Everything in CAP / Java
76 of 743
Domain: 2
Signals
Content: 3
Java: Answers in Java
More
Group by: Capability
Domain AI & AgentsDomain Security & ComplianceOffers A referenceOffers Runnable codeOffers A recipeClear all
EntryBySignalsLast activity
Agent access to your codeSAP and community
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Before You Upgrade S/4HANA: Static UI5 Checks with MCPBefore You Upgrade S/4HANA: Static UI5 Checks with MCPA UI5 version upgrade checked against one app by pairing two MCP servers: the ui5_version_diff tool added to mcp-sap-docs, which reads a bundle from ui5-lib-diff downloaded once at setup and filters it by version range, change type, library or query text, and @ui5/mcp-server, whose get_project_info, get_version_info, run_ui5_linter and run_manifest_validation say what the app uses and what fails. Run with a ui5-versions-upgrade.md skill on the legacy app from From SEGW and Legacy UI5 to RAP with ARC-1, from SAPUI5 1.84.59 to 1.147.2, the diff range held 985 deprecations and 961 What's New entries, and the linting and manifest validation narrowed that to findings in this app, among them jQuery.sap.require, synchronous bootstrap, the sap_belize theme, sap.m.MessagePage and an old manifest _version. The checks read the source in a local checkout and never the deployed app, so the report is a first pass: a changelog entry is not proof that a workaround can be deleted, and the app still has to be run and tested.published 2026-05-20
Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Somebody following the CAP MCP server announcement all the way through, and writing down what it cost: a CAP service in VS Code wired to S/4HANA through a destination, plus the real bumps — Windows PATH and global installs — that the announcement does not have.smarchesini, published 2025-09-21
Evaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceEvaluating SAP’s new MCP servers: UI5, CAP, and Fiori tools in practiceSomeone trying SAP's three new MCP servers rather than repeating the announcement. It sets the official positioning first — MCP as the bridge from coding assistants to SAP tooling across Cursor, Windsurf, Copilot, Cline and Claude Code, with best-practice scaffolds and BTP-aligned guardrails — and then reports what using them is actually like. The rare kind of post that tests a vendor claim.published 2025-09-04
From SEGW and Legacy UI5 to RAP with ARC-1From SEGW and Legacy UI5 to RAP with ARC-1Three ARC-1 skills, run in Cursor with Composer-2 against a deliberately rough demo on an S/4HANA 2023 trial system, turn the SEGW service ZDEMO_MIG_PROJECTS_SRV into a managed, draft-enabled RAP business object published as OData V4, replace its ApproveProject function import and its direct UPDATE ... COMMIT WORK with the action approve_project written in EML in local mode, and rebuild the freestyle UI5 JavaScript app once in UI5 TypeScript and once as a Fiori elements list report and object page driven by metadata extensions. What the published transcripts add is how the agent got there: it found the generated MPC class names and the custom logic in DPC_EXT only by reading the system, the skills made it print the extracted model and stop for confirmation before writing, and @ui5/mcp-server, mcp-sap-docs and @sap-ux/fiori-mcp-server each had their own job beside it. The demo is small on purpose, and the post says a productive SEGW service that calls BAPIs, carries custom authorisation logic or supports deep inserts is not solved with one prompt.published 2026-05-11
From SEGW and Legacy UI5 to RAP with ARC-1
@sap-ux/fiori-mcp-server has been through 2 major lines since this was published: 0.7 (2026-05), 1 (2026-05). Affects Runnable code.
