suite: What ships next across all capabilitiespublishedSAP's road map for SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp across its capability areas: API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.Rate limiting
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicespublishedThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.Authentication
Fri 9
Serve your application over MCPecosystems, name revisedThe Commerce and SuccessFactors providers reach into a system from outside and moved to agent access to your systems with their slots.Serve your application over MCP
Thu 8
btp-ui5-show-userinfoadded to the atlasUI5 app reading the signed-in user via launchpad and approuter
Wed 7
Making the Case for Enhanced REST Adapter in SAP Integration SuitepublishedCatalogues what SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's native HTTP adapter supports for authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handlingError handlingTurning a failure into a response a client can act on — protocol-correct error payloads, correlation, and a boundary between internal detail and what a caller sees.SAP and community, unassessed (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPIOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.SAP and community, narrow by design import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.Authentication
Tue 6
How to subscribe or fetch data from solace to CPI using AEM Adapter : part-5publishedCloses a series on event-driven architecture with Solace by detailing the subscriber side of an iFlow in Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp: an advanced event mesh adapter feeds an exception subprocess, and a Groovy step classifies each failure as recoverable, left to Solace's own retry, or non-recoverable, answered with a custom property that tells Solace to stop retrying before the message reaches an escalation layer. The escalation layer names email, ServiceNow and Loggly as destinations without explaining any of them.Error handling
Migration Journey from MuleSoft to SAP Integration Suite (CI)publishedMaps MuleSoft Anypoint's error handling onto SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: the Global Error Handler and MuleSoft's built-in retries become Exception Subprocesses with scripted Groovy retry logic or JMS-based retry, since Cloud Integration has no automatic equivalent. MuleSoft's searchable logger text becomes Content Modifier headers and Groovy-scripted Message Log entries, correlated by application message ID and correlation ID for traceability across complex interfaces. The mapping is drawn from the author's own migration project across assessment, development and validation phases, and is explicitly flagged as not an SAP- or MuleSoft-approved design.Error handling
Mon 5
SAP Integration Suite + MCP: A Practical Architecture for AI Agents and SAPpublishedLays out the runtime chain for exposing S/4HANA APIs to an AI agent through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: the agent calls a tool on the MCP Gateway, which is built from a governed API Artifact, which still runs on Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp for mapping, routing and error handling before reaching the backend. It states that the API-artifact approach requires the Integration Cell runtime rather than the normal CPI message-processing runtime, an OAuth-secured REST or OData artifact on OpenAPI 3.0.0-3.0.3, and an entitlement that is service-plan dependent (citing SAP Note 2903776) — so the architecture question is whether the landscape already has the right MCP entitlement, runtime and API foundation.Serve your application over MCP
Sat 3
IPS provisioning to ABAP Cloud Developer TrialpublishedWalks through provisioning users and groups from SAP Cloud Identity Services' Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Identity provisioning
Wed 30
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1publishedFirst of a three-part series on designing a CAP application on BTP that uses the platform's data privacyData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp, SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp, SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp and SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18 and Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18.Data privacy
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?publishedExplains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp already generates the SCIM ID and Global User ID in uuid format for each record.Identity provisioning
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerpublishedWalks through wiring an Identity Authentication tenant of Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp into the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Audit logging
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingpublishedOpens with the question compliance teams ask about Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.Data privacy
Show 1 more
What Happens to Your Data When You Enable SAP's AI Features?publishedTraces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration@sap-ai-sdk/orchestrationThe Orchestration Service client of SAP's AI SDK, which applies templating, grounding, filtering and masking around a model call rather than in the application.sap official, cap client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.Data privacy
Tue 29
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIpublishedSplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP serversServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-toolingAgent toolingBuilding an agent into your own application — the tools it may call, the state it keeps between turns, and the framework it runs in. Distinct from MCP servers, which expose an application to somebody else's agent, and from agent guidance, which is knowledge handed to a coding agent.SAP and community, unassessed pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integrationLLM integrationCalling a language model from application code with the tenant, destination and credential handling already solved instead using an SDK call with a hand-rolled key.SAP and community, narrow by design side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.Serve your application over MCP
Agentic AI on BTP: a Single Agent with LangGraphpublishedA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP serversServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design — OData MCP Proxyodata-mcp-proxyA config-driven proxy that turns OData and REST endpoints into MCP tools from a JSON file — no code — and runs on BTP Cloud Foundry against BTP Destinations.independent, btp, CI MCP ServerCI MCP ServerAn MCP server that exposes SAP Cloud Integration's OData APIs as tools, defined entirely in one JSON config file, so an assistant works integration content, logs and configurations in natural language.independent, btp, AI Core MCP ServerAI Core MCP ServerAn MCP server that exposes SAP AI Core's APIs as tools, defined entirely in one JSON config file for a proxy, so deployments, configurations and scenarios are managed through an assistant.independent, btp, BTP MCP ServerBTP MCP ServerBTP Core Services as MCP tools, and the only server in this corner that renders dashboards inside the chat — a subaccount overview with drill-down, a geomap of data-centre locations, consumption and users.independent, btp and BTP CF MCP ServerBTP CF MCP ServerThe Cloud Foundry V3 API on SAP BTP as MCP tools — apps, orgs, spaces, services, routes and quotas — declared in one JSON config file and run by odata-mcp-proxy.independent, btp — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.Serve your application over MCP
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIpublishedA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only — getting a user out of every system that holds them once they leave — by chaining
btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.Identity provisioningBTP Audit Log MCP Server: Security Monitoring with AI AssistantspublishedWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxyodata-mcp-proxyA config-driven proxy that turns OData and REST endpoints into MCP tools from a JSON file — no code — and runs on BTP Cloud Foundry against BTP Destinations.independent, btp, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.Serve your application over MCP
Show 3 more
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentspublishedBuilds an MCP Server artifact inside SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.Serve your application over MCP
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewpublishedAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.Audit logging
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughpublishedBuilds an MCP Server on SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's Integration Cell, in front of a Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTPOAuth 2.0 on SAP BTPOAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.sap official, btp client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.Serve your application over MCP
Mon 28
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentpublishedA command-by-command walkthrough of
@sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA CloudSAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp. cds add mta and fiori add deploy-config, from @sap/generator-fiori@sap/generator-fioriThe single entry point for generating a Fiori application — the user picks a template and the generator produces the project around it.sap official, cap, build the Cloud FoundrySAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.AuthorizationSun 27
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!publishedWalks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.Authentication
Audit loggingcore coverage revisedcapire audit 2026-09-27: a page this capability owns was cited nowhere.Audit logging
Authenticationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: the security overview and the product security overview were cited nowhere; the first carries a boundary SAP draws itself.Authentication
Authorizationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: a page this capability owns was cited nowhere.Authorization
Show 3 more
Data privacycore coverage revisedcapire audit 2026-09-27, judgement pages read a fifth time: the description says data privacy is doing what the law requires, and the security index's table calls data privacy a legal concept and data protection a suite of security measures; the row is quotable as written.Data privacy
Documentationcore coverage revisedPackage pass 2026-09-27: the capability had no paragraph and no source at all.Documentation
Serve your application over MCPcore coverage revisedcapire audit 2026-09-27, link-only pages read a fourth time: MCP services are one of the three things SAP frames as CAP's native AI support, in the one sentence the section's index says of its own.Serve your application over MCP
Sat 26
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDpublishedA step-by-step configuration walkthrough for wiring SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the trust and user-correlation layer behind SAP Task CenterSAP Task CenterOne inbox across SAP applications: tasks from S/4HANA, SuccessFactors, Ariba and BTP workflows in one list, with a public API for a custom task provider.sap official, btp: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp jobs, and the principal-propagation trust the cloud connectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp needs to pass it through to an on-premise task provider.Authentication