BrowseSAP Cloud Application Programming Model
Everything in CAP
450 of 1047
Domain
Signals
Content
More: SAP Community
Group by: Capability
Source SAP CommunityClear all
EntryBySignalsLast activity
Agent access to your codeSAP and community
Boost your CAP Development with AI: Introducing the MCP Server for CAPBoost your CAP Development with AI: Introducing the MCP Server for CAPThe announcement of the development-tool half of the two things called MCP here: a server that gives an agent context about the project in front of it and relevant CAP examples, so Claude Code or Copilot steers better. Names the agents it was tried with, which is more than most announcements do.published 2025-09-03
Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Somebody following the CAP MCP server announcement all the way through, and writing down what it cost: a CAP service in VS Code wired to S/4HANA through a destination, plus the real bumps — Windows PATH and global installs — that the announcement does not have.smarchesini, published 2025-09-21
Evaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceEvaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceSomeone trying SAP's three new MCP servers rather than repeating the announcement. It sets the official positioning first — MCP as the bridge from coding assistants to SAP tooling across Cursor, Windsurf, Copilot, Cline and Claude Code, with best-practice scaffolds and BTP-aligned guardrails — and then reports what using them is actually like. The rare kind of post that tests a vendor claim.published 2025-09-04
Give Your AI Agent Some Tools: Introducing the UI5 MCP ServerGive Your AI Agent Some Tools: Introducing the UI5 MCP ServerAnnounces @ui5/mcp-server, SAP's open-source MCP server for UI5 development, and walks through its initial six tools. get_project_info, get_api_reference and run_ui5_linter (which applies UI5 linter fixes) read the project's own version, manifest and code rather than an LLM's training data, which is what agent access to your code explains. create_ui5_app scaffolds a new JavaScript or TypeScript project, standalone or inside an existing CAP application, from templates with pre-configured OData model setups, which is generators.published 2025-09-03
SAP Fiori Tools Update – First Release of the SAP Fiori MCP Server for Agentic AISAP Fiori Tools Update – First Release of the SAP Fiori MCP Server for Agentic AIThe release announcement for the Fiori MCP server, placed as the step after the Project Accelerator: an assistant can create and edit Fiori applications directly rather than describing what a developer should do. The vendor's own framing, so read it beside the independent evaluation of the same servers rather than instead of it.published 2025-09-03
UI5 MCP Server Got Extended for UI Integration Cards GenerationUI5 MCP Server Got Extended for UI Integration Cards GenerationVersion 0.2.1 of the UI5 MCP Server adds three tools for UI Integration Cards: get_integration_cards_guidelines feeds an agent current best practices and API versions, create_integration_card scaffolds a new card project, and run_manifest_validation checks the generated manifest against the schema. The post frames these as closing the same gaps as the server's existing tools — an LLM's outdated or wrong card API knowledge — this time for scaffolding and validating a card rather than a full app.daniel_vladinov, published 2026-01-22
Agent guidanceSAP and community
⚡Unlocking the Power of LLMs in CAP: Understanding llms.txt and llms-full.txt⚡Unlocking the Power of LLMs in CAP: Understanding llms.txt and llms-full.txtllms.txt and llms-full.txt for CAP — a plain-text map of the documentation, written for an agent that arrived by fetching a URL rather than one somebody configured. The convention the atlas uses for itself, applied to capire.Yogananda, published 2025-05-18
Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Somebody following the CAP MCP server announcement all the way through, and writing down what it cost: a CAP service in VS Code wired to S/4HANA through a destination, plus the real bumps — Windows PATH and global installs — that the announcement does not have.smarchesini, published 2025-09-21
Enhancing Unit Testing in SAP CAP Java Applications with GitHub CopilotEnhancing Unit Testing in SAP CAP Java Applications with GitHub CopilotBuilt on SAP's own CAP Java unit-testing guide, and the question is narrow: how much of that does an assistant actually write for you. The author's own getting-started post is the one to read first.Anjali_Pathak, published 2025-09-04
