CDS pluginCDS plugintypeInstalls into a CAP project and extends the runtime. CAP loads it through cds.requires or the plugin hook.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
@cap-js/audit-logging
Integration with the SAP Audit Log serviceSAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.
LoggingCAPLoggingcapabilitySeeing what a running service did, in a form something can read afterwards — levels, a formatter that suits a laptop and one that suits a log service.Audit loggingCAPAudit loggingcapabilityRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.
@sap/cds≥ 9@sap/cdsartifactThe peer range, as published.
Optional
SAP Audit Log serviceSAP Audit Log serviceartifactThe service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Who is behind it
SAP Cloud Application Programming ModelSAP Cloud Application Programming ModelOrganisationMaintains this In the atlas: maintains 34@cap-jsmaintainerAjinkya PatilPersonContributes to this In the atlas: contributes to 112@ajinkyapatil8190Arley Triana MorinPersonContributes to this In the atlas: contributes to 9, wrote 1@arleytmChristian GeorgiPersonContributes to this In the atlas: maintains 1, contributes to 53@chgeoChristian SchüringsPersonContributes to this In the atlas: contributes to 25@cschueringsDaniel HutzelPersonContributes to this In the atlas: contributes to 32, wrote 3@danjoaDr. David A. KunzPersonContributes to this In the atlas: contributes to 16@David-KunzGuilherme DellagustinPersonContributes to this In the atlas: contributes to 27@dellagustin-sapNikolay GrechanovPersonContributes to this In the atlas: contributes to 1@grenikHeiko WitteborgPersonContributes to this In the atlas: contributes to 18@hm23Johannes VogelPersonContributes to this In the atlas: contributes to 25@johannes-vogel25 contributors
Before choosing this
crawled
Conditions
LicenceSAP Developer License Agreement 3.2 CAP§ 1, 2, 3A cds-plugin is used with SAP CAP materials, or an artifact is explicitly identified as a CAP plugin or application.
Derived: the instrument's applicability matches this artifact, checked
§ 1License. Productive customer applications are limited to SAP BTP or another SAP-licensed platform, and mass extraction to a non-SAP product is restricted except where solely required for SAP interoperability.
§ 2Intellectual Property. The agreement retains SAP's rights in the covered materials and limits making APIs, tools or software available to third parties, while preserving ownership of customer applications subject to SAP's underlying rights.
§ 3Artificial Intelligence Training. The agreement prohibits use of the covered materials and customer applications for training artificial-intelligence models or systems.
declared, How the plugin is installed into a CAP project, as its documentation says., read npm add @cap-js/audit-logging — @cap-js/audit-logging — README, 2026-10-18
Connections4
Group by
NodeRelationConditionBasis
Functional2
Audit loggingAudit loggingcapabilityRecording who touched personal or sensitive data, for auditorsSAP only
→provides
none
authored
provides Audit logging
Functional, authored
Recording who touched personal or sensitive data, for auditors
LoggingLoggingcapabilitySeeing what a running service did, in a readable formSAP only
→provides
none
authored
provides Logging
Functional, authored
Seeing what a running service did, in a readable form
Technical2
SAP Audit Log serviceSAP Audit Log serviceserviceIngests and retains compliance audit data from BTPsap official, btp
→connects to
if The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead
connects to SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
Writing the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.
Basis
“`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.”@cap-js/audit-logging — README, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
stated
connects to SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
Writing the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.
Basis
“`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.”@cap-js/audit-logging — README, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
Ingests and retains compliance audit data from BTP
SAP Audit Log serviceSAP Audit Log serviceserviceIngests and retains compliance audit data from BTPsap official, btp
→optionally needs
if The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead
optionally needs SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
The service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Basis
“requires a paid-for instance of the [SAP Audit Log service for customers]”cap-js/audit-logging — README, In Production, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
stated
optionally needs SAP Audit Log service
Technical, stated
If
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
For
The service the shipped integration writes audit logs to in production, which the README says needs a paid-for instance; an own implementation may write to a custom store instead.
Basis
“requires a paid-for instance of the [SAP Audit Log service for customers]”cap-js/audit-logging — README, In Production, checked “However, it is possible to provide an own implementation that writes the audit logs to a custom store.”cap-js/audit-logging — README, In Production, checked
Ingests and retains compliance audit data from BTP
Derived from the package name. No recipe recorded; the README has the configuration.
Learn more2
Readings
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsblogWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09gopalanand, SAP Community
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationblogThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01KrishnaSharma7, SAP Community
What changed
v1.3.0
Support for @sap/cds 8 is dropped; the plugin needs @sap/cds 9 or later.
Makes stale:
Setup notes that add the plugin to a CAP 8 project.
1 earlier
v0.1.0
Logs are written with audit.log() and audit.logSync() against the SAP Audit Log Service REST API instead of through the @sap/audit-logging client library. The events dataAccessLog, dataModificationLog, configChangeLog and securityLog are removed, @AuditLog.Operation annotations are ignored, and reading sensitive data is logged only when cds.requires['audit-log'].handle includes READ.
Makes stale:
Guides that set cds.features.audit_personal_data: true, annotate entities with @AuditLog.Operation, or expect reads of sensitive data to be logged by default.
@cap-js/audit-loggingcds-pluginIntegration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.sap official, cap
SAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp
@cap-js/audit-logging → SAP Audit Log serviceStated in the document, data, under a conditionWriting the audit log messages a CAP application produces, the personal data ones derived from annotations included, to the SAP Audit Log service, the integration the plugin ships; an own implementation may write them to a custom store instead.If The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
SAPnot SAP's, or the project's ownstated in the document
@cap-js/audit-logging is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.
The information in this file is by no means complete but enables you to get started quickly. Make sure to read the provided documentation at cap.cloud.sap to get the full picture.
Preliminaries
In this guide, we use the Incidents Management reference sample app as the base to add change tracking to. Clone the repository and apply the step-by-step instructions:
git clone https://github.com/cap-js/incidents-appcd incidents-appnpm i
Setup
To enable audit logging, simply add this self-configuring plugin package to your project:
npm add @cap-js/audit-logging
Annotate Personal Data
Identify entities and elements (potentially) holding personal data using @PersonalData annotations. Create a db/data-privacy.cds file and add the following:
using { sap.capire.incidents as my } from './schema';annotate my.Customers with @PersonalData : { DataSubjectRole : 'Customer', EntitySemantics : 'DataSubject'} { ID @PersonalData.FieldSemantics: 'DataSubjectID'; firstName @PersonalData.IsPotentiallyPersonal; lastName @PersonalData.IsPotentiallyPersonal; email @PersonalData.IsPotentiallyPersonal; phone @PersonalData.IsPotentiallyPersonal; creditCardNo @PersonalData.IsPotentiallySensitive;};annotate my.Addresses with @PersonalData: { EntitySemantics : 'DataSubjectDetails'} { customer @PersonalData.FieldSemantics: 'DataSubjectID'; city @PersonalData.IsPotentiallyPersonal; postCode @PersonalData.IsPotentiallyPersonal; streetAddress @PersonalData.IsPotentiallyPersonal;};annotate my.Incidents with @PersonalData : { EntitySemantics : 'Other'} { customer @PersonalData.FieldSemantics: 'DataSubjectID';};
The end-to-end out-of-the-box functionality provided by this plugin requires a paid-for instance of the SAP Audit Log service for customers. However, it is possible to provide an own implementation that writes the audit logs to a custom store.
This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.
Code of Conduct
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.
Licensing
Copyright 2023 SAP SE or an SAP affiliate company and contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.
Properly encode request body parameters using in audit-log-to-restv2
Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association
await audit.log('<event>', <data>) for asynchronous logs (cf. emit)
await audit.logSync('<event>', <data>) for synchronous logs (cf. send)
New REST API-based schema with auto-filled LogEntry aspect
New events SensitiveDataRead, PersonalDataModified, ConfigurationModified, and SecurityEvent
Full support for OAuth2 plan of SAP Audit Log Service
Changed
Whether reading sensitive data and modifying personal data is logged is determined by cds.requires['audit-log'].handle: [...].
Possible values in the array are READ and/ or WRITE, with WRITE as the sole default entry.
Hence, accessing sensitive data is not logged by default.
Integration with SAP Audit Log Service via REST API instead of client library (@sap/audit-logging)
Fixed
Various glitches in log calculation
Removed
Old events dataAccessLog, dataModificationLog, configChangeLog, and securityLog
@AuditLog.Operation annotations are ignored. Having the plugin as dependency signals the intent to audit log.
cds.features.audit_personal_data: true is no longer necessary. Instead, simply add the plugin as a dependency.
LoggingLoggingcapabilitySeeing what a running service did, in a form something can read afterwards — levels, a formatter that suits a laptop and one that suits a log service.SAP only
SAP Application Logging service for SAP BTPSAP Application Logging service for SAP BTPserviceCollects an application's log lines from Cloud Foundry or Kyma into a searchable Kibana, for the retention the plan sets.sap official, btpCollects Cloud Foundry or Kyma logs into a searchable Kibana
com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bompackageThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, capMaven bill of materials pinning CAP Java module versions
Audit loggingAudit loggingcapabilityRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only
SAP Audit Log serviceSAP Audit Log serviceserviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btpIngests and retains compliance audit data from BTP
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngpackageA CAP Java plugin that sends audit log events to the SAP Audit Log service in the format the Audit Log Event Catalog expects.sap official, capCAP Java plugin sending audit log events to SAP Audit Log service
com.sap.cds:cds-feature-auditlog-v2com.sap.cds:cds-feature-auditlog-v2packageThe CAP Java handler that sends the SDK's AuditLog events to the SAP Audit Log service over its API version 2, once a service binding is present.sap official, capCAP Java handler for SAP Audit Log service API version 2
com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bompackageThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, capMaven bill of materials pinning CAP Java module versions
The plugin's own integration is used; an own implementation may write the audit logs to a custom store instead.
The plugin required the Audit Log service and said nothing of what passes between them.
Integration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.