Agent guidanceSAP and community
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Building a CAP service with cds‑mcp and Cline — HANDS‑ON SUPER BASIC GUIDE [ with screenshots ] 🍌Somebody following the CAP MCP server announcement all the way through, and writing down what it cost: a CAP service in VS Code wired to S/4HANA through a destination, plus the real bumps — Windows PATH and global installs — that the announcement does not have.smarchesini, published 2025-09-21
Teaching AI Agents Best Practices: A Skills Workspace for CAP DevelopmentTeaching AI Agents Best Practices: A Skills Workspace for CAP DevelopmentStates the gap this capability exists for more precisely than most: an agent already knows CAP well enough to generate models, handlers and deployments, but knowing a framework and following its current practice reliably are different things, because a model defaults to whatever it saw most of during training — which may be outdated, subtly wrong, or simply not how a given team works. Skills are offered as the closing mechanism, and the post describes a workspace pattern rather than a single file, with the architecture claimed to be framework-agnostic.daniel_schlachter, published 2026-06-09
Agent toolingSAP only
Agent-led test management: Hands-on lab with Joule in SAP Cloud ALMAgent-led test management: Hands-on lab with Joule in SAP Cloud ALMThe Test Management Assistant, a Joule capability in SAP Cloud ALM, worked through on project scenarios: scoping requirements, detecting coverage gaps and generating test cases with AI. The edge is to SAP Joule, which the assistant runs on; SAP Cloud ALM has no entry here, and the atlas's testing concern, proving a service's model and handlers, is not this session's test management. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Christina Pickhardt, Daniel Lorenz, Niclas Weidner and Tobias Keller, written here from SAP's abstract; the recording is not yet published.
AI-accelerated RISE with SAP migration with the system transition workbenchAI-accelerated RISE with SAP migration with the system transition workbenchSAP Joule for Consultants and the RISE with SAP system transition workbench in a move to SAP S/4HANA Cloud Private Edition: readiness assessments, migration workflows and the SAP tools involved. The edge is to SAP Joule, of which Joule for Consultants is a part; the system transition workbench has no entry here, and Platform migration covers applications leaving older BTP platforms, not an ERP system's move. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Funkert, Kristin Aleksandrova, Mirja Kempin and Moritz Gysler, written here from SAP's abstract; the recording is not yet published.
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
ARC-1 with Joule Studio: Bringing Real ABAP System Context into JouleARC-1 with Joule Studio: Bringing Real ABAP System Context into JouleBrings the same BTP-deployed ARC-1 endpoint into Joule through a Joule Studio, classic edition agent configured with Anthropic Claude Sonnet 4 and two MCP servers, ARC-1 and mcp-sap-docs, for work that starts in SAP where the previous part started in Microsoft 365. Two read-only showcases carry the ABAP Cloud readiness edge: a clean core check of one class that reports it is not released, uses USR02 and BUT000 directly and has no ATC findings, and a modernisation backlog for package ZSD_LEGACY which, as that package did not exist, grouped 28 ZSD* objects into risk buckets instead. The route through SAP Integration Suite API Management or a future MCP gateway is presented as a target architecture and not yet a productive setup, because Joule Studio's documentation requires streamable HTTP destinations and does not support MCP servers that need interactive OAuth user authorisation.published 2026-05-06
ARC-1 with Joule Studio: Bringing Real ABAP System Context into Joule
arc-1 has been through 2 major lines since this was published: 0.9 (2026-05), 1 (2026-07). Affects Runnable code.
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Building agentic applications with SAP HANA CloudBuilding agentic applications with SAP HANA CloudA CAP application extended with semantic search and agent features on top of SAP HANA Cloud's vector engine and SAP AI Core, built in a hands-on workshop. The abstract names the parts, CAP, the vector engine and AI Core, and the two additions: semantic search, the retrieval half of retrieval-augmented generation, and LLM-supported agent capabilities inside the application, which is agent tooling. Which embedding model, which CAP runtime and how the agent calls its tools are not stated. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Hui Li, Ritty Joseph, Shraddha Shetty and Tanuja Jadhav, written here from SAP's abstract; the recording is not yet published.
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building custom Joule Agents with SAP Knowledge GraphBuilding custom Joule Agents with SAP Knowledge GraphCustom Joule Agents built in a hands-on with SAP Knowledge Graph and Joule Studio: discovering APIs from a user's intent, grounding an agent's answers in business context, and integrating data products for SAP Business Data Cloud. The agents are SAP Joule's; the Knowledge Graph is not an atlas entry, and the abstract does not say which Joule Studio edition the exercises use. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Jan Portisch, Lucas Kiesow, Pavithra G K and Rafael Martin, written here from SAP's abstract; no recording is announced.
