BrowseSAP Cloud Application Programming Model
Everything in CAP
129 of 1047
Domain: 2
Signals
Content: Nothing recorded
More
Group by: Capability
EntryBySignalsLast activity
Audit loggingSAP only
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Introducing the Cloud Application Programming Model (CAP)Introducing the Cloud Application Programming Model (CAP)SAP's own general-availability announcement for CAP, laid out as a Golden Path: a data model and service defined in CDS gets a generated service provider that serves metadata publishing and CRUD requests, fills in primary keys and audit data, and writes trace and audit logs without application code. The same CDS model carries annotations that translate to OData vocabularies and generate a Fiori elements app skeleton, which is how Fiori annotations work in CAP.Daniel7, published 2018-06-05
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
AuthenticationSAP and community
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicesRoad map: SAP Business AI Platform security and SAP Cloud Identity ServicesThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity Services and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
AuthorizationSAP and community
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
CAP-JAVA implementation for Authorization Management Service (AMS)CAP-JAVA implementation for Authorization Management Service (AMS)Short and deliberately narrow: the author defers the concepts to kevin_li's post and writes only the CAP Java part — the development flow, designing the authorization model, and assigning and checking a policy. Read the other one first; this is the half that touches the code.Harvey_Yao, published 2024-12-27
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP(Cloud Application Programming)开发框架概述SAP CAP(Cloud Application Programming)开发框架概述A Chinese-language walkthrough of CAP built mainly from CAPire's own "About CAP" page: CDS entities, associations, compositions and aspects for data modelling, with an extend Books with @restrict: [{ grant:'WRITE', to:'admin' }] aspect as its authorization example; CQL and CQN queries shown against both a local service and OData's $select/$expand; and the service-and-event model — this.on, this.emit, srv.on — that carries CAP's async processing. It closes with the author's own setup: installing @sap/cds-dk, scaffolding a bookshop project with cds init, and running it with cds watch against local SQLite, mocked authentication and file-based messaging standing in for HANA Cloud, IAS and Kafka.ArthurYang, published 2024-01-07
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesSecuring SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management service (XSUAA), restricting CDS service definitions with @restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds Node.js example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Soumya-Pirlamarla, published 2025-07-14
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Change trackingSAP and community
BTP CAP : Custom plugin to separate generic change log capture logicBTP CAP : Custom plugin to separate generic change log capture logicWalks through building a custom [CAP](ecosystem:cap) plugin that centralises change-log capture: on cds.once('served') it collects entities annotated @audit, then hooks srv.before('UPDATE') to read the existing record, diff it field by field against the incoming payload, and record old/new values with the user and timestamp. It also documents a cds build failure packaging the plugin's own directory into gen/srv for MTA deployment, fixed by adding it as a copyfiles build-parameter step in mta.yaml.sreehari_vpillai, published 2023-05-10
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Open Sourcing CAP – how to learn more or get involvedOpen Sourcing CAP – how to learn more or get involvedA roundup of CAP's open-sourcing, begun at TechEd the year before, pointing to a webinar recording, a podcast episode and reCAP 2023 talks for background. Among the components it names are a feature toggle library giving Node.js CAP apps live-updatable toggles backed by Redis, a new pluggable database layer with SQLite and PostgreSQL implementations plus a generic SQL layer, and a change tracking component that builds a change history for data from CDS models.Fempel, published 2023-10-02
Data privacySAP only
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1First of a three-part series on designing a CAP application on BTP that uses the platform's data privacy services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data Manager, SAP Data Retention Manager, SAP Data Privacy Integration and SAP Audit Log service. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2 and Part 3.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP and community
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
CAPVAL: A project is bornCAPVAL: A project is bornThis second CAPVAL post announces CAPVAL version 2.0, made compatible with CAP v8 after breaking changes there, with the fix shown as a custom cds.middlewares.after error handler. It restates the plugin's @validation.message annotation alongside standard annotations such as @mandatory as the input validation mechanic the project builds on, and the release otherwise adds automated tests and release-automation GitHub Actions rather than new annotations.published 2024-08-26
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Malware scanningSAP only
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
Rate limitingSAP and community
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
MCP Gateway in Practice: Architecture, configuration, and hands-onMCP Gateway in Practice: Architecture, configuration, and hands-onA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration Suite: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API Management, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systems edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.SAP Developers
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
ConfigurationSAP only
AI needs a foundation: A map of the plug-in ecosystem for CAPAI needs a foundation: A map of the plug-in ecosystem for CAPA map of the plug-ins for CAP (@sap/cds), official, community and independent, drawn across regions such as integration, performance and tooling, so that a team can see what exists to reuse and what it would have to build: the question plugin authoring answers from the other side. SAP's abstract places CAP at the centre of its AI strategy, with model context protocol support, and the map is offered as the foundation under that. A TechEd 2026 session (Tuesday 27 October, Community Theater, Berlin), presented by Mike Zaschka, written here from SAP's abstract; the recording is not yet published.
CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787Four malicious npm package versions published on 29 April 2026 that exfiltrate credentials and propagate into adjacent repositories, and what a CAP developer should check. A security advisory rather than a technique, and dated precisely for that reason.Yogananda, published 2026-05-01
CAP Heaven? Not Yet — But You Can See It from HereCAP Heaven? Not Yet — But You Can See It from HereAn assessment from someone with Java, Azure and AWS behind them as well as ABAP and Fiori, which is a rarer vantage point than it sounds. The title is the verdict.published 2026-02-07
CAP is important because it's not importantCAP is important because it's not importantAn essay rather than a technique: what CAP actually is, what it gives you, and the case for treating it as foundational precisely because it is not the interesting part of an application. Written in 2019, when that argument still had to be made, and the title is the argument. Also recorded as a Tech Aloud podcast episode and a CodeTalk, both linked from the post.published 2019-11-06
CAP, RAP, or Both: Stop Hiding Behind 'It Depends'CAP, RAP, or Both: Stop Hiding Behind 'It Depends'Opens by refusing the answer every other post on this gives — "both are complementary, choose based on context" — and then commits to a framework, including the parts usually left out: the staffing bias behind the decision, and what to do about a landscape with thousands of Z-objects. Argument, not tutorial.published 2026-04-09
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Don't "let it crash", is this the new CAP guideline?Don't "let it crash", is this the new CAP guideline?Dinu traces a change in error handling in CAP's Node.js runtime: @sap/cds@8.2.0 adds a cds.server.shutdown_on_uncaught_errors config flag, defaulting to true, but invoking an operation with an undefined variable no longer takes the server down, with or without the flag, where the same code crashed it on cds@6 and cds@7, and the author notes the old behaviour was already missing in cds@8.1. It still crashes with features.odata_new_adapter turned off to use the old OData parser, so it is the new OData adapter, like the REST adapter before it, that answers an uncaught error with a 500 instead of taking the process down.Dinu, published 2024-09-06
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Getting started with cds.ql in NodeJS for CAP - 101 on how to query dataGetting started with cds.ql in NodeJS for CAP - 101 on how to query dataWalks through cds.ql, the query API @sap/cds gives a Node.js CAP service's custom handlers, with worked SELECT, UPDATE, DELETE and INSERT examples against a sample schema — filters, AND/OR conditions, column projections, ordering, limiting, grouping and joining two entities through a schema view. An added correction notes that cds.tx(req) is no longer needed to run a query in newer CAP versions, contradicting the post's own original guidance.published 2022-06-21
Hello React & Vue : SAP CAP’s New UI Layer is Here!Hello React & Vue : SAP CAP’s New UI Layer is Here!CAP gaining a UI layer for React and Vue, which changes the default assumption that the front end is UI5. Short, and the significance is larger than the length.Yogananda, published 2026-06-25
SAP CAPv7 - Node.js Highlights and ExperiencesSAP CAPv7 - Node.js Highlights and ExperiencesAn account of upgrading a 100+ table CAP Node.js project from v6 to v7, working through breaking changes in @sap/cds 7: event handlers now always receive an array, service paths move under /odata/v4/... unless serve_on_root is set, and cds-serve replaces cds run. It goes deepest on the GraphQL plugin, @cap-js/graphql: the /graphql endpoint it serves, Composition results wrapped in a nodes connection, and offset-based pagination reached through OData's top and skip rather than GraphQL's own limit and offset.published 2023-08-03
SAP Cloud Application Programming Model (CAP) - start hereSAP Cloud Application Programming Model (CAP) - start hereThe orientation post for CAP, published in 2018 and revised in 2020 and again in 2021 with help credited to Iwona Hahn — which is the unusual part: a starting-point index that was maintained rather than left to rot, and says so at the top. Read as the shape of what a newcomer was pointed at, and as a marker of how much of that changed inside three years.published 2018-10-10