Github Copilot VSCode - My Own SAP Development RulesGithub Copilot VSCode - My Own SAP Development RulesOne developer's rule files for Copilot, split by concern rather than kept as one prompt: CAP backend rules, UI5 frontend rules, Jest testing rules and Bruno collection rules, each with a scope narrow enough that an agent cannot read it two ways. The CAP file covers reusable types, managed data, soft-delete behaviour and service conventions; the UI5 file covers naming, view constraints and where annotations may live. It is the rule-file half of agent guidance rather than the skill half — nothing is packaged or published, and the value on offer is the shape of the split.radu_simen, published 2026-02-05
Teaching AI Agents Best Practices: A Skills Workspace for CAP DevelopmentTeaching AI Agents Best Practices: A Skills Workspace for CAP DevelopmentStates the gap this capability exists for more precisely than most: an agent already knows CAP well enough to generate models, handlers and deployments, but knowing a framework and following its current practice reliably are different things, because a model defaults to whatever it saw most of during training — which may be outdated, subtly wrong, or simply not how a given team works. Skills are offered as the closing mechanism, and the post describes a workspace pattern rather than a single file, with the architecture claimed to be framework-agnostic.daniel_schlachter, published 2026-06-09
Agent toolingSAP and community
Adapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionAdapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionA custom Joule Agent and Joule Skill, built in Joule Studio, classic edition to extend SAP Joule past its built-in Purchase Order display and change features: a buyer's single sentence naming a Purchase Requisition number becomes a created Purchase Order, with the skill wrapping the Purchase Requisition and Purchase Order OData V4 APIs as Action Packages reached through two destinations. The author anchors the agent's success condition to a PurchaseOrderNumber in the skill's output rather than an HTTP status code, and reports that the Purchase Requisition item structure does not map one-to-one onto the Purchase Order creation payload.jonathanvi59, published 2026-08-19
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Building Durable AI Agents - Announcing the cds-langgraph-persistence PluginBuilding Durable AI Agents - Announcing the cds-langgraph-persistence PluginThe announcement, and the argument behind it. Treating an agent as a software architecture rather than a model with tools makes a list of production requirements — identity, authn and authz, multitenancy, persistence, event-driven flows, scalability, observability, CI/CD — and the author's point is that CAP already answers most of them for BTP, which is what makes LangGraph inside CAP Node.js worth doing. The post then narrows to one of those requirements, durability, and the checkpointer that supplies it. Written from a year of building agents next to real business systems rather than as a framework tour.merbinjanselm, published 2026-07-15
Building Durable AI Agents - Announcing the cds-langgraph-persistence Plugin
@mi8y/cds-langgraph-persistence has been through 3 major lines since this was published: 0.5 (2026-07), 0.6 (2026-07), 0.7 (2026-09). Affects Runnable code.
Event Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshEvent Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshA prototype, described as one: a plain CAP application made to react to external events on Kyma, with an agent in the loop and the UI refreshing itself rather than being reloaded. Short — it reports what was built and why, not how to rebuild it.Shahid, published 2025-12-01
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
How Redwood Software and SAP are shaping the next era of automation with Joule StudioHow Redwood Software and SAP are shaping the next era of automation with Joule StudioRedwood's Field CTO describes a tech preview where an SAP Basis administrator tells SAP Joule in natural language to pause background jobs and dependent Integration Suite iFlows for unplanned system maintenance; Joule acts as a control tower, triggering a pre-approved RunMyJobs workflow and asking for approval before the restart proceeds. The integration is built by publishing RunMyJobs operations to the SAP Business Accelerator Hub, securing access through SAP BTP with API keys and role-based permissions, and combining those actions into a skill inside Joule Studio's low-code design canvas.gmblom, published 2025-11-02
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
Document extractionSAP only
Cloud Integration with Document AICloud Integration with Document AIWalks through connecting Cloud Integration to SAP Document AI: an iFlow posts a prescription PDF to Document AI's job API, polls the job endpoint until it completes, and a groovy script reads back the result, keeping only the fields above a stated 60% confidence threshold. The scenario is a hospital extracting a new patient's past illnesses, allergies and blood group from uploaded prescriptions, matched against a custom extraction schema.PriyankaChak, published 2025-08-10