Building Durable AI Agents - Announcing the cds-langgraph-persistence PluginBuilding Durable AI Agents - Announcing the cds-langgraph-persistence PluginThe announcement, and the argument behind it. Treating an agent as a software architecture rather than a model with tools makes a list of production requirements — identity, authn and authz, multitenancy, persistence, event-driven flows, scalability, observability, CI/CD — and the author's point is that CAP already answers most of them for BTP, which is what makes LangGraph inside CAP Node.js worth doing. The post then narrows to one of those requirements, durability, and the checkpointer that supplies it. Written from a year of building agents next to real business systems rather than as a framework tour.merbinjanselm, published 2026-07-15
Building Durable AI Agents - Announcing the cds-langgraph-persistence Plugin
@mi8y/cds-langgraph-persistence has been through 3 major lines since this was published: 0.5 (2026-07), 0.6 (2026-07), 0.7 (2026-09). Affects Runnable code.
Building enterprise agent extensions with the Joule Studio solutionBuilding enterprise agent extensions with the Joule Studio solutionExtending SAP's standard agents with third-party integrations and business actions in Joule Studio: agents that run a process across systems, call an external service, put an approval step in the middle and bring the result back into the business context, which is what SAP Joule's agents do and what Joule Studio, classic edition is in the atlas. The abstract names Joule Studio without saying which edition the exercise uses, and lists outcomes rather than the steps built. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Charan Ravikumar, Jacob Hornberger, Maria Kondratyeva and Michael Zadikowitsch, written here from SAP's abstract; the recording is not yet published.
Experience core foundational capabilities of SAP Cloud ERPExperience core foundational capabilities of SAP Cloud ERPGuided exercises in SAP S/4HANA Cloud Public Edition, which SAP calls the execution backbone of the Autonomous Enterprise: validating AI capabilities against master data for industry and domain needs, generating AI-driven KPIs and reporting summaries. The product is an external here and the abstract names no AI feature by name; the edge is to SAP Joule, SAP's AI layer across its applications and the one entry the AI capabilities of SAP Cloud ERP attach to, which the abstract itself does not name. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Akshat Kharial, Ankush Thareja and Nises Soni, written here from SAP's abstract; the recording is not yet published.
Generate agentic workflows using SAP-managed n8n in Joule StudioGenerate agentic workflows using SAP-managed n8n in Joule StudioSAP-managed n8n inside Joule Studio generates a workflow from a business intent a developer states, and the workflow is then tested and deployed, consuming line-of-business application APIs, events and agents in SAP Business AI Platform: process automation with the workflow generated from intent, and agent tooling where the workflow calls agents. The generated workflow sends notifications to the Joule Work mobile app of SAP Joule, to Microsoft Teams or to Slack. SAP's abstract names the pieces and not how the generation or the n8n hosting works. A two-hour hands-on TechEd 2026 session (Tuesday 27 October, Berlin), presented by Rama Sulakshani Murari, Rumen Dimitrov, Seshadri Sreenivas Ramanarayanan and Venugopal Chembrakalathil, written here from SAP's abstract; the recording is not yet published.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Knowledge graph and agent memory: Build an agent that remembersKnowledge graph and agent memory: Build an agent that remembersThe knowledge graph engine in SAP HANA Cloud as an agent's memory: what the engine, the graph side of graph, spatial and document data, does in an agentic workflow, how an agent keeps what it learns there, the state agent tooling holds between turns, and the SAP AI Core integration through which the database calls LLMs and tabular foundation models such as SAP-RPT-1. The abstract names the engine, the memory role and the AI Core link and does not say how the memory is written or read. DA205 on Tuesday 27 October is the 45-minute talk on the same engine, with a near-identical abstract and a different cast. A two-hour hands-on TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christoph Morgen, Jan Zwickel, Markus Fath and Thomas Hammer, written here from SAP's abstract; the recording is not yet published.