What's new in SAP Cloud Application Programming Model – January 2026What's new in SAP Cloud Application Programming Model – January 2026December and January together: the new @assert feature, revised documentation, CDS editor work, and Kyma deployment additions.published 2026-02-09
What's new in SAP Cloud Application Programming Model – November 2025What's new in SAP Cloud Application Programming Model – November 2025The November edition, led by the Status Transition Flows feature presented at reCAP 2025.published 2025-12-08
What's new in SAP Cloud Application Programming Model – September 2025What's new in SAP Cloud Application Programming Model – September 2025The monthly release communication for CAP itself, and this edition carries the MCP servers and the Application Frontend Service integration. Kept because a dated list of what shipped when is the only record of that; three editions are indexed here rather than the whole run.published 2025-10-14
DeploymentSAP and community
🚀 秒速で学ぶ SAP AI Core Agent 開発 🚀 - Part 8 CloudFoundry にデプロイ🚀 秒速で学ぶ SAP AI Core Agent 開発 🚀 - Part 8 CloudFoundry にデプロイPart 8 of a Japanese-language series deploys the Python backend and SAPUI5 chat UI built in earlier parts to SAP BTP, Cloud Foundry Runtime: the backend's manifest.yaml declares its buildpack, memory and start command for cf push, while the UI's MTA project is built with mbt build and uploaded with cf deploy, then has its ENDPOINT constant repointed at the live API's route. It closes with adding the deployed HTML5 app to SAP Build Work Zone, standard edition through Channel Manager's content sync, Content Explorer and a new Site Directory site.Ryota_Ito, published 2025-06-16
A 25x faster mta.yaml build for SAP CAP Node.js projectsA 25x faster mta.yaml build for SAP CAP Node.js projectsOne change to the build descriptor, arrived at after discarding the obvious alternatives — the author reports trying shell scripts, npm caching and offline installs, swapping npm for pnpm, and cds build --no-clean, all of which helped and none of which was this. The value is as much in the record of what was ruled out as in the trick itself.published 2025-03-17
A modern workflow for SAP Cloud Integration with CAP and Azure DevOpsA modern workflow for SAP Cloud Integration with CAP and Azure DevOpsCAP used to build tooling rather than an application: the development workflow for Cloud Integration is limited to what the Integration Suite offers, so the author puts a CAP service and Azure DevOps around it. An unusual use of the framework, and the reason to read it.marcel_schork62, published 2023-06-27
Adding Shell Plugin to SAP Fiori CAP Application and Deploying to Cloud Portal ServiceAdding Shell Plugin to SAP Fiori CAP Application and Deploying to Cloud Portal ServiceA launchpad shell plugin built as a CAP application and deployed to the Cloud Portal service — extending the shell around your app rather than the app itself.Abhinandan2, published 2025-11-24
Build BTP CAP App with Fiori Integration – Part 2: Implementing End to End AppBuild BTP CAP App with Fiori Integration – Part 2: Implementing End to End AppThe implementation half of the series whose first part set up the account and the database: the application itself, end to end.SuryaRamesh, published 2026-04-09
Build, Configure, and Deploy SAP CAP Projects to the CloudBuild, Configure, and Deploy SAP CAP Projects to the CloudA full CAP application with a Fiori UI taken from creation to the cloud in one post. Long, and it covers the configuration between the two that shorter guides skip.Dhanushwar, published 2025-05-20
Deploy a Full-Stack CAP Application in SAP BTPDeploy a Full-Stack CAP Application in SAP BTPFive tutorials taking the Developer's Guide application from running locally to running on BTP — preparation, the deployment itself, role assignment, and integration with Build Work Zone. Published twice, once for Cloud Foundry and once for Kyma, with the same shape and different descriptors; indexed once, because the second is the first with the runtime swapped.SAP
Deploying a CAP Application to SAP Cloud Platform, Kyma runtime & connecting an iOS appDeploying a CAP Application to SAP Cloud Platform, Kyma runtime & connecting an iOS appKyma when it was new on the platform, taken from a CAP application through deployment to a native iOS client on the other end. Written by someone working the mobile side, so the parts about what a device needs from the service are more careful than usual.KRiedelsheimer, published 2020-12-17