Integrate CAP application as outbound channel for SAP Document AIIntegrate CAP application as outbound channel for SAP Document AIDocument AI will call you back when extraction finishes, and the callback is where this goes wrong: the CAP application has to accept an unauthenticated POST from outside without dropping CSRF protection for everything else. The answer is a middleware hooked into the CAP bootstrap, and the post spends its length on the token lifecycle rather than on the extraction.sdeissenboeck, published 2026-04-22
Integrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepIntegrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepThe forward direction, in full: a PDF or scan arriving at a CAP service, sent to Document Information Extraction, and the fields coming back into the model. Long, and step-by-step in the literal sense — the service binding and the request shapes are all written out.furkan5, published 2025-10-09
SAP AI Services - DOX - Gen AI with SAP CAP Plugin - Part 3SAP AI Services - DOX - Gen AI with SAP CAP Plugin - Part 3Building on Reusable components for CAP with cds-plugin by Daniel Schlachter, this part walks through a custom CAP plugin — a cds-plugin.js plus a lib_cap_dox.js helper — that authenticates against SAP's Document Information Extraction (DOX) service and calls its schema and job-status APIs to fill an entity from extracted document fields. It covers reading the service key from Cloud Foundry (cf service-key) for the OAuth token endpoint, and dynamically mapping DOX's header and line-item output onto CAP entity properties.sabarna17, published 2024-06-11
Using BTP Document Extraction Service into actual App developmentUsing BTP Document Extraction Service into actual App developmentWalks through calling SAP Document AI's REST API directly: getting a client-credentials bearer token from the service key's UAA, then POSTing to /document/jobs with a file and an options body naming the document type and the header fields and line items to extract (paymentTerms, documentDate, taxId, description for an invoice), and polling the returned job id until the status resolves. Covers the trial-account booster and its own UI for uploading a document and testing extraction before moving to Postman and a small Python script that lists jobs over the same bearer token.Ace_D, published 2024-07-31
What a Second Document AI Workshop Taught Me About GovernanceWhat a Second Document AI Workshop Taught Me About GovernanceFrom questions raised at a second SAP Document AI workshop: the retention period for extracted data is a setting in the service's administration rather than a fixed property, with the source file deleted after processing and the decommissioning period for the extracted data configured to the customer's own policy. It also draws a boundary readers kept merging: Document AI extracts across languages but does not translate, so turning a document into a reviewer's own language is a separate step, pointing on BTP at SAP Translation Hub.Nicolas_BacaStorni, published 2026-08-25
LLM integrationSAP and community
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3The concepts before the code: what the GPT model and its API actually offer, and what the finished chat application looks like — personalities included. Written in the weeks when the ground was moving under it, and the post carries its own change log to prove it: GPT-3.5 added on 1 March, GPT-4 on 15 March, and an admission that a series planned as two posts became three.published 2023-02-22
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3The backend: CAP with TypeScript, the entities holding chats and personalities, and the service that talks to the API. This is where the streamed completion and the repositories behind the handler come from, which is the part of the sample still worth lifting even though the model access has since been superseded by AI Core.published 2023-02-24
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3The SAPUI5 frontend of the sample, and mostly an argument for writing UI5 in TypeScript: ES imports in place of sap.ui.define, a class with real private members in place of the underscore convention, and the service types generated from the CDS model copied into the UI package, so one IChats interface types the OData object the controller reads. The second half is structure — a formatter class and a singleton LayoutManager called from the XML view through core:require, a confirmation helper taking a callback, a dialog class resolving a promise, a generic createEntity<T> on a service class — all of it to keep every controller under 100 lines. What it says about arranging a UI5 app holds whatever model sits behind the chat; the tooling around it is of its date, and the post calls UI5's TypeScript support experimental.published 2023-02-27
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3
cds2types. Affects Runnable code.
