PackagePackagetypeA library you install and call yourself.See every one →What this type is →by SAPby SAPoriginPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
@sap-cloud-sdk/connectivity
Destination lookup and the connectivity proxy — the package that turns a destination name into a reachable endpoint with credentials attached.
DestinationsCAPDestinationscapabilityReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.
Requires
SAP Destination serviceSAP Destination serviceartifactNamed as a dependency in its documentation.SAP Connectivity serviceSAP Connectivity serviceartifactNamed as a dependency in its documentation.
Who is behind it
SAPSAPOrganisationMaintains this In the atlas: maintains 137, wrote 14@SAPmaintainerArtem KovalovPersonContributes to this In the atlas: contributes to 6@artemkovalyovSAP Cloud SDK BotPersonContributes to this In the atlas: contributes to 11@bot-sdk-jsBrigittaK307PersonContributes to this In the atlas: contributes to 12@BrigittaK307Britta VarwigPersonContributes to this In the atlas: contributes to 8@bvarwigRobert KaniaPersonContributes to this In the atlas: contributes to 6@cezaryrkChristian SchüringsPersonContributes to this In the atlas: contributes to 25@cschueringsDaniel KullmannPersonContributes to this In the atlas: contributes to 6@daniel-kullmannDavid KnaackPersonContributes to this In the atlas: contributes to 13, wrote 1@davidkna-sapDeeksha SinhaPersonContributes to this In the atlas: contributes to 12@deekshas8Deni DajaPersonContributes to this In the atlas: contributes to 6@denidaja38 contributors
Before choosing this
crawled
Conditions
LicenceSAP Developer License Agreement 3.2 CAP§ 1from DestinationsA destination used by a covered CAP application sends SAP product data to a non-SAP product rather than only addressing a remote endpoint.
§ 1License. Productive customer applications are limited to SAP BTP or another SAP-licensed platform, and mass extraction to a non-SAP product is restricted except where solely required for SAP interoperability.
A destination is configuration, not the deciding boundary. The licence becomes material when the resulting data flow is extraction into a non-SAP product, so the target and purpose need review.
declared, Where the library runs once installed: inside its host (loaded into the CAP application, installed into the ABAP system, loaded by the UI5 application), in a program of your own, or only at build time.
Distributed through
npm
declared, How it is installed, as its documentation tells a user to get it., read npm install @sap-cloud-sdk/connectivity — @sap-cloud-sdk/connectivity — README, 2026-10-18
Connections5
Group by
NodeRelationConditionBasis
Functional1
DestinationsDestinationscapabilityReaching remote systems without addresses or credentials in the codeSAP and community, unassessed
→provides
none
authored
provides Destinations
Functional, authored
Reaching remote systems without addresses or credentials in the code
Technical4
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authpackageXSUAA authentication stack for an MCP server on SAP BTPindependent, btp
←needed by
destination lookup and the connectivity proxy that the package's BTP entrypoint builds on.
needed by @arc-mcp/xsuaa-auth
Technical, derived, through inverted from its requires edge
For
destination lookup and the connectivity proxy that the package's BTP entrypoint builds on.
Basis
“`@sap/xssec` and `@sap-cloud-sdk/connectivity` are regular dependencies and install automatically.”xsuaa-auth README, checked
derived
needed by @arc-mcp/xsuaa-auth
Technical, derived, through inverted from its requires edge
For
destination lookup and the connectivity proxy that the package's BTP entrypoint builds on.
Basis
“`@sap/xssec` and `@sap-cloud-sdk/connectivity` are regular dependencies and install automatically.”xsuaa-auth README, checked
XSUAA authentication stack for an MCP server on SAP BTP
SAP Connectivity serviceSAP Connectivity serviceserviceProxy from cloud apps to on-premise systems via Cloud Connectorsap official, btp
→needs
none
authored
needs SAP Connectivity service
Technical, authored
Proxy from cloud apps to on-premise systems via Cloud Connector
SAP Destination serviceSAP Destination serviceserviceNamed, credentialed addresses of other systems resolved at runtimesap official, btp
→needs
none
authored
needs SAP Destination service
Technical, authored
Named, credentialed addresses of other systems resolved at runtime
@cap-js/n8n@cap-js/n8ncds-pluginTriggers n8n workflows from a CAP applicationsap official, cap
←used by
through inverted from its requires edge
used by @cap-js/n8n
Technical, derived, through inverted from its requires edge
derived
used by @cap-js/n8n
Technical, derived, through inverted from its requires edge
@sap-cloud-sdk/connectivitypackageDestination lookup and the connectivity proxy — the package that turns a destination name into a reachable endpoint with credentials attached.sap official, cap
SAP Destination serviceserviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp
SAP Connectivity serviceserviceThe proxy through which a cloud application reaches an on-premise system behind a Cloud Connector — HTTP, RFC and raw sockets — without that system being exposed.sap official, btp
@sap-cloud-sdk/connectivity → SAP Destination serviceDocumented only
@sap-cloud-sdk/connectivity → SAP Connectivity serviceDocumented only
The recommended way to get in touch with us is to create an issue on GitHub.