Deploying CAP services with the in-memory SQLite databaseDeploying CAP services with the in-memory SQLite databaseIn-memory, deployed to Cloud Foundry — so the data is gone on restart, on purpose. For a service whose datastore does not need to survive anything, which is a narrower case than it sounds and a real one.liam_mischewski, published 2021-05-24
Deploying first CAP Project in SAP Cloud : A Step-by-Step GuideDeploying first CAP Project in SAP Cloud : A Step-by-Step GuideThe terminal route rather than the template wizard, from cds init to a deployed application, with each command written out. For the case where the generated project is the thing you are trying to understand.satyanarayanpradhan, published 2025-07-02
DevOps with SAP BTPDevOps with SAP BTPHow SAP frames a delivery pipeline for applications on BTP Cloud Foundry: continuous integration through the SAP Continuous Integration and Delivery service and its pipeline templates for CAP and Fiori, transport and change management across environments, and a section on reasonable alternatives for teams with existing CI infrastructure. Culture first, tools second, and explicit that the setup differs on other BTP environments.published 2025-06-06
Event Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshEvent Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshA prototype, described as one: a plain CAP application made to react to external events on Kyma, with an agent in the loop and the UI refreshing itself rather than being reloaded. Short — it reports what was built and why, not how to rebuild it.Shahid, published 2025-12-01
Extend SAP SuccessFactors on SAP BTP with CAP - Deploy to SAP HANA CloudExtend SAP SuccessFactors on SAP BTP with CAP - Deploy to SAP HANA CloudThe deployment instalment of the author's SuccessFactors extension series — the project already exists and the imported service is already modelled, so this is only the move onto HANA Cloud. Depends on the two posts before it and says so.ale_biagi, published 2022-03-29
From Concept to action: Hands-On with the CAP Operator and the Partner Reference ApplicationFrom Concept to action: Hands-On with the CAP Operator and the Partner Reference ApplicationThe CAP Operator applied to a real application rather than a sample of its own — SAP's Partner Reference Application, taken from plugin integration through containerisation to custom resources. The transition to CRDs is the part that repays attention: it is where the deployment stops being an mta and becomes Kubernetes.ChristianWeiss, published 2026-05-21
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-6]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-6]The last part: the Fiori application built and deployed into the HTML5 Application Repository, separately from the service it talks to. Opens with a checklist of the five parts before it, which is the clearest statement of what the whole series covers.sanjucs, published 2026-05-14
HTML5.Timeout for CAP destinations in mta.yaml longer than defaultHTML5.Timeout for CAP destinations in mta.yaml longer than defaultA page and a half about one property that has to be raised when a CAP destination is slower than the default allows — and it now opens with its own correction, dated October 2025, that the property is called timeout rather than HTML5.Timeout, credited to a commenter. The correction is why it is worth keeping.NilsJanen, published 2022-11-09
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Kyma Evolution: Transforming SAP Kyma into a tailor-made SaaS Platform for sbs extensionsKyma Evolution: Transforming SAP Kyma into a tailor-made SaaS Platform for sbs extensionsWritten by an extensibility expert building against Cloud ERP under clean core, and it treats Kyma as something to shape rather than to adopt — what has to be added to the runtime before it is a SaaS platform for CAP extensions. The Partner Reference Application post is the hands-on sequel.ChristianWeiss, published 2026-02-03
Multitenant SaaS applications on SAP BTP using CAP? SAP BTP, Kyma Runtime!Multitenant SaaS applications on SAP BTP using CAP? SAP BTP, Kyma Runtime!The Kyma counterpart to the Cloud Foundry Tried-and-True series — the same SaaS application, the same requirements, a Kubernetes runtime underneath. The two code lines were later merged, which the Reloaded post announces.martinfrick, published 2023-04-05