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIAn Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIA dormant internal app at SAP Japan revived with AI, built to solve a problem the team actually had — colleagues who could not talk to each other. Build Apps on the front, CAP on Kyma behind it, OpenAI in the middle.javieryw, published 2024-01-31
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAI
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Automate your Job Postings Using Generative AI (ChatGPT) & SAP Build Process Automation AppsAutomate your Job Postings Using Generative AI (ChatGPT) & SAP Build Process Automation AppsA process that drafts its own text: ChatGPT writing job postings, SAP Build Process Automation carrying them through approval, and CAP in between. Presented as a generic pattern the author expects to be adapted rather than copied.shivamshukla12, published 2023-08-10
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
cds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPcds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPNames a cost most CAP-plus-LLM writing ignores: every JSON payload streamed to a model is billed by its verbosity, in latency as well as money. The plugin brings TOON — Token-Oriented Object Notation — to a CAP service so the wire format changes without the service code doing so, in a REST variant and an OData one, with token counts reported on both sides.published 2026-01-25
Creating a meal generator application with SAP Build, Cloud Application Programming and openAICreating a meal generator application with SAP Build, Cloud Application Programming and openAIIngredients in, meal suggestions out, assembled from BTP services plus OpenAI and Google APIs. A small application built for the pleasure of it, and useful here as the plainest example of CAP holding the middle of a generative flow.former_member793421, published 2023-07-17
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Empowering Your Data Analytics with GPT-3 and SAP CAP IntegrationEmpowering Your Data Analytics with GPT-3 and SAP CAP IntegrationFree text in, SQL out, answer back in a sentence — the model writes the query, CAP runs it, and the model turns the rows into prose. Written in the GPT-3 window, so the model access has dated, but the three-step shape has not, and it is a different bet from retrieval: nothing is embedded, the schema is the context.Former Member, published 2023-03-10
Enhancing Business Processes with SAP BTP AI in SAP Integration SuiteEnhancing Business Processes with SAP BTP AI in SAP Integration SuiteWalks through a post-exit iflow in SAP Integration Suite that calls an LLM through SAP AI Core's Generative AI Hub to turn a customer's free-text return comment into one of a fixed set of SAP rejection-reason codes, so an inbound ORDERS05 IDoc carries a decision (E1EDP01-ABGRU) the ERP can act on without pausing for manual review. The worked example is a Commerce Cloud returns flow into S/4HANA; the piece argues the same bounded-classification pattern fits other narrative fields — delivery-exception remarks, expense-claim justifications — where the cost of an LLM call is repaid by removing a human review step, and points to a colleague's post on the Generative AI Hub orchestration workflow for the guardrailing (prompt templating, data masking) it only names.arunmaarirajha_kv, published 2025-12-15
Enhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginEnhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginStarts from the blank form nobody wants to fill in, and asks what an enterprise application should do about it. The AI is in service of that rather than the subject of it.published 2026-04-29
HANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingHANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingTwo ways to produce the same embedding, run side by side: HANA Cloud's own VECTOR_EMBEDDING function against Azure OpenAI through the CAP LLM plugin. The CDS side is short — an element of type cds.Vector maps to REAL_VECTOR on deploy — so what remains is the comparison, which is the thing you cannot get from either product's documentation alone.lalitmohan, published 2025-04-09
How to Reduce Prompt Token Costs Using Toon = Save MoneyHow to Reduce Prompt Token Costs Using Toon = Save MoneyToken spend treated as a running cost rather than a detail, and TOON as the lever. Companion reading to the CAP adapter for the same format that is indexed here.Yogananda, published 2025-11-12
How to Reduce Prompt Token Costs Using Toon = Save Money
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
How to use Cloud SDK for AI in an existing CAP NodeJS Project in CommonJSHow to use Cloud SDK for AI in an existing CAP NodeJS Project in CommonJSA dependency that is ESM-only inside a project that is CommonJS, and the author's judgement that converting the project was too risky. What follows is the esbuild workaround, which is the honest answer when the ecosystem has moved and your codebase has not.Jacky_Liu1, published 2025-08-01
Integrating a Custom AI Model into SAP CAP Using AI LaunchpadIntegrating a Custom AI Model into SAP CAP Using AI LaunchpadYour own model rather than a hosted one: deployed to AI Core, made callable through AI Launchpad, then reached from CAP. The case a lot of companies ask about and few posts cover.egeAksoyek, published 2026-03-20
Integrating a Custom AI Model into SAP CAP Using AI Launchpad
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Lets Talk to the Database - CAP & SQLite Powered by Google Gemini-2.5-ProLets Talk to the Database - CAP & SQLite Powered by Google Gemini-2.5-ProNatural language against a CAP service on SQLite, with a non-SAP model doing the translation. Written as a learning exercise rather than a pattern, and the choice of Gemini over anything in the AI hub is the interesting part of it.ShivamShuklaSAP, published 2025-04-16
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
Prompt-Driven Development: Building Full-Stack SAP CAP Apps from User StoriesPrompt-Driven Development: Building Full-Stack SAP CAP Apps from User StoriesA user story in, a scaffolded full-stack CAP application out, through SAP Build Code and Joule. The question it is actually asking is how much of the foundational code is worth generating, and it answers by generating all of it.AnuradhaDhingan, published 2025-12-11
RAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPRAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPThe end-to-end version: a CAP service exposing the vector engine and the AI hub behind a couple of endpoints, answering where a CodeJam is on a given date. It has aged in a way the author has marked in the page itself — the section on the CAP LLM plugin now carries "(Outdated)" in its own heading — so read the embedding preparation and the retrieval shape, and check the plugin part against the package.KevinR, published 2024-05-21
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
UI5 AI Features library is now an npm PackageUI5 AI Features library is now an npm PackageThe release note for a demo turning into a dependency, and it is explicit about why that matters: the earlier version worked, but using it meant cloning the repo and copying both halves, which stops working the moment one of them changes. The post walks through what shipping the CAP plugin and the be.wl.ai control library in one npm version buys — a client and server contract that cannot drift — then lists the eleven controls by group, shows the two-line configuration that activates each half, and notes that this version is actually deployed on BTP behind both a standalone approuter and Work Zone. It closes on the demo repository, written with no library source in it as the test that the package stands alone.published 2026-08-31
UI5 AI Features library is now an npm Package
cds 8, line ended. Affects Runnable code.