Select the issue category Bug, Feature, or Question depending on the nature of your request.
We try to provide fixes, features and answers as soon as possible.
Contribute
If you would like to contribute to the SAP Cloud SDK, please make yourself familiar with our contributing guidelines and follow the given instructions.
e8f8134: [fix] Export ./internal.js named export in package.json for compatibility.
Please migrate to the new named export ./internal, the old export is deprecated and will be removed in the next major release.
9f55261: [fix] Extend OnPremise HTTP agent cache key to scope it more strongly.
The cache key now includes the subaccount identity ensuring keep-alive sockets are not reused across tenants in multi-tenant technical user flows.
If no stable identity context can be derived from the request, a fresh agent without keep-alive is created for each request.
This matches the behavior of the previous implementation in SAP Cloud SDK v4.6.0 and lower, which did not cache agents in any case.
32aab37: [feat] A new agentOptions property on Destination allows configuring the underlying HTTP(S) agent (e.g. keepAlive, timeout) without constructing an agent manually.
Patch Changes
34da40e: [fix] HTTP(S) agents are now cached per destination instead of per protocol and options, preventing unintended agent reuse across different destinations.
a42a3a2: [fix] Refactor HTTP agent cache for better runtime compatibility.
24fe0c5: [fix] Fix DestinationOrFetchOptions and HttpDestinationOrFetchOptions so the service key surfaces at the type level.
9102f18: [New Functionality] Add createDestinationFromIasService() convenience function to build IAS-backed destinations.
This function aims to offer more convenience for obtaining IAS-backed destinations outside SAP BTP-environments.
d54ba5a: [Improvement] Cache custom http and https agents and enable the keep-alive option by default.
9102f18: [New Functionality] Add getIasToken() convenience function to fetch IAS token.
This function aims to offer more convenience for obtaining IAS tokens outside SAP BTP-environments.
d54ba5a: [Improvement] Use node's global http/https agent unless a custom agent is required by the destination configuration.
9102f18: [Compatibility Note] IAS tokens are now cached via @sap/xssec.
@sap/xssec uses an LRU cache limited to 100 items, previously this cache was unbound.
Patch Changes
df84426: [Fixed Issue] Avoid caching JWT if forwardAuthToken is set to true.
02d1302: [Compatibility Note] Update @sap/xssec to version 4.12.2 with changed XSUAA URL behavior.
When fetching XSUAA tokens with zone ID (multi-tenant scenarios), xssec now uses the base domain without a tenant subdomain prefix.
962cdcb: [Improvement] Allow passing a service binding directly through DestinationFromServiceBindingOptions instead of looking it up by name.
d444438: [New Functionality] Support IAS (App-to-App) authentication. Use transformServiceBindingToDestination() function or getDestinationFromServiceBinding() function to create a destination targeting an IAS application.
3c19ffa: [Compatibility Note] The getDestinationFromDestinationService() function no longer verifies the incoming XSUAA JWT against the application's bound XSUAA instance. Consequently, the cacheVerificationKeys option is now deprecated and has no effect.
3c19ffa: [Improvement] Remove dependency on XSUAA service binding while retrieving destinations using getDestinationFromDestinationService() and getAllDestinationsFromDestinationService() functions.
4a187d6: [Fixed Issue] Remove destination cache in getDestinationFromServiceBinding() function to let cached destinations retrieved in getDestinationFromDestinationService() function be added with the proxyConfiguration property.
7d92a1b: [Compatibility Note] The following deprecated content has been removed from the package:
The behaviour of getAgentConfig() function is changed to be asynchronous. The temporary asynchronous function getAgentConfigAsync() has been removed.
The destinationForServiceBinding() function has been removed. Use getDestinationFromServiceBinding() instead.
The PartialDestinationFetchOptions type has been removed. Use either ServiceBindingTransformOptions or getDestinationFromServiceBinding() function.
The serviceToken() function no longer takes xsuaaCredentials as part of the options parameter.
The parseDestination() function is no longer a public API.
The DestinationForServiceBindingOptions interface has been renamed to DestinationFromServiceBindingOptions.
d69325a: [Compatibility Note] Enable destination caching by default when retrieving destinations via the destination service. Change affects behavior of getDestination() method, getAllDestinationsFromDestinationService() method, generated client's execute() method and generic HTTP requests execution using executeHttpRequest().
25c9dd8: [Compatibility Note] Disable iasToXsuaaTokenExchange by default if not defined.
Patch Changes
e7cf4e7: [Fixed Issue] Reintroduce option to pass iss property to getClientCredentialsToken function.