SAP Joule for Consultants: Unified knowledge for requirements and designsSAP Joule for Consultants: Unified knowledge for requirements and designsFit-to-standard analysis as a consultant on a cloud transformation project: connecting an organisation's data to SAP Joule for Consultants through SAP AI Core, getting answers from SAP knowledge and that content, then building an expert, loading project files and running guided prompts. The edges are to SAP Joule, of which Joule for Consultants is a part, and to SAP AI Core, named as the connection path; how the data is grounded is left to the session. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Anantharaman Ravi, Natalie Han, Sachin Kaura and Yi Hsuan Lin, written here from SAP's abstract; the recording is not yet published.
Transform business data into AI-supported insightsTransform business data into AI-supported insightsBusiness metrics turned into insights, narratives and recommendations by SAP Joule's agents, with People Intelligence, the SAP Snowflake solution extension for SAP Business Data Cloud and SAP Analytics Cloud connected in SAP Business Data Cloud. The abstract names what is connected and what comes out, and does not say what the exercise builds or where the Snowflake extension sits in it; People Intelligence and the extension are not atlas entries. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Babacar Toure, Maximilian Paul Gander, Neetha Pucknat and San Tran, written here from SAP's abstract; the recording is not yet published.
Document extractionSAP only
Hands on SAP Document AI: Next-generation intelligent document processingHands on SAP Document AI: Next-generation intelligent document processingSAP Document AI configured and run by hand: schema design, splitting and classifying documents, enriching the extracted data and custom prompting are the exercises SAP's abstract names. Document extraction from the configuring side, with the schema the participant's own; which document types or models the exercises use is not stated. A TechEd 2026 hands-on session (Thursday 29 October, Berlin), presented by Christoph Lenschow, Tobias Weller and Tomasz Janasz, written here from SAP's abstract; no recording is announced.
Integrate CAP application as outbound channel for SAP Document AIIntegrate CAP application as outbound channel for SAP Document AIDocument AI will call you back when extraction finishes, and the callback is where this goes wrong: the CAP application has to accept an unauthenticated POST from outside without dropping CSRF protection for everything else. The answer is a middleware hooked into the CAP bootstrap, and the post spends its length on the token lifecycle rather than on the extraction.sdeissenboeck, published 2026-04-22
Integrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepIntegrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepThe forward direction, in full: a PDF or scan arriving at a CAP service, sent to Document Information Extraction, and the fields coming back into the model. Long, and step-by-step in the literal sense — the service binding and the request shapes are all written out.furkan5, published 2025-10-09
SAP Document AISAP Document AISAP's reference architecture for SAP Document AI, first as SAP composes the service on BTP for document extraction: OCR, pretrained models, customer-defined schemas and LLM calls through SAP AI Core and its Prompt Registry in one pipeline, with tenant-isolated persistence in SAP HANA Cloud, PostgreSQL and an object store. Its scenario pages then lay out a solution in three layers: intake through Outlook and SharePoint inbound channels, the workspace UI, the Joule Work mobile app or the upload API; classification and extraction with a confidence score per field, automatic confirmation above a threshold and review of the rest in the workspace; and posting through outbound channels, directly to a REST API, through an SAP Integration Suite flow, or through a CAP service that maps the fields and calls SAP S/4HANA over OData. Enrichment beyond the service's own master data lookup is left to a CAP application or an Integration Suite flow triggered from an outbound channel, and direct API posting leaves error handling, retries and monitoring to the application.published 2026-06-03
Use Free Tier to Create a Service Instance for SAP Document AIUse Free Tier to Create a Service Instance for SAP Document AIFour steps in the SAP BTP cockpit that end with a service key for SAP Document AI: open the cockpit, check the subaccount's entitlements and add the service on the free tier plan if it is not listed, create the instance, then create the key. It names the plans to use in production instead, blocks_of_100, embedded_edition and premium_edition, and stops at the credentials, before any document is uploaded.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
LLM integrationSAP only