Part 2: Runtime Architecture & Cost efficiency gainsPart 2: Runtime Architecture & Cost efficiency gainsThe technical half of the Kyma Evolution series: why a cluster tuned for CAP multitenancy is not just somewhere to run containers, and where the cost efficiency actually comes from.ChristianWeiss, published 2026-02-04
Quickly Deploy a Sample CAP Application to BTPQuickly Deploy a Sample CAP Application to BTPPrerequisites first and at length — account, dev environment, CLI tools, MBT — because that is where a first deployment actually fails. The deploy itself is short once they are true.AminAlmarsafy, published 2025-11-15
SAP CAP Lessons Learned: Run a CAP app using SQLite on SAP BTP - Cloud FoundrySAP CAP Lessons Learned: Run a CAP app using SQLite on SAP BTP - Cloud FoundrySQLite past the point it is meant to go — deployed, not local. Written as a lesson learned rather than a recommendation, and it pairs with the author's own note that SQLite is single threaded.LucasMagriniRigo, published 2024-12-30
SAP CAP With Prostgres Serice in BTPSAP CAP With Prostgres Serice in BTPA step-by-step walkthrough of a CAP bookshop project on @cap-js/postgres, provisioning PostgreSQL on SAP BTP, hyperscaler option's trial plan through mta.yaml, building the MTA archive and deploying it to Cloud Foundry by hand, then inspecting the deployed database with pgAdmin over an SSH tunnel. It updates an earlier post by Mike Zaschka on the same topic to the package CAP now ships by default, though the manual build-and-deploy sequence it shows predates cds up folding those steps into one command by a day.satya-dev, published 2025-03-30
Simple steps to deploy your CAP project to HANA cloudSimple steps to deploy your CAP project to HANA cloudWritten from the far side of a failed deploy — the author says these are the troubleshooting steps that ended up working, not a designed procedure. Short, and honest about being a record rather than a recommendation.OmPrakashJha, published 2021-02-11
Streamlined Kyma deployment for CAP applicationsStreamlined Kyma deployment for CAP applicationsUnder two thousand characters on getting a CAP application onto Kyma with less ceremony than the long guides require. Short by design.published 2025-12-08
The fastest way to a deployable CAP app on SAP BTP Cloud FoundryThe fastest way to a deployable CAP app on SAP BTP Cloud FoundryThe gap between an application that runs locally and one that runs deployed — binding, bundling, the database connection, authorization — treated as the problem rather than as setup. Since updated for cds up, which is the shortest answer the core now offers, and the post carries that update inline rather than leaving the original standing.published 2025-02-13
The Future of Continuous Delivery for SAP Cloud SDK and SAP Cloud Application Programming ModelThe Future of Continuous Delivery for SAP Cloud SDK and SAP Cloud Application Programming ModelA direction note on the Continuous Delivery Pipeline that Cloud SDK and CAP projects were expected to start from, written by someone on the inside as its future was being decided. Dated 2020, so read it for what was being weighed rather than for what to run — and as one of the few places the reasoning behind a tooling direction was written down at all.published 2020-11-23
Feature togglesSAP and community
Open Sourcing CAP – how to learn more or get involvedOpen Sourcing CAP – how to learn more or get involvedA roundup of CAP's open-sourcing, begun at TechEd the year before, pointing to a webinar recording, a podcast episode and reCAP 2023 talks for background. Among the components it names are a feature toggle library giving Node.js CAP apps live-updatable toggles backed by Redis, a new pluggable database layer with SQLite and PostgreSQL implementations plus a generic SQL layer, and a change tracking component that builds a change history for data from CDS models.Fempel, published 2023-10-02
Streamline User Targeting with Segments in SAP Feature FlagsStreamline User Targeting with Segments in SAP Feature FlagsWalks through segments in the SAP Feature Flags service: reusable, named user lists — up to 1,000 direct user IDs or 15 attribute-based conditional rules per segment — referenced across every feature flag in a service instance instead of redefined per flag. Covers creating a segment from the Feature Flags Dashboard and the per-instance limit of 20 segments, plus the safeguard that a segment in use cannot be deleted.Maksimiliana, published 2026-02-05