40fa8d9: [Fixed Issue] Add proxyConfiguration on the fly to avoid expired proxy authorization token in cached destination if it lives shorter than the token for destination service.
efa75d3: [New Functionality] Add convenience function transformServiceBindingToDestination() to create destination from service bindings.
The following service bindings are supported:
business-logging
destination
s4-hana-cloud
saas-registry
workflow
service-manager
xsuaa
aicore
efa75d3: [Improvement] Expose getServiceBinding(). This was previously an internal function.
4f29615: [Compatibility Note] The JKU header in JWTs is no longer verified. Instead the signature of the JWT is verified, which is more secure.
c721bbd: [Compatibility Note] The SAP Cloud SDK used to get all subaccount and instance destinations, that are available with your JWT (without potentially required token retrieval), through two requests to the destination service (/subaccountDestinations and /instanceDestinations). While this approach can have advantages when caching, it can cause severe performance issues without caching. Therefore, from now on, only one destination is retrieved per requested destination through /destinations.
You can no longer rely on the SDK to automatically cache all destinations on the first request. If needed, you can call getAllDestinationsFromDestinationService() with cache enabled instead.
c721bbd: [Improvement] Retrieve only one destination per requested destination instead of all subaccount and instance destinations. (See compatibility notes.)
28c9cb7: [Fixed Issue] Allow the use of authentication type NoAuthentication with proxy type OnPremise without requiring the SAP-Connectivity-Authentication header.
28c9cb7: [Compatibility Note] Using Principal Propagation through authentication type NoAuthentication is no longer supported. This resulted in erroneous behavior for destinations with authentication type NoAuthentication. If you need to use Principal Propagation use authentication type PrincipalPropagation.
7ed5ceb52: [Fixed Issue] Compare selectionStrategy in DestinationFetchOptions based on value instead of reference.
bf54df09b: [Fixed Issue] Fix destination caching for destinations from service bindings. The destinations are not cached repeatedly. The function getDestinationFromServiceBinding() returns undefined for destinations which have expired JWTs.
Patch Changes
2277f9443: [Fixed Issue] Support destinations of type ClientCertificateAuthentication without password.
db0780f1b: [New Functionality] Always add a name to destinations from service bindings created with getDestinationFromServiceBinding().
bde64634d: [Compatibility Note] Deprecate destinationForServiceBinding() and PartialDestinationFetchOptions. Use getDestinationFromServiceBinding() and ServiceBindingTransformOptions instead.
bde64634d: [New Functionality] Support forwarding of auth tokens for destinations from the destination service, service bindings and environment variables.
0583836bc: [Improvement] Do not rely on XSUAA service when caching service tokens. Cache keys are now based on service credentials URL.
8f54207b6: [Improvement] Do not rely on the XSUAA service binding to retrieve tenant information when registering destinations. If tenant is unknown and no binding is found, set it to a default value ('tenant_id').
36a01f775: [New Functionality] Add option to cache mTLS certificates.
6b58354e8: [Fixed Issue] Remove dependency to XSUAA service binding when checking whether a JWT was issued by XSUAA for destination retrieval. Now, the ext_attr.ehancer property is checked.
c09b1d06f: [Compatibility Note] The expiresIn property of authTokens on a Destination can be undefined.
616d77b85: [New Functionality] Enable the use of mTLS certificates for registered destinations on CloudFoundry.
56c3f70f4: [Fixed Issue] Forward the user JWT irrespective of the destination authentication type when forwardAuthToken is set to true on a destination
782b9e37e: [Improvement] Set the default validity time of the client credentials token cache to 5 minutes instead of never expiring.
039412e59: [New Functionality] Add support for authentication type NoAuthentication on-premise destinations.
28b7af86f: [Compatibility Note] The combination of iss and jwt is now supported when fetching destinations. When both properties are set, the iss property is no longer ignored.
28b7af86f: [New Functionality] Allow combination of iss an jwt when fetching a destination. In this case the iss URL will be used to fetch the destination service token and jwt will be used for the x-user-token header of user based authentication types.
47fc7278d: [Fixed Issue] Fix the The proxy configuration is undefined error for OnPrem MAIL destinations by removing the isHttpDestination check when adding proxyConfiguration to the destination object.
fde964e37: [Compatibility Note] The generic types of JwtKeyMapping is simplified so the second type argument JwtKeysT are always strings.
fde964e37: [Compatibility Note] The Protocol enum was replaced with a string literal union type. Now, instead of passing Protocol.HTTPS pass 'https'.
fde964e37: [Compatibility Note] Remove the options timeout and enableCircuitBreaker from all BTP service interactions i.e. destination and token fetching.
fde964e37: [Compatibility Note] Switch the compilerOptions.module to Node16 instead of CommonJS for better interoperability with ES modules. See the TypeScript handbook for technical details if needed.
fde964e37: [Compatibility Note] The enum IsolationStrategy was replaced with a string literal union type of the same name. Use 'tenant' and 'tenant-user' instead of IsolationStrategy.Tenant and IsolationStrategy.Tenant_User.
fde964e37: [Improvement] Replace Protocol enum with a string literal union type.
fde964e37: [Compatibility Note]] The url property in Destination is now optional as destinations of type MAIL do not have a URL.
fde964e37: [Improvement] Replace IsolationStrategy enum with union type.