UI5 MCP Server Got Extended for UI Integration Cards GenerationUI5 MCP Server Got Extended for UI Integration Cards GenerationVersion 0.2.1 of the UI5 MCP Server adds three tools for UI Integration Cards: get_integration_cards_guidelines feeds an agent current best practices and API versions, create_integration_card scaffolds a new card project, and run_manifest_validation checks the generated manifest against the schema. The post frames these as closing the same gaps as the server's existing tools — an LLM's outdated or wrong card API knowledge — this time for scaffolding and validating a card rather than a full app.daniel_vladinov, published 2026-01-22
What an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayWhat an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayA first look at SAP AI Core's Generative AI Hub from someone who builds gateways outside SAP for a living: the orchestration service harmonizes provider calls onto one API (a model name string switches providers, and SAP Note 3437766 carries the current model list, token rates and deprecation dates), runs a fixed, non-reorderable module pipeline — templating, masking through SAP Data Privacy Integration, grounding, content filtering, then the model call — and retries down an ordered fallback list whose entries can each carry their own model and rules. It places @sap-ai-sdk/orchestration among the official JavaScript, Java and Python SDKs, and notes SAP's own LiteLLM provider as a way to put a different gateway in front of it.amishkush, published 2026-09-30
RAG on CDSSAP and community
HANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingHANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingTwo ways to produce the same embedding, run side by side: HANA Cloud's own VECTOR_EMBEDDING function against Azure OpenAI through the CAP LLM plugin. The CDS side is short — an element of type cds.Vector maps to REAL_VECTOR on deploy — so what remains is the comparison, which is the thing you cannot get from either product's documentation alone.lalitmohan, published 2025-04-09
RAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPRAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPThe end-to-end version: a CAP service exposing the vector engine and the AI hub behind a couple of endpoints, answering where a CodeJam is on a given date. It has aged in a way the author has marked in the page itself — the section on the CAP LLM plugin now carries "(Outdated)" in its own heading — so read the embedding preparation and the retrieval shape, and check the plugin part against the package.KevinR, published 2024-05-21
Using HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPUsing HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPEmbeddings generated inside the database rather than fetched from AI Core or an external model — a Q4 2024 HANA Cloud function, used from CAP. The shift it describes is where the embedding step lives, which changes what has to be deployed and what has to be called.published 2025-03-02
Tool governanceSAP and community
MCP Servers are the New Z-TablesMCP Servers are the New Z-TablesA single CAP service exposed as three overlapping MCP servers tools, queried by the same prompt nineteen times, returned the same tool every time — evidence, the author argues, that tool selection rests on the resemblance between a prompt and a tool's description rather than on any binding a where-used list could enumerate before retiring it. It contrasts that setup with @cap-js/mcp, which exposes a whole service as three generic tools instead of one per operation, and quotes the adapter's own beta documentation admitting no rate limiting, audit logging, input validation or approval workflow, and no use as a gateway to SAP Application APIs. From there it names four small Tool governance practices it has adopted: an owner recorded in the tool's own metadata, logging every invocation, deprecating inside the description, and exposing fewer tools.published 2026-08-21
Audit loggingSAP only
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Introducing the Cloud Application Programming Model (CAP)Introducing the Cloud Application Programming Model (CAP)SAP's own general-availability announcement for CAP, laid out as a Golden Path: a data model and service defined in CDS gets a generated service provider that serves metadata publishing and CRUD requests, fills in primary keys and audit data, and writes trace and audit logs without application code. The same CDS model carries annotations that translate to OData vocabularies and generate a Fiori elements app skeleton, which is how Fiori annotations work in CAP.Daniel7, published 2018-06-05
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
AuthenticationSAP and community
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
AuthorizationSAP and community
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
CAP-JAVA implementation for Authorization Management Service (AMS)CAP-JAVA implementation for Authorization Management Service (AMS)Short and deliberately narrow: the author defers the concepts to kevin_li's post and writes only the CAP Java part — the development flow, designing the authorization model, and assigning and checking a policy. Read the other one first; this is the half that touches the code.Harvey_Yao, published 2024-12-27
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP(Cloud Application Programming)开发框架概述SAP CAP(Cloud Application Programming)开发框架概述A Chinese-language walkthrough of CAP built mainly from CAPire's own "About CAP" page: CDS entities, associations, compositions and aspects for data modelling, with an extend Books with @restrict: [{ grant:'WRITE', to:'admin' }] aspect as its authorization example; CQL and CQN queries shown against both a local service and OData's $select/$expand; and the service-and-event model — this.on, this.emit, srv.on — that carries CAP's async processing. It closes with the author's own setup: installing @sap/cds-dk, scaffolding a bookshop project with cds init, and running it with cds watch against local SQLite, mocked authentication and file-based messaging standing in for HANA Cloud, IAS and Kafka.ArthurYang, published 2024-01-07
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesSecuring SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management service (XSUAA), restricting CDS service definitions with @restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds Node.js example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Soumya-Pirlamarla, published 2025-07-14
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Change trackingSAP and community
BTP CAP : Custom plugin to separate generic change log capture logicBTP CAP : Custom plugin to separate generic change log capture logicWalks through building a custom [CAP](ecosystem:cap) plugin that centralises change-log capture: on cds.once('served') it collects entities annotated @audit, then hooks srv.before('UPDATE') to read the existing record, diff it field by field against the incoming payload, and record old/new values with the user and timestamp. It also documents a cds build failure packaging the plugin's own directory into gen/srv for MTA deployment, fixed by adding it as a copyfiles build-parameter step in mta.yaml.sreehari_vpillai, published 2023-05-10
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Open Sourcing CAP – how to learn more or get involvedOpen Sourcing CAP – how to learn more or get involvedA roundup of CAP's open-sourcing, begun at TechEd the year before, pointing to a webinar recording, a podcast episode and reCAP 2023 talks for background. Among the components it names are a feature toggle library giving Node.js CAP apps live-updatable toggles backed by Redis, a new pluggable database layer with SQLite and PostgreSQL implementations plus a generic SQL layer, and a change tracking component that builds a change history for data from CDS models.Fempel, published 2023-10-02
Data privacySAP only
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1First of a three-part series on designing a CAP application on BTP that uses the platform's data privacy services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data Manager, SAP Data Retention Manager, SAP Data Privacy Integration and SAP Audit Log service. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2 and Part 3.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP and community
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
CAPVAL: A project is bornCAPVAL: A project is bornThis second CAPVAL post announces CAPVAL version 2.0, made compatible with CAP v8 after breaking changes there, with the fix shown as a custom cds.middlewares.after error handler. It restates the plugin's @validation.message annotation alongside standard annotations such as @mandatory as the input validation mechanic the project builds on, and the release otherwise adds automated tests and release-automation GitHub Actions rather than new annotations.published 2024-08-26
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Malware scanningSAP only
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
Rate limitingSAP and community
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
ConfigurationSAP only
CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787Four malicious npm package versions published on 29 April 2026 that exfiltrate credentials and propagate into adjacent repositories, and what a CAP developer should check. A security advisory rather than a technique, and dated precisely for that reason.Yogananda, published 2026-05-01
CAP Heaven? Not Yet — But You Can See It from HereCAP Heaven? Not Yet — But You Can See It from HereAn assessment from someone with Java, Azure and AWS behind them as well as ABAP and Fiori, which is a rarer vantage point than it sounds. The title is the verdict.published 2026-02-07