Health checksSAP only
#BTP #SAPCAP: Quirky Nuggets (N05-N06)#BTP #SAPCAP: Quirky Nuggets (N05-N06)On SAP BTP, Cloud Foundry Runtime, a one-shot PostgreSQL db-deployer app can be restarted by the platform's default port-type health check inside its 60-second timeout, re-running the deploy and duplicating data in the PostgreSQL database; setting health-check-type to process or http, via cf commands or the app's mta.yaml parameters, avoids it. In CAP, a remote service's entities are imported and consumed through cds.connect.to and queried via a projection, but its functions and actions cannot be projected: they must be redefined in the consuming service's own interface, with the handler forwarding the call to the remote proxy.published 2023-07-27
Job schedulingSAP and community
SAP BTP Cloud foundry Job Scheduling for CAP based projectSAP BTP Cloud foundry Job Scheduling for CAP based projectWalks through binding the SAP Job Scheduling service's trial instance to a CAP application's own custom action endpoint, so the service calls it on a configured interval and keeps a log of each run. The action itself is ordinary application code — here, sending an email through a third-party library — and the trial subaccount the author used could only run the job once, not on a repeating schedule.sunojmichael1, published 2021-03-15
SAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecSAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecA tutorial on generating a type-safe client library for the SAP Job Scheduling service's REST API from its OpenAPI specification, using the OpenAPI Generator CLI to target Node.js, TypeScript, Java, Python, Go or C#. It walks through OAuth 2.0 client-credentials authentication and the generated client's Jobs API, listing, creating and reading jobs with their cron schedules, and lists what the service's error statuses (400, 401, 404, 409, 429, 503) mean to a caller. It states that the official @sap/jobs-client will be deprecated and tells readers to use a generated client for now.DenisDuev, published 2026-05-04
SAP Job Scheduling Service: Set Job Run Status with the REST API and Node.jsSAP Job Scheduling Service: Set Job Run Status with the REST API and Node.jsWalks through recovering a stuck asynchronous job run in SAP Job Scheduling service: when a triggered app fails to call back, the run stays at ACK_RECEIVED and eventually UNKNOWN, since the scheduler never assumes success or failure on its own. The fix is a Node.js script that reads a downloaded service key, gets an OAuth2 client-credentials token, and calls PUT /scheduler/jobs/{jobId}/schedules/{scheduleId}/runs/{runId} with a success/message body to set the run to FAILURE or SUCCESS by hand.DenisDuev, published 2025-08-11
LoggingSAP only
From Application Logging to Cloud Logging: Service Innovation GuideFrom Application Logging to Cloud Logging: Service Innovation GuideSAP Cloud Logging replaces SAP Application Logging service, moving each customer from a shared multitenant stack to a dedicated, fully isolated one, and this guide sets out what changes with the move: a deployment per compliance region instead of per Cloud Foundry landscape, SAML/IDP-based authentication instead of Cloud Foundry-bound auth, retention that is configurable instead of fixed at seven days, and hourly capacity-unit pricing instead of fixed-size monthly plans. It also states the deprecation timeline for logging on BTP: SAP Application Logging closes to new or renewed CPEA contracts after 2025-07-31, while contracts signed before that date keep their entitlement until their next renewal.Hariharan-Gandhi, published 2024-11-22
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
SAP Cloud Logging Serviceでコンテナメトリクスを監視するSAP Cloud Logging Serviceでコンテナメトリクスを監視するIn Japanese. Container metrics for a CAP Node.js application into SAP Cloud Logging Service, and the reason it exists is that the obvious route does not apply: Spring Boot Actuator covers the Java side, and Node has no equivalent, so the author reaches for Telegraf instead. The procedure is deliberately independent of application logic — bind the instance, add a startup script and a config file — so it works against an application you already have.kyoneo, published 2024-03-26
MultitenancySAP and community
Building a SaaS Multitenant Application Using SAP CAP Framework — Without a DatabaseBuilding a SaaS Multitenant Application Using SAP CAP Framework — Without a DatabaseMultitenancy with the database taken out, which is a useful way to see what is left: the approuter and its tenant host pattern, the XSUAA instance in shared tenant mode, and the SaaS Registry binding that makes a subscription happen. Everything here is subscription lifecycle and routing, so the parts that are usually entangled with HDI container provisioning are visible on their own.DebashishDas, published 2026-05-06
CAP multitenancy with Work ZoneCAP multitenancy with Work ZoneA gap in the tooling and the manual edit that closes it. cds add portal wires the Portal service, which is deprecated; Work Zone supports multitenancy but has no equivalent command. The author runs the portal command anyway and then rewrites the resource and module config in mta.yaml to point at Work Zone. Short, and honest that it is a workaround rather than a supported path.published 2025-03-14
Custom Business Logic Extensibility in CAP (CDS-Oyster)Custom Business Logic Extensibility in CAP (CDS-Oyster)A Devtoberfest 2026 session walking @sap/cds-oyster — at version 0.55, with 1.0 stated for Q4 — end to end on a multitenant xtravels, from the application developer's side and the extension developer's side. The application developer adds a submit-for-review action to the status flow and opens exactly one surface for custom code: a separate extension service marked as extensible code, holding a no-op validate action and two read-only helper entities, which the host application calls before the status change; nothing else is extensible, because the annotation defaults to false. The extension developer works in a project whose base model came from cds pull, with test data, a server.js and types from @cap-js/cds-typer added so the UI and code completion work, debugs the handler locally and pushes it as an @sap/cds-mtxs extension, after which the next request rejects a travel over the policy limit without a restart — the code having been stored as an annotation in the tenant's model and run in a Rust WebAssembly sandbox with no database connection, whose queries go back to the CAP runtime as CQL strings, which is tenant extensibility extended from fields to logic.published 2026-10-09
Event-Driven Multi-Tenant Architecture on SAP BTP with CAP and SAP Event MeshEvent-Driven Multi-Tenant Architecture on SAP BTP with CAP and SAP Event MeshThe two topics that are usually written about separately, taken together — because a shared broker is where tenant isolation stops being automatic. It starts from why microservices are decoupled at all, places Event Mesh among the four broker services BTP offers, and then works through what changes when the publisher and the consumer are multitenant.ale_biagi, published 2024-12-19
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
From Concept to action: Hands-On with the CAP Operator and the Partner Reference ApplicationFrom Concept to action: Hands-On with the CAP Operator and the Partner Reference ApplicationThe CAP Operator applied to a real application rather than a sample of its own — SAP's Partner Reference Application, taken from plugin integration through containerisation to custom resources. The transition to CRDs is the part that repays attention: it is where the deployment stops being an mta and becomes Kubernetes.ChristianWeiss, published 2026-05-21
Kyma Evolution: Transforming SAP Kyma into a tailor-made SaaS Platform for sbs extensionsKyma Evolution: Transforming SAP Kyma into a tailor-made SaaS Platform for sbs extensionsWritten by an extensibility expert building against Cloud ERP under clean core, and it treats Kyma as something to shape rather than to adopt — what has to be added to the runtime before it is a SaaS platform for CAP extensions. The Partner Reference Application post is the hands-on sequel.ChristianWeiss, published 2026-02-03
Multitenant Business Applications with CAP | Hands-on Video TutorialsMultitenant Business Applications with CAP | Hands-on Video TutorialsA hands-on video series from the SAP HANA Academy on building multitenant applications with CAP, with the written post as its index. Referenced by other posts here as the more current alternative to their own text.dvankempen, published 2021-06-03
Multitenant SaaS Application using CAPMultitenant SaaS Application using CAPSAP's reference architecture for a multitenant SaaS application on BTP built with CAP: one deployment serving many tenants with logically separated data, the subscription and onboarding flow, and the BTP services the design leans on. Written for partners and line-of-business teams building on BTP, and it is SAP's own side of the shape multitenancy takes on BTP.published 2025-01-31