Minor Changes
fde964e37: [New Functionality] Support OAuth2RefreshToken authentication type
fde964e37: [New Functionality] Add a retry option in the DestinationFetchOption.
Enable this options if the token exchange done by the destination service is unstable.
fde964e37: [Fixed Issue] Fix the combination of providing the iss together with OnPremise basic destinations.
fde964e37: [New Functionality] Add ResilienceOptions and resilience() function. The function returns an array of middlewares based on the provided options.
cb598c16: [New Functionality] Support JWTs without a JKU property.
09094607: [New Functionality] Add interface DestinationCacheInterface and method setDestinationCache to support implementation of custom destination cache.
93d41281: [New Functionality] Fetch client credential token for destinations created by service bindings.
8fdfebd6: [Fixed Issue] Fix getDestination() to allow passing an async transform function serviceBindingTransformFn in options. The transform function can also be passed by execute(), executeHttpRequest(), executeRaw(), etc.
[Compatibility Note] Rename transformationFn into serviceBindingTransformFn in DestinationForServiceBindingsOptions to avoid ambiguity and make the function async.
04726a35: [Improvement] Reduce default log output on the info level significantly.
04726a35: [Compatibility Note] Only log the successful retrieval of destinations on theinfo log level, log everything else is on the debug or warn level.
0a008674: [Compatibility Note] Mark the function noDestinationErrorMessage as internal API.
0a008674: [New Functionality] Support self-signed certificate using the trustStore property of the destination object.
DestinationsDestinationscapabilityReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed
SAP Destination serviceSAP Destination serviceserviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btpNamed, credentialed addresses of other systems resolved at runtime
com.sap.cds:cds-feature-remote-odatacom.sap.cds:cds-feature-remote-odatapackageA CAP Java feature for consuming remote OData V2 and V4 services as Remote Services, translating CQN queries into OData requests against a destination or a service binding.sap official, capRemote Services for consuming OData V2 and V4 APIs in CAP Java
com.sap.cds:cds-integration-cloud-sdkcom.sap.cds:cds-integration-cloud-sdkpackageA CAP Java feature that integrates the SAP Cloud SDK, so features such as remote OData and enterprise messaging resolve a destination or service binding and reach a remote REST-based service.sap official, capSAP Cloud SDK integration for remote REST services in CAP Java
capire/s4capire/s4packageA pre-built integration package for SAP S/4HANA, holding the imported service definitions a CAP project would otherwise generate for itself.sap official, capPrebuilt SAP S/4HANA integration package for CAP projects
cdsecdsepackageResolves a destination from a CAP project's own configuration, then makes the outbound call with axios: the url, the method and the body are written at the call site.independent, capDestination resolution and axios calls from CAP configuration
@sap/cds@sap/cdspackageThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtime
@sap-cloud-sdk/http-client@sap-cloud-sdk/http-clientpackageThe HTTP client that carries a destination's credentials, so an outbound call inherits the authentication rather than assembling it.sap official, capHTTP client carrying a destination's credentials
@sap-cloud-sdk/odata-common@sap-cloud-sdk/odata-commonpackageThe shared machinery under the SDK's OData and OpenAPI client generators; a dependency of the generated clients rather than something written against directly.sap official, capShared machinery under the Cloud SDK's OData and OpenAPI clients
@sap-cloud-sdk/openapi@sap-cloud-sdk/openapipackageGenerated OpenAPI clients for the Cloud SDK, so a REST API described by a specification is called through typed functions.sap official, capGenerated OpenAPI clients for the Cloud SDK
@sap-cloud-sdk/resilience@sap-cloud-sdk/resiliencepackageTimeouts, retries and circuit breaking around a remote call, so one slow downstream system does not take the application with it.sap official, capTimeouts, retries and circuit breaking around remote calls
@sap-cloud-sdk/util@sap-cloud-sdk/utilpackageGeneral utilities shared across the Cloud SDK packages — a dependency, not a thing to reach for on its own.sap official, capGeneral utilities shared across the Cloud SDK packages
@sapmentors/cds-scp-api@sapmentors/cds-scp-apipackageA Node module for CAP that calls an external API through a destination instead of a hardcoded endpoint, taking its address, credentials and on-premise tunnel from the SAP Destination and Connectivity services.community org, capNode module for CAP calling external APIs through a destination
