ServiceServiceA BTP service you subscribe to and bind, rather than install. It has plans and regions, not versions, and may deliver a product that lives outside the atlas.See every one →What this type is →by SAPby SAPPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
SAP Audit Log service
Ingests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.
Where it sits
Lives in
Provides
Audit loggingCAPBTPAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.
Serves
What it declares
Every artifact
- Type
- Service
- Origin
- By SAP
As a service
- Plans
- 1
- Regions
- 45
- Support component
- BC-CP-CF-SEC-AUDITLG
Connections
Group by
NodeRelationBasis
Functional
Audit loggingAudit loggingRecording who touched personal or sensitive data, for auditorsSAP only
provides
authored
provides Audit logging
Recording who touched personal or sensitive data, for auditors
Technical
@cap-js/audit-logging@cap-js/audit-loggingCAP integration with the SAP Audit Log servicesap official, cap
connected from
derived
connected from @cap-js/audit-logging
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
Writing the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.
“`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.”“However, it is possible to provide an own implementation that writes the audit logs to a custom store.”
CAP integration with the SAP Audit Log service
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngCAP Java plugin sending audit log events to SAP Audit Log servicesap official, cap
connected from
derived
connected from com.sap.cds:cds-feature-auditlog-ng
Emitting the audit log events of a CAP Java application to the SAP Audit Log service, in the shape of its Audit Log Event Catalog.
“The CDS plugin for SAP Audit Log service enables Java CAP applications to emit audit log events in a standardized way.”“It is fully compatible with the Audit Log Event Catalog, ensuring standardized event semantics and compatibility.”
CAP Java plugin sending audit log events to SAP Audit Log service
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngCAP Java plugin sending audit log events to SAP Audit Log servicesap official, cap
needed by
derived
needed by com.sap.cds:cds-feature-auditlog-ng
“A user-provided service instance for SAP Audit Log service created in your Cloud Foundry space”
CAP Java plugin sending audit log events to SAP Audit Log service
@cap-js/audit-logging@cap-js/audit-loggingCAP integration with the SAP Audit Log servicesap official, cap
optionally used by
derived
optionally used by @cap-js/audit-logging
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
The service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
“requires a paid-for instance of the [SAP Audit Log service for customers]”“However, it is possible to provide an own implementation that writes the audit logs to a custom store.”
CAP integration with the SAP Audit Log service
arc-1arc-1MCP server over the ADT REST API for ABAP objectsindependent, abap
optionally used by
derived
optionally used by arc-1
audit logging is configured to use the BTP Audit Log Service
sending structured audit events to the BTP Audit Log Service
“**Audit logging** — structured events to stderr, file, or BTP Audit Log Service”
MCP server over the ADT REST API for ABAP objects
com.sap.cds:cds-feature-auditlog-v2com.sap.cds:cds-feature-auditlog-v2CAP Java handler for SAP Audit Log service API version 2sap official, cap
optionally used by
derived
optionally used by com.sap.cds:cds-feature-auditlog-v2
The cds-feature-auditlog-v2 dependency is on the classpath and a binding to the SAP Audit Log service (API version 2) is provided.
The AuditLog v2 handler only activates once a service binding to the AuditLog v2 service is present in the CAP Java application.
“Also a service binding to the AuditLog v2 service has to be added to the CAP Java application, then this handler is activated.”
CAP Java handler for SAP Audit Log service API version 2
Download
Learn more
Readings
- BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13Wouter Lemaire, SAP Community
- Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23Yogananda, SAP Community
- How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07Yogananda, SAP Community
3 more
- Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25Martin Pankraz, SAP Community
- SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12anikesh_jyotishi2, SAP Community
- Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03TusharTrivedi12, SAP Community
What’s New
from SAP Help Portal, readhelp.sap.com/whats-new, SAP Audit LogSAP’s wordsOn SAP Help Portal
15 entries from to , counted per month.
Direct Audit Log Access via BTP Cockpit
Search API
Rotation of SAP Audit log root certificate
SAP Audit Log Viewer for Global Accounts
SAP Audit Log Viewer Now Automatically Enabled for All Subaccounts
Filter data by message category in Audit Log Viewer
Filter your audit log data based on categories
New filter for audit data in Retrieval API
Premium service plan is now enabled on US East (VA)
Introducing request rate limiting for the SAP Audit Log Service Retrieval API
Audit Log service storage migration
Start writing your own audit logs
Audit log Retrieval API V1 is disabled
auditlog-api is out of maintenance
Global account retrieval functionality for Feature set B
Others providing
Compare all 5 on the Audit logging page →Audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only
- com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngA CAP Java plugin that sends audit log events to the SAP Audit Log service in the format the Audit Log Event Catalog expects.sap official, capCAP Java plugin sending audit log events to SAP Audit Log service
- com.sap.cds:cds-feature-auditlog-v2com.sap.cds:cds-feature-auditlog-v2The CAP Java handler that sends the SDK's AuditLog events to the SAP Audit Log service over its API version 2, once a service binding is present.sap official, capCAP Java handler for SAP Audit Log service API version 2
- com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bomThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, capMaven bill of materials pinning CAP Java module versions
- @cap-js/audit-logging@cap-js/audit-loggingIntegration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.sap official, capCAP integration with the SAP Audit Log service
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
discovered viaSAP-samples/btp-service-metadata · btp-service-metadata
first seen in the atlas
ecosystem and domainbtp, security-and-compliance
History in the atlas
- First seen.
For your agent
- Ref
artifact:btp-audit-log- JSON
- /artifacts/btp-audit-log.json
- MCP
- Connecting an agent