CAP is important because it's not importantCAP is important because it's not importantAn essay rather than a technique: what CAP actually is, what it gives you, and the case for treating it as foundational precisely because it is not the interesting part of an application. Written in 2019, when that argument still had to be made, and the title is the argument. Also recorded as a Tech Aloud podcast episode and a CodeTalk, both linked from the post.published 2019-11-06
CAP, RAP, or Both: Stop Hiding Behind 'It Depends'CAP, RAP, or Both: Stop Hiding Behind 'It Depends'Opens by refusing the answer every other post on this gives — "both are complementary, choose based on context" — and then commits to a framework, including the parts usually left out: the staffing bias behind the decision, and what to do about a landscape with thousands of Z-objects. Argument, not tutorial.published 2026-04-09
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Don't "let it crash", is this the new CAP guideline?Don't "let it crash", is this the new CAP guideline?Dinu traces a change in error handling in CAP's Node.js runtime: @sap/cds@8.2.0 adds a cds.server.shutdown_on_uncaught_errors config flag, defaulting to true, but invoking an operation with an undefined variable no longer takes the server down, with or without the flag, where the same code crashed it on cds@6 and cds@7, and the author notes the old behaviour was already missing in cds@8.1. It still crashes with features.odata_new_adapter turned off to use the old OData parser, so it is the new OData adapter, like the REST adapter before it, that answers an uncaught error with a 500 instead of taking the process down.Dinu, published 2024-09-06
Getting started with cds.ql in NodeJS for CAP - 101 on how to query dataGetting started with cds.ql in NodeJS for CAP - 101 on how to query dataWalks through cds.ql, the query API @sap/cds gives a Node.js CAP service's custom handlers, with worked SELECT, UPDATE, DELETE and INSERT examples against a sample schema — filters, AND/OR conditions, column projections, ordering, limiting, grouping and joining two entities through a schema view. An added correction notes that cds.tx(req) is no longer needed to run a query in newer CAP versions, contradicting the post's own original guidance.published 2022-06-21
Hello React & Vue : SAP CAP’s New UI Layer is Here!Hello React & Vue : SAP CAP’s New UI Layer is Here!CAP gaining a UI layer for React and Vue, which changes the default assumption that the front end is UI5. Short, and the significance is larger than the length.Yogananda, published 2026-06-25
SAP CAPv7 - Node.js Highlights and ExperiencesSAP CAPv7 - Node.js Highlights and ExperiencesAn account of upgrading a 100+ table CAP Node.js project from v6 to v7, working through breaking changes in @sap/cds 7: event handlers now always receive an array, service paths move under /odata/v4/... unless serve_on_root is set, and cds-serve replaces cds run. It goes deepest on the GraphQL plugin, @cap-js/graphql: the /graphql endpoint it serves, Composition results wrapped in a nodes connection, and offset-based pagination reached through OData's top and skip rather than GraphQL's own limit and offset.published 2023-08-03
SAP Cloud Application Programming Model (CAP) - start hereSAP Cloud Application Programming Model (CAP) - start hereThe orientation post for CAP, published in 2018 and revised in 2020 and again in 2021 with help credited to Iwona Hahn — which is the unusual part: a starting-point index that was maintained rather than left to rot, and says so at the top. Read as the shape of what a newcomer was pointed at, and as a marker of how much of that changed inside three years.published 2018-10-10
Tips for running CAP nodejs in SAP BTPTips for running CAP nodejs in SAP BTPDeliberately not a summary of capire: the author says up front that nothing here repeats the documented best practices, and the subject is configuration for running cloud-natively rather than correctly. Examples target Cloud Foundry, with the claim that they hold for Kyma too.published 2023-06-21
Tips for running CAP nodejs in SAP BTP
Deployment changed in @sap/cds-dk 8.9.0, 2025-03-31. Affects Runnable code.
What's new in SAP Cloud Application Programming Model – January 2026What's new in SAP Cloud Application Programming Model – January 2026December and January together: the new @assert feature, revised documentation, CDS editor work, and Kyma deployment additions.published 2026-02-09
What's new in SAP Cloud Application Programming Model – November 2025What's new in SAP Cloud Application Programming Model – November 2025The November edition, led by the Status Transition Flows feature presented at reCAP 2025.published 2025-12-08
What's new in SAP Cloud Application Programming Model – September 2025What's new in SAP Cloud Application Programming Model – September 2025The monthly release communication for CAP itself, and this edition carries the MCP servers and the Application Frontend Service integration. Kept because a dated list of what shipped when is the only record of that; three editions are indexed here rather than the whole run.published 2025-10-14