Multitenant SaaS applications on SAP BTP using CAP - The Reloaded Version!Multitenant SaaS applications on SAP BTP using CAP - The Reloaded Version!An announcement rather than a tutorial, and it is the one that changes how the rest of the series should be read: the Cloud Foundry and Kyma code lines and their documentation were merged into a single sample, so the runtime becomes a choice inside one repository instead of a fork in the reading path.martinfrick, published 2023-08-09
Multitenant SaaS applications on SAP BTP using CAP? SAP BTP, Kyma Runtime!Multitenant SaaS applications on SAP BTP using CAP? SAP BTP, Kyma Runtime!The Kyma counterpart to the Cloud Foundry Tried-and-True series — the same SaaS application, the same requirements, a Kubernetes runtime underneath. The two code lines were later merged, which the Reloaded post announces.martinfrick, published 2023-04-05
Multitenant SaaS applications on SAP BTP using CAP? Tried-and-True!Multitenant SaaS applications on SAP BTP using CAP? Tried-and-True!The opening post of the Cloud Foundry series, and the one that states the shape of the whole thing: a sample built out of a partner co-innovation project with BCG, then delivered in three graded versions — Basic, Advanced, Expert Features — against a fictional partner's requirements. Read it for the motivation and the map; the implementation is in the three that follow.martinfrick, published 2022-10-19
Multitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Advanced VersionMultitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Advanced VersionWhat the basic version leaves out and production needs: central user management, and reaching an on-premise S/4HANA from a subscribed tenant. Framed as a step towards production readiness rather than as production itself, which is the honest reading — the Expert Features post is where the rest of that distance is covered.published 2022-11-21
Multitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Basic VersionMultitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Basic VersionThe version deliberately bounded by what a trial or pay-as-you-go account can hold — the authors point out a PAYG owner can run it for nothing on free-tier services. Scenario first, then the architecture diagram, then a component-by-component walk through what each service in it is for.published 2022-10-24
Multitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Expert FeaturesMultitenant SaaS apps on SAP BTP using CAP? Tried-and-True! – The Expert FeaturesThe last of the four, and the one carrying the features that are optional until they are not. Each is written up as a self-contained tutorial in the sample repository rather than inline, so the post is a guide to which of them applies to your landscape.martinfrick, published 2022-11-29
Part 2: Runtime Architecture & Cost efficiency gainsPart 2: Runtime Architecture & Cost efficiency gainsThe technical half of the Kyma Evolution series: why a cluster tuned for CAP multitenancy is not just somewhere to run containers, and where the cost efficiency actually comes from.ChristianWeiss, published 2026-02-04
Platform migrationSAP only
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Modernize your database landscape with SAP HANA CloudModernize your database landscape with SAP HANA CloudWhy to move a database estate to SAP HANA Cloud, and the migration tools and services for doing so, which is the platform migration concern. SAP's abstract is one sentence and names none of the tools. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Niklas Siemer and Roman Belosludtsev, written here from SAP's abstract; the recording is not yet published.
Product Updates for SAP Build Code – June 2025 EditionProduct Updates for SAP Build Code – June 2025 EditionThe Q2-2025 release of SAP Build Code adds a Joule-based SAP HANA Application Migration Assistant extension that automates converting XS Classic and XS Advanced service-layer artifacts — XSJSLIB, XSODATA and XSJS — into CAP service definitions and handlers on SAP HANA Cloud, extending the existing database migration assistant with generative AI. It walks through the "XS Classic to CAP" and "XS Advanced to CAP" templates that trigger the conversion.published 2025-06-27