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3The concepts before the code: what the GPT model and its API actually offer, and what the finished chat application looks like — personalities included. Written in the weeks when the ground was moving under it, and the post carries its own change log to prove it: GPT-3.5 added on 1 March, GPT-4 on 15 March, and an admission that a series planned as two posts became three.published 2023-02-22
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3The backend: CAP with TypeScript, the entities holding chats and personalities, and the service that talks to the API. This is where the streamed completion and the repositories behind the handler come from, which is the part of the sample still worth lifting even though the model access has since been superseded by AI Core.published 2023-02-24
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3The SAPUI5 frontend of the sample, and mostly an argument for writing UI5 in TypeScript: ES imports in place of sap.ui.define, a class with real private members in place of the underscore convention, and the service types generated from the CDS model copied into the UI package, so one IChats interface types the OData object the controller reads. The second half is structure — a formatter class and a singleton LayoutManager called from the XML view through core:require, a confirmation helper taking a callback, a dialog class resolving a promise, a generic createEntity<T> on a service class — all of it to keep every controller under 100 lines. What it says about arranging a UI5 app holds whatever model sits behind the chat; the tooling around it is of its date, and the post calls UI5's TypeScript support experimental.published 2023-02-27
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3
cds2types. Affects Runnable code.
Agentic CAP: Build MCP servers and enterprise AI agentsAgentic CAP: Build MCP servers and enterprise AI agentsCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCP concern, and SAP AI Core is the LLM integration through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIAn Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIA dormant internal app at SAP Japan revived with AI, built to solve a problem the team actually had — colleagues who could not talk to each other. Build Apps on the front, CAP on Kyma behind it, OpenAI in the middle.javieryw, published 2024-01-31
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAI
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Building agentic applications with SAP HANA CloudBuilding agentic applications with SAP HANA CloudA CAP application extended with semantic search and agent features on top of SAP HANA Cloud's vector engine and SAP AI Core, built in a hands-on workshop. The abstract names the parts, CAP, the vector engine and AI Core, and the two additions: semantic search, the retrieval half of retrieval-augmented generation, and LLM-supported agent capabilities inside the application, which is agent tooling. Which embedding model, which CAP runtime and how the agent calls its tools are not stated. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Hui Li, Ritty Joseph, Shraddha Shetty and Tanuja Jadhav, written here from SAP's abstract; the recording is not yet published.
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
cds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPcds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPNames a cost most CAP-plus-LLM writing ignores: every JSON payload streamed to a model is billed by its verbosity, in latency as well as money. The plugin brings TOON — Token-Oriented Object Notation — to a CAP service so the wire format changes without the service code doing so, in a REST variant and an OData one, with token counts reported on both sides.published 2026-01-25
Data MaskingData MaskingData masking replaces identifiable or confidential text in a prompt with placeholders such as <Person_0> or <Organization_1> before it reaches a large language model, using pattern matching and machine learning to find what to replace. The page states SAP AI Core supports it as a feature and sets out five steps for applying it, defining the masking scope, choosing a technique, preserving the prompt's intent, checking compliance and risk, then testing and monitoring the result. That is the shape data masking takes on the BTP door.
Document GroundingDocument GroundingDocument Grounding is a managed retrieval-augmented-generation service under the Generative AI Hub on BTP, which SAP's page on SAP AI Core places inside that service: it ingests documents from Amazon S3, SharePoint, SAP Document Management Service, SAP Work Zone or an SFTP server, and handles chunking, embedding and retrieval itself, refreshing content automatically when a source document changes. The page states this managed path is recommended for most enterprise scenarios because it covers the whole lifecycle end to end, and offers a separate Document Grounding Vector API for data that is already chunked and embedded, for cases that need finer control over chunking and metadata.
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Enhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginEnhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginStarts from the blank form nobody wants to fill in, and asks what an enterprise application should do about it. The AI is in service of that rather than the subject of it.published 2026-04-29
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
How to Reduce Prompt Token Costs Using Toon = Save MoneyHow to Reduce Prompt Token Costs Using Toon = Save MoneyToken spend treated as a running cost rather than a detail, and TOON as the lever. Companion reading to the CAP adapter for the same format that is indexed here.Yogananda, published 2025-11-12
How to Reduce Prompt Token Costs Using Toon = Save Money
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
Integrating a Custom AI Model into SAP CAP Using AI LaunchpadIntegrating a Custom AI Model into SAP CAP Using AI LaunchpadYour own model rather than a hosted one: deployed to AI Core, made callable through AI Launchpad, then reached from CAP. The case a lot of companies ask about and few posts cover.egeAksoyek, published 2026-03-20
Integrating a Custom AI Model into SAP CAP Using AI Launchpad
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Knowledge graph and agent memory: Build an agent that remembersKnowledge graph and agent memory: Build an agent that remembersThe knowledge graph engine in SAP HANA Cloud as an agent's memory: what the engine, the graph side of graph, spatial and document data, does in an agentic workflow, how an agent keeps what it learns there, the state agent tooling holds between turns, and the SAP AI Core integration through which the database calls LLMs and tabular foundation models such as SAP-RPT-1. The abstract names the engine, the memory role and the AI Core link and does not say how the memory is written or read. DA205 on Tuesday 27 October is the 45-minute talk on the same engine, with a near-identical abstract and a different cast. A two-hour hands-on TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christoph Morgen, Jan Zwickel, Markus Fath and Thomas Hammer, written here from SAP's abstract; the recording is not yet published.
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
Prompt TemplatingPrompt TemplatingPrompt templating replaces a static prompt with a structured, reusable template whose placeholders are filled in at runtime, which the page says helps LLM responses stay consistent and lets the same instructions be adapted across tasks. On SAP AI Core this is implemented through the Prompt Registry, and the page states that storing prompts as plain strings in code is possible but not recommended. That is prompt management as a stored and managed object rather than a string embedded in the caller.
SAP Joule for Consultants: Unified knowledge for requirements and designsSAP Joule for Consultants: Unified knowledge for requirements and designsFit-to-standard analysis as a consultant on a cloud transformation project: connecting an organisation's data to SAP Joule for Consultants through SAP AI Core, getting answers from SAP knowledge and that content, then building an expert, loading project files and running guided prompts. The edges are to SAP Joule, of which Joule for Consultants is a part, and to SAP AI Core, named as the connection path; how the data is grounded is left to the session. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Anantharaman Ravi, Natalie Han, Sachin Kaura and Yi Hsuan Lin, written here from SAP's abstract; the recording is not yet published.
SAP-RPT and TabPFN: Get started with tabular foundation modelsSAP-RPT and TabPFN: Get started with tabular foundation modelsTabular foundation models, SAP-RPT and TabPFN, in a hands-on with SAP and Prior Labs: the model families first, then predictions run through SAP AI Core with a workflow built on tabular orchestration and connected to the participant's own data for real-time predictions. A predictive models session with the models as the subject; the abstract does not name the SDK or API the workflow is built with. A TechEd 2026 hands-on session (Thursday 29 October, Berlin), presented by Eliott Kalfon, Janick Zaehringer-Frasch, Johannes Hoehne, Katharina Schell, Nilay Mehta and Sherene Tan, written here from SAP's abstract; no recording is announced.
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
UI5 AI Features library is now an npm PackageUI5 AI Features library is now an npm PackageThe release note for a demo turning into a dependency, and it is explicit about why that matters: the earlier version worked, but using it meant cloning the repo and copying both halves, which stops working the moment one of them changes. The post walks through what shipping the CAP plugin and the be.wl.ai control library in one npm version buys — a client and server contract that cannot drift — