onedevatlasBeta
Browse the atlas
AllCAPUI5ABAPBTP
All CAPNode.jsJava
CapabilityData & Persistence

Attachments

Storing a file somebody uploaded next to the record it belongs to, and getting it back out — where the bytes actually live, who may read them, and what the UI shows while they are being scanned.

Overview

SAP SHIPS
Node.js →

@cap-js/attachments An official CAP Node.js plugin for attachment handling, with local database storage and AWS S3, Azure Blob or GCP Object Store integration.

@cap-js/sdm Stores attachments in an SAP Document Management repository instead of a bucket, for the case where the documents have to live in the system of record.

@sap/cds Serves an element annotated @Core.MediaType as an OData media resource, stored in the database as a LargeBinary or redirected to an external URL, streamed to and from the client.

Java →

com.sap.cds:cds-feature-attachments A CAP Java attachments package that adds an Attachments aspect and stores content in the database by default, or in AWS, Azure or Google Object Store through a separate module.

com.sap.cds:sdm A CAP Java plugin that stores attachments in an SAP Document Management repository through an Attachments aspect, with draft handling and direct creation on active entities; versioned repositories are excluded.

Not covered: The built-in layer stops at one binary element: no metadata aspect, no storage beyond the database or a redirect URL, no malware scan, and in Node.js SQLite reads a LargeBinary whole rather than streaming it. The Node.js and Java SDM plugins exclude versioned repositories. In Node.js attachments, Fiori elements requires draft enablement; non-draft clients create metadata and upload content in separate requests.

Scanning depends on configuration: Node.js attachments rejects uploads when scanning is enabled but no scanner is available; Java attachments marks files Clean when no scanner is available.

Built into @sap/cds
SourceServing Media Data — capirechecked
THE COMMUNITY ADDS

cap-attachments-plus documents storage in the application owner’s cloud account through BTP destinations; sap-cap-sdm-plugin maps CDS fields to CMIS properties and exposes CMIS and administration clients. @tklein1801/cap-js-attachments documents a draft-based attachment flow with shared Object Store tenant prefixes.

cap-attachments-plus@tklein1801/cap-js-attachmentssap-cap-sdm-plugin

Artifacts9

9 of 9 artifacts
ArtifactSignals
CDS plugins5
@cap-js/attachmentsCAP Node.js attachments with database, S3, Azure or GCP storage
Signals
none
@cap-js/sdmCAP attachments stored in an SAP Document Management repository
Signals
Functional boundary
@tklein1801/cap-js-attachmentsCAP Node.js attachments plugin with Object Store and malware scanning
Signals
none
cap-attachments-plusCAP Node.js attachments plugin with database or cloud storage
Signals
none
sap-cap-sdm-pluginCAP Node.js plugin mapping CDS entities to SAP Document Management
Signals
Archived+1
Packages3
@sap/cdsCAP Node.js runtime
Signals
none
com.sap.cds:cds-feature-attachmentsCAP Java attachments with database storage and an Object Store module
Signals
Functional boundary
com.sap.cds:sdmCAP Java plugin for attachments in SAP Document Management
Signals
Functional boundary
Services1
SAP Document Management service, integration optionAPIs and a UI5 component for document management in apps
Signals
none

Tasks5Beta

CoversCovers, under conditionsStated not supportedAssessed, not knownNot assessed
Keep attachment content out of the application database4 under conditions, 1 not known

A deployed CAP application keeps uploaded file content in an object store or a document repository, and keeps only the metadata and a reference in its own database.

Choosing between AWS, Azure and Google, and entitlement to any of them, are project questions and are not assessed. Moving content already written to the database is not covered by any source read here. Nothing here establishes that a deployment was run.

Covers, under conditions@cap-js/attachmentsWith a storage target configured, the content goes to that target and the database keeps the reference and the metadata. The README states that productive use requires a valid object store binding.

Conditions: A valid SAP Object Store binding exists for the deployed application.

Remaining work: Provision and bind the Object Store service and set the storage target kind per profile. Without the binding the productive path is the one the README rules out, not a fallback to the database.

Open artifact →

Covers, under conditions@cap-js/sdmPuts the documents in an SAP Document Management repository rather than a bucket, for the case where the files belong in a repository the business already keeps.

Conditions: An SAP Document Management integration option service instance and key exist. A repository is onboarded with those credentials and its id is configured for the deployment.

Remaining work: Create the instance and key, onboard the repository and configure its id in the deployment descriptor before anything is stored.

Open artifact →

Covers, under conditionscom.sap.cds:cds-feature-attachmentsThe base dependency stores attachments in the database. A separate module, cds-feature-attachments-oss, puts them in an AWS, Azure or Google object store instead and keeps only a reference in the database.

Conditions: The cds-feature-attachments-oss module is used as the storage target module. A valid Object Store service binding exists for the application.

Remaining work: Add the oss module and provision the binding. The base dependency alone leaves the content in the database, which is the state this task is trying to leave.

Open artifact →

Covers, under conditionscom.sap.cds:sdmThe Java counterpart of the same route: the documents go to an SAP Document Management repository the application is bound to.

Conditions: An SAP Document Management integration option service instance and key exist and the application is bound to the instance. A repository is onboarded with those credentials and its id is added to the deployment descriptor.

Remaining work: Create the instance and key, bind the application to it and onboard the repository before anything is stored.

Open artifact →

Assessed, not knowncap-attachments-plusThe graph records a claim dated 2026-09-17 that this plugin stores cloud content in the application owner's own AWS, Azure or GCP account through a BTP destination, which would be the one option here that keeps the bytes outside SAP's service. That claim has not been re-established.

Remaining work: Retrieve the npm README again. https://www.npmjs.com/package/cap-attachments-plus returned HTTP 403 on 2026-09-19 and again on 2026-09-20, and the package has no public repository to read instead.

Open artifact →

Keep each subscriber's attachments apart in a multitenant CAP application2 covers, 3 under conditions

Each subscriber of a multitenant CAP application uploads and reads only its own attachments, and that tenant's content is removed when it unsubscribes.

Tenant isolation in the database, and the subscription mechanics themselves, belong to multitenancy and are assessed there. Whether a subaccount is entitled to one Object Store instance per tenant is a project question. Nothing here establishes that a subscription or an unsubscription was observed.

Covers@cap-js/sdmSeparates tenants by repository rather than by key prefix: one is provisioned when a tenant subscribes and cleaned up when it unsubscribes.

Remaining work: Deploy the onboarding and offboarding code the README shows. The lifecycle is automated once that code is in place, not before.

Open artifact →

Coverscom.sap.cds:sdmOffers onboarding and offboarding APIs for repositories in a multitenant CAP SaaS application, so a tenant gets a repository rather than a share of one. What an unsubscription does when the repository cannot be deleted is stated: it fails, unless the repository was not found.

Remaining work: Call those APIs from the application's own subscription handling.

Open artifact →

Covers, under conditions@cap-js/attachmentsIn separate mode, the default since 2.1.0, the plugin creates an object store instance for each tenant when it subscribes and deletes it when it unsubscribes. A shared instance can be configured instead, and there the README states that attachment URLs carry the tenant id and says nothing about removing a tenant's content.

Conditions: Separate mode is in use, which is the mode the README states per-tenant provisioning and deletion for, and the default from version 2.1.0. @cap-js/attachments is in the dependencies of both the application and the mtx sidecar.

Remaining work: Add the plugin to both package.json files, choose separate or shared instances before the first subscription, and bind the shared instance to the mtx module when shared is chosen. On the shared instance the removal half of this outcome is not stated.

Open artifact →

Covers, under conditionscom.sap.cds:cds-feature-attachmentsWith an object store as the storage target, one bucket serves every tenant, keys are prefixed with the tenant id and a tenant's data is cleaned up on unsubscribe. With SAP HANA as the target the README puts multitenancy on the consuming application.

Conditions: An object store is the storage target, and the package is at version 1.5.0 or later. With SAP HANA as the storage target, multitenancy support depends on the consuming application.

Remaining work: On the SAP HANA target the application provides the isolation itself, and the README names a schema per tenant as the usual arrangement without specifying what the package does about it.

Open artifact →

Covers, under conditions@tklein1801/cap-js-attachmentsStates readiness for multitenancy on a shared object store instance, with attachment URLs prefixed by the tenant id. It documents the prefixing and not the provisioning.

Conditions: A shared SAP Object Store instance with a bucket already exists and is reachable.

Remaining work: Provide the shared instance and its bucket. The README requires one to exist rather than creating it per tenant.

Open artifact →

Keep version history for an attached document1 covers, 3 no, 1 not known

A document attached to a business record keeps its earlier versions, so a reader can see what the file was before it was replaced.

Change tracking of the record's own fields is a different concern. Whether a customer is entitled to SAP Document Management is a project question. Versioning inside a bucket, configured on the storage service rather than by the application, is outside what these packages document. Nothing here establishes that any alternative route was built or run.

CoversSAP Document Management service, integration optionThe service under both plugins names versioning among the document management capabilities it offers, and offers its APIs for an application to build its own document management layer on.

Remaining work: Build the record association and the upload path against those APIs. Neither CAP plugin covers a versioned repository, so this route leaves the Attachments aspect behind.

Open artifact →

Stated not supported@cap-js/attachmentsThe README addresses replacement rather than versions. By default the Attachments aspect marks the content non-updatable, so an upload to an attachment that already has content is rejected with 409; with that annotation overridden the upload overwrites the existing content. Neither path produces a second version, and the README names no place where the earlier file survives.

Remaining work: Keep the earlier file somewhere other than the attachment: a second record, or the document management APIs. Whether the configured storage target retains a previous object is a question for that service and is not answered here.

Open artifact →

Stated not supported@cap-js/sdmThe plugin rules out versioned repositories, so the repository that would hold the versions is the one it cannot be pointed at.

Remaining work: Either drop the version requirement, or reach the document management APIs from the application without this plugin in the path.

Open artifact →

Stated not supportedcom.sap.cds:sdmStates the same exclusion in the same words as its Node.js counterpart, so switching runtime does not open the route.

Remaining work: Either drop the version requirement, or reach the document management APIs from the application without this plugin in the path.

Open artifact →

Assessed, not knowncom.sap.cds:cds-feature-attachmentsThe pinned README documents storage targets, the scanner and multitenancy. Re-read on 2026-09-20, it states nothing about replacing the content of an existing attachment and nothing about earlier versions, so the Node.js answer cannot be carried across.

Remaining work: Establish what happens to the previous content on replacement, from the plugin's model or the CAP Java documentation.

Open artifact →

Scan an uploaded attachment before anyone can download it2 covers, 3 under conditions

A file a user uploads is scanned for malware, and a file that was never scanned does not reach a reader carrying the same status as one that was.

How well a scanner detects anything is not assessed. What the application does with an infected file, and the wording it shows a user, are its own handling. Nothing here establishes that a scan was observed running.

Covers@cap-js/attachmentsWith scanning left enabled and no scanner available, the upload fails, so the file does not get stored unscanned. Download is tied to the status: the README states that an attachment cannot be downloaded unless its status is Clean.

Remaining work: Bind the SAP Malware Scanning service, or disable scanning deliberately per profile. The plugin states the two outcomes; picking between them is the application's decision.

Open artifact →

Coverscom.sap.cds:cds-feature-attachmentsDownload is tied to the status here too: only an attachment marked Clean is accessible. With no scanner available the attachments are marked Clean automatically, so a file nobody scanned reaches a reader through the same gate as a scanned one.

Remaining work: Bind a service instance labelled malware-scanner. Until then a Clean status says nothing about the file, which is the fact this flavor has to be checked for.

Open artifact →

Covers, under conditions@cap-js/sdmScanning happens at the SAP Document Management repository rather than in the plugin, on repositories onboarded with virus scanning. With it switched on, uploads above 400 MB are rejected with HTTP 409 before any data is streamed, and the same README's Known Restrictions state a 100 MB maximum for attachments.

Conditions: The repository is onboarded with virus scanning enabled. Files above 400 MB are rejected rather than scanned when virus scanning is on.

Remaining work: Enable virus scanning when the repository is onboarded, decide what the application does with a file the repository refuses on size, and establish which of the two stated size figures applies to an upload.

Open artifact →

Covers, under conditionscom.sap.cds:sdmNames malware scan and Trend Micro scan on repositories onboarded with virus scanning, and puts a size limit on what is scanned: only attachments up to 400 MB.

Conditions: The repository is onboarded with virus scanning enabled. Only attachments up to 400 MB are scanned.

Remaining work: Decide what happens to a file above the scanned size. The README's localization example ships a message key telling a user that files larger than 400 MB cannot be uploaded to a virus-scan repository, and states the outcome nowhere else.

Open artifact →

Covers, under conditions@tklein1801/cap-js-attachmentsAn independent plugin that states scanning on for every profile except development, so the developer machine is the one place a file goes unscanned. The scanner it reaches is the SAP Malware Scanning service, bound as malware-scanner.

Conditions: An SAP Malware Scanning service instance the application can access already exists. That instance is bound with cds bind malware-scanner.

Remaining work: Provide the service instance and bind it. The README requires one to exist and creates nothing.

Open artifact →

Upload an attachment from a client that is not SAP Fiori elements3 under conditions, 1 not known

A caller that is not an SAP Fiori elements UI, such as a test client, a custom front end or another service, creates an attachment record against an existing business record and uploads its content.

The upload control and the client code that drives it are a UI question and are not assessed here. Who may read the file afterwards belongs to authorization. Nothing here establishes that any of these paths was run end to end.

Covers, under conditions@cap-js/attachmentsDraft enablement is stated as an SAP Fiori elements requirement rather than a plugin one. A caller outside Fiori elements creates the attachment metadata and uploads the content in two separate requests it writes itself.

Conditions: The client is not SAP Fiori elements, in which case draft enablement is not required. The caller issues metadata creation and content upload as separate HTTP requests.

Remaining work: Write and maintain the two-request sequence in the calling client. The README points at tests/non-draft-request.http as the example and ships no client.

Open artifact →

Covers, under conditions@cap-js/sdmStates full support for attachments on non-draft, active entities, with the plugin handling create, update and delete on the attachment entity directly rather than through a draft.

Conditions: The entity is not annotated with @odata.draft.enabled. An SAP Document Management integration option service instance and key exist, a repository is onboarded and its id is configured for the deployment.

Remaining work: Model the entity without the draft annotation, then write the client against the active entity. The README rules the annotation out for non-draft attachment support and states nothing about what a caller has to send when the annotation is kept.

Open artifact →

Covers, under conditionscom.sap.cds:sdmStates that attachments can be created directly on active, non-draft entities: the leading application triggers the insert on the attachment entity and the plugin picks the content up from there.

Conditions: The leading application triggers an INSERT on the attachment entity through the ApplicationService, or the DraftService that extends it. An SAP Document Management integration option service instance and key exist, the application is bound to the instance and a repository is onboarded.

Remaining work: Implement that insert in the leading application. The README documents the entry point, not the calling client.

Open artifact →

Assessed, not knowncom.sap.cds:cds-feature-attachmentsThe pinned README documents storage targets, the malware scanner and multitenancy. Re-read on 2026-09-20, it names no draft annotation, no DraftService and no request sequence, so what a caller outside SAP Fiori elements has to send is not stated. Absence of a statement is not a refusal.

Remaining work: Retrieve the CAP Java attachments documentation on capire and the plugin's own draft handling before this flavor can be answered.

Open artifact →

Task answers1

Connected task assessments · source-read · includes assessments awaiting editorial review

Attach a document to a business record and retrieve it later

CAP Node.js

Awaiting editorial review · assessed · no Atlas runtime testing

  • cap-attachments-plus · Independent · implementation

    Attachment aspect and upload/download UI; own-account AWS, Azure or GCP storage through a BTP destination.

  • @cap-js/attachments · SAP official · implementation

    Attachment handling through the official CAP Node.js plugin.

  • @sap/cds · SAP official · foundation

    Documented media streaming foundation rather than a complete attachment user flow.

cap-attachments-plus · conditional

Attachment aspect and upload/download UI; own-account AWS, Azure or GCP storage through a BTP destination.

Conditions: Fiori elements uses a draft-enabled entity.; Cloud storage requires account credentials and a Destination service binding.

Remaining work: Configure storage, authorization and scanning for the application; the development scanner can be mocked.

cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06

@cap-js/attachments · conditional

Attachment handling through the official CAP Node.js plugin.

Conditions: Fiori elements requires draft enablement.; Productive use requires a valid Object Store binding.

Remaining work: Configure storage and scanning and establish business-record authorization.

@cap-js/attachments README · checked 2026-10-06

@sap/cds · conditional

Documented media streaming foundation rather than a complete attachment user flow.

Conditions: Model a media element and its MIME type.

Remaining work: Implement record association, access control and the upload interface.

CAP — Serving Media Data · checked 2026-10-06

Prototype assessment awaiting review · assessed . No Atlas runtime testing.

Related knowledge

Serving Media Data

Official reference for the streaming foundation.

Why included: Reading explains the documented implementation contribution. · SAP CAP documentation

Attachments plugin guide

Setup and storage requirements for the official plugin.

Why included: Reading explains the documented implementation contribution. · cap-js

cap-attachments-plus guide

Maintainer documentation for attachment handling and own-account storage.

Why included: Reading explains the documented implementation contribution. · npm

CAP Framework (Cloud Application Programming Model)

Source subject or learning resource; applicability is established separately by the scoped assessment.

Why included: The CAP framework subject is broader than the Node.js runtime. This is a route to context, not package identity or compatibility. · SAP Developers

Why this assessment is relevant
  1. Attach a document to a business record and retrieve it later → CAP Node.js
Relationships and evidence (15)

  • cap-attachments-plus → provides → Attachments

    Adds an Attachments aspect and Fiori elements upload facet. Cloud attachment content is stored in the application owner’s AWS, Azure or GCP account using credentials from a BTP destination; local development can store content in the database.

    Basis: atlas-record

    plus — README · checked 2026-09-17Credentials come from a **BTP destination** you create yourself

    plus — README · checked 2026-09-17For scenarios where the entity is not draft-enabled, for example [`tests/non-draft-request.http`](./tests/non-draft-request.http), separate HTTP requests for metadata creation and asset uploading need to be performed manually.

    plus — README · checked 2026-09-17The plugin's own `[development]` profile default already wires up a **mocked** scanner (`kind: "malwareScanner-mocked"`) that always reports `Clean` without calling any real service.

    plus — README · checked 2026-09-17Each cloud provider reads its configuration directly from a BTP destination, pointing at your own AWS, Azure or GCP account rather than an SAP Object Store service instance.

  • @cap-js/attachments → provides → Attachments

    Adds the Attachments aspect, Fiori annotations and file handling to CAP Node.js. Database storage is used locally; productive use requires an Object Store binding. Fiori elements requires draft enablement, while non-draft clients send separate metadata and content requests.

    Basis: atlas-record

    cap-js/attachments — README · checked 2026-09-17- **AWS S3** (`kind: "s3"`) - **Azure Blob Storage** (`kind: "azure"`) - **GCP Cloud Storage** (`kind: "gcp"`)

    cap-js/attachments — README · checked 2026-09-17For scenarios where the entity is not draft-enabled, for example [`tests/non-draft-request.http`](./tests/non-draft-request.http), separate HTTP requests for metadata creation and asset uploading need to be performed manually.

    cap-js/attachments — README · checked 2026-09-17If there is no malware scanner available and the scanner is not disabled, then the upload will fail.

    cap-js/attachments — README · checked 2026-09-17For productive use, a valid object store binding is required, see [Object Stores](#object-stores) and [Storage Targets](#storage-targets).

    cap-js/attachments — README · checked 2026-09-17If you are not using SAP Fiori elements, draft enablement is not required.

  • @sap/cds → provides → Attachments

    Serves an element annotated @Core.MediaType as an OData media resource, stored in the database as a LargeBinary or redirected to an external URL, streamed to and from the client.

    Basis: atlas-record

    Serving Media Data — capire · checked 2026-09-27CAP provides out-of-the-box support for serving media and other binary data. Media data can be stored either directly in the database or in an external repository, and can be streamed to and from clients.

    Serving Media Data — capire · checked 2026-09-27The media data is streamed automatically.

  • Attach a document to a business record and retrieve it later → associatedWith → Attachments

    Discover the shared task through the Attachments concern.

    Basis: pilot-assessment

  • Serving Media Data → explains → @sap/cds

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • Attachments plugin guide → explains → @cap-js/attachments

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • cap-attachments-plus guide → explains → cap-attachments-plus

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

  • CAP Framework (Cloud Application Programming Model) → contextualizes → @sap/cds

    The CAP framework subject is broader than the Node.js runtime. This is a route to context, not package identity or compatibility.

    Basis: pilot-mapping

    Mapping: about · pending-human-review · authored from cited sources · checked 2026-10-06

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → assesses → Attach a document to a business record and retrieve it later

    One shared outcome, one scoped assessment.

    Basis: pilot-assessment

  • cap-attachments-plus → contributesTo → CAP Node.js

    Attachment aspect and upload/download UI; own-account AWS, Azure or GCP storage through a BTP destination.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

  • @cap-js/attachments → contributesTo → CAP Node.js

    Attachment handling through the official CAP Node.js plugin.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • @sap/cds → contributesTo → CAP Node.js

    Documented media streaming foundation rather than a complete attachment user flow.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → reading → Serving Media Data

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → reading → Attachments plugin guide

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • CAP Node.js → reading → cap-attachments-plus guide

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

Gaps, source snapshot and retrieval limits
  • This assessment does not establish repository versioning, retention policy or tenant isolation for a chosen deployment.
  • Independent origin follows the existing atlas artifact classification; it is not a license or quality rating.
  • Retrieval uses at most four typed steps within a bounded source index. Source relationships do not establish compatibility.

Developers snapshot checked 2026-10-05 · 33 indexed records from a 9,023-node source snapshot. This is a bounded retrieval view; absence is not evidence that no solution exists. Source relationships and proximity do not establish runtime compatibility.

Mapping version: connected-tasks-2026-10-06-v4+mcp-records-b256b58cfb844590. Task and mapping evidence remain separate from implementation evidence.

Drafted with AI

Content14

Group by14 of 14 pieces
Piece, what it offers
Attachments14
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AI
SAP Community, Shahid, Blog
Media Handling in SAP CAPM – Backend and Frontend Implementation
SAP Community, Talari Hari Kumar, BlogThe reasoningA recipeRunnable code
Major updates to the Attachments plugin – multi-cloud support, malware scanning and more
SAP Community, rupamaity, BlogThe reasoningA recipeRunnable code
Version drift
Show 11 more
Uploading attachment with cap-js/attachment plugins but via External App/Postman
SAP Community, chrisobar, BlogThe reasoning
Building an Attachment Upload and Download Solution Using UploadSetwithTable Control
SAP Community, AyhamT, BlogThe reasoningRunnable code
Use SAP Document Management Service Plugin In CAP NODEJS Step by Step Guidance
SAP Community, Jacky_Liu1, BlogThe reasoningA recipeRunnable code
Unlocking Efficiency: Leveraging SAP BTP Document Management Service in Fiori Applications # 2
SAP Community, prajnaparmita, BlogThe reasoningA recipeRunnable code
Consume SAP Document Management using @cap-js/sdm plugin
SAP Community, rashmiangadi, BlogThe reasoningA recipeRunnable code
Extend Upload Set with Table to Fiori Elements and utilize Object Store
SAP Community, Kazuhiko Takata, BlogThe reasoningRunnable code
Core changed
Working with the Attachment plugin - Cloud Application Programming
SAP Community, Arun Krishnamoorthy, BlogThe reasoningA recipeRunnable code
New majors
Extend Upload Set to Fiori Elements and utilize Document Management Service
SAP Community, Kazuhiko Takata, BlogThe reasoningRunnable code
Core changed
Upload attachments in a Freestyle UI5 and CAP app
SAP Community, Wouter Lemaire, BlogThe reasoning
Presenting sap-cap-sdm-plugin: Effortless Integration Between CAP (Node.js) and DMS
SAP Community, Vinícius Barrionuevo, BlogThe reasoningRunnable code
Archived
How to transfer file from CAP backside
SAP Community, frank_xie, BlogThe reasoningRunnable code
Core changed
com.sap.cds:cds-feature-attachments1
Major updates to the Attachments plugin – multi-cloud support, malware scanning and more
SAP Community, rupamaity, BlogThe reasoningA recipeRunnable code
Version drift
@cap-js/attachments3
Major updates to the Attachments plugin – multi-cloud support, malware scanning and more
SAP Community, rupamaity, BlogThe reasoningA recipeRunnable code
Version drift
Uploading attachment with cap-js/attachment plugins but via External App/Postman
SAP Community, chrisobar, BlogThe reasoning
Working with the Attachment plugin - Cloud Application Programming
SAP Community, Arun Krishnamoorthy, BlogThe reasoningA recipeRunnable code
New majors
@cap-js/sdm2
Use SAP Document Management Service Plugin In CAP NODEJS Step by Step Guidance
SAP Community, Jacky_Liu1, BlogThe reasoningA recipeRunnable code
Consume SAP Document Management using @cap-js/sdm plugin
SAP Community, rashmiangadi, BlogThe reasoningA recipeRunnable code
sap-cap-sdm-plugin1
Presenting sap-cap-sdm-plugin: Effortless Integration Between CAP (Node.js) and DMS
SAP Community, Vinícius Barrionuevo, BlogThe reasoningRunnable code
Archived

Seen working2

ArtifactSignals
Samples2
attachment-reuse-controls-sampleFiori Elements page embedding upload controls on @cap-js/attachments
No license
cap-mediaMedia handling in core CDS with a UI5 UploadSet
No license

Details

Connected knowledge — wider context1

Source connections explain where this sits. Implementation claims remain in their exact task assessment.

Attach a document to a business record and retrieve it later · CAP Node.js
View scoped assessment

Prototype assessment awaiting review · assessed . No Atlas runtime testing.

Related knowledge

Serving Media Data

Official reference for the streaming foundation.

Why included: Reading explains the documented implementation contribution. · SAP CAP documentation

Attachments plugin guide

Setup and storage requirements for the official plugin.

Why included: Reading explains the documented implementation contribution. · cap-js

cap-attachments-plus guide

Maintainer documentation for attachment handling and own-account storage.

Why included: Reading explains the documented implementation contribution. · npm

CAP Framework (Cloud Application Programming Model)

Source subject or learning resource; applicability is established separately by the scoped assessment.

Why included: The CAP framework subject is broader than the Node.js runtime. This is a route to context, not package identity or compatibility. · SAP Developers

Why this assessment is relevant
  1. Attach a document to a business record and retrieve it later → CAP Node.js
Relationships and evidence (15)

  • cap-attachments-plus → provides → Attachments

    Adds an Attachments aspect and Fiori elements upload facet. Cloud attachment content is stored in the application owner’s AWS, Azure or GCP account using credentials from a BTP destination; local development can store content in the database.

    Basis: atlas-record

    plus — README · checked 2026-09-17Credentials come from a **BTP destination** you create yourself

    plus — README · checked 2026-09-17For scenarios where the entity is not draft-enabled, for example [`tests/non-draft-request.http`](./tests/non-draft-request.http), separate HTTP requests for metadata creation and asset uploading need to be performed manually.

    plus — README · checked 2026-09-17The plugin's own `[development]` profile default already wires up a **mocked** scanner (`kind: "malwareScanner-mocked"`) that always reports `Clean` without calling any real service.

    plus — README · checked 2026-09-17Each cloud provider reads its configuration directly from a BTP destination, pointing at your own AWS, Azure or GCP account rather than an SAP Object Store service instance.

  • @cap-js/attachments → provides → Attachments

    Adds the Attachments aspect, Fiori annotations and file handling to CAP Node.js. Database storage is used locally; productive use requires an Object Store binding. Fiori elements requires draft enablement, while non-draft clients send separate metadata and content requests.

    Basis: atlas-record

    cap-js/attachments — README · checked 2026-09-17- **AWS S3** (`kind: "s3"`) - **Azure Blob Storage** (`kind: "azure"`) - **GCP Cloud Storage** (`kind: "gcp"`)

    cap-js/attachments — README · checked 2026-09-17For scenarios where the entity is not draft-enabled, for example [`tests/non-draft-request.http`](./tests/non-draft-request.http), separate HTTP requests for metadata creation and asset uploading need to be performed manually.

    cap-js/attachments — README · checked 2026-09-17If there is no malware scanner available and the scanner is not disabled, then the upload will fail.

    cap-js/attachments — README · checked 2026-09-17For productive use, a valid object store binding is required, see [Object Stores](#object-stores) and [Storage Targets](#storage-targets).

    cap-js/attachments — README · checked 2026-09-17If you are not using SAP Fiori elements, draft enablement is not required.

  • @sap/cds → provides → Attachments

    Serves an element annotated @Core.MediaType as an OData media resource, stored in the database as a LargeBinary or redirected to an external URL, streamed to and from the client.

    Basis: atlas-record

    Serving Media Data — capire · checked 2026-09-27CAP provides out-of-the-box support for serving media and other binary data. Media data can be stored either directly in the database or in an external repository, and can be streamed to and from clients.

    Serving Media Data — capire · checked 2026-09-27The media data is streamed automatically.

  • Attach a document to a business record and retrieve it later → associatedWith → Attachments

    Discover the shared task through the Attachments concern.

    Basis: pilot-assessment

  • Serving Media Data → explains → @sap/cds

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • Attachments plugin guide → explains → @cap-js/attachments

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • cap-attachments-plus guide → explains → cap-attachments-plus

    Reading explains the documented implementation contribution.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

  • CAP Framework (Cloud Application Programming Model) → contextualizes → @sap/cds

    The CAP framework subject is broader than the Node.js runtime. This is a route to context, not package identity or compatibility.

    Basis: pilot-mapping

    Mapping: about · pending-human-review · authored from cited sources · checked 2026-10-06

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → assesses → Attach a document to a business record and retrieve it later

    One shared outcome, one scoped assessment.

    Basis: pilot-assessment

  • cap-attachments-plus → contributesTo → CAP Node.js

    Attachment aspect and upload/download UI; own-account AWS, Azure or GCP storage through a BTP destination.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

  • @cap-js/attachments → contributesTo → CAP Node.js

    Attachment handling through the official CAP Node.js plugin.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • @sap/cds → contributesTo → CAP Node.js

    Documented media streaming foundation rather than a complete attachment user flow.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → reading → Serving Media Data

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    CAP — Serving Media Data · checked 2026-10-06The media data is streamed automatically.

  • CAP Node.js → reading → Attachments plugin guide

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    @cap-js/attachments README · checked 2026-10-06For productive use, a valid object store binding is required

  • CAP Node.js → reading → cap-attachments-plus guide

    Curated supporting reading for this assessment.

    Basis: pilot-assessment

    cap-attachments-plus npm README, latest 1.0.29 at retrieval · checked 2026-10-06Credentials come from a **BTP destination** you create yourself

Gaps, source snapshot and retrieval limits
  • This assessment does not establish repository versioning, retention policy or tenant isolation for a chosen deployment.
  • Independent origin follows the existing atlas artifact classification; it is not a license or quality rating.
  • Retrieval uses at most four typed steps within a bounded source index. Source relationships do not establish compatibility.

Developers snapshot checked 2026-10-05 · 33 indexed records from a 9,023-node source snapshot. This is a bounded retrieval view; absence is not evidence that no solution exists. Source relationships and proximity do not establish runtime compatibility.

Mapping version: connected-tasks-2026-10-06-v4+mcp-records-b256b58cfb844590. Task and mapping evidence remain separate from implementation evidence.

What changed — and what it makes stale3
@cap-js/sdm 1.0.0, CAP

A second official plugin arrived for the case where the bytes have to live in SAP Document Management rather than a bucket. Before it, the object-store plugin was the only officially supported destination for attachment bytes; after it, the same create, open, delete, rename, virus-scan and draft handling is available against an SDM repository instead.

Makes stale:

Guidance that treats @cap-js/attachments' object-store backend as the only officially supported place attachment bytes can live.

Sourcecap-js/sdm — Release v1.0.0checked
@cap-js/attachments 1.1.0, CAP

The plugin gained automatic malware scanning of uploaded files via SAP Malware Scanning Service, with a status per attachment (Unscanned, Scanning, Infected, Clean, Failed). Before it, a file accepted by the plugin was stored and served with no scan of its contents.

Makes stale:

Advice that malware scanning has to be wired up separately when using the plugin. Since May 2024 it runs by default outside the development profile, and is opted out of rather than into.

Sourcecap-js/attachments — Release v1.1.0checked
@cap-js/attachments 1.0.0, CAP

The core gained a dedicated attachments plugin. Before it, putting a file next to a record meant modelling a LargeBinary element with @Core.MediaType and hand-writing upload, storage and retrieval handlers; after it, annotating an entity with the Attachments aspect gives upload, SAP Object Store storage and retrieval without hand-written handlers.

Makes stale:

Guidance that treats attachment storage as something you always build yourself on top of LargeBinary. That was the only approach before March 2024; LargeBinary is still the mechanism underneath, but the plugin is now the point of entry.

Sourcecap-js/attachments — Release v1.0.0checked
Coverage
statecore and community, CAP
assessed
relationshipunassessed
domainData & Persistence
also inUI5, ABAP, BTP/BAIP
SourceServing Media Data — capirechecked SourceServing Media Data — capirechecked SourceServing Media Data — capirechecked SourceCAP plugins — Attachments and SAP Document Managementchecked Sourcecap-js/sdm — READMEchecked Sourcecap-java/sdm — READMEchecked Sourcecap-js/attachments — READMEchecked Sourcecap-js/attachments — READMEchecked Sourcecap-js/attachments — READMEchecked Sourcecap-java/cds-feature-attachments — READMEchecked
Comparison properties4

These are the questions used to compare what the artifacts do. Values come from their documentation and may apply to a particular ecosystem or runtime. Each recorded value in the comparison opens its statement and sources.

Storage targetUpload flowScan behaviourVersioned repositories
For your agent
Ref
capability:attachments
JSON
/capabilities/attachments.json
MCP
Connecting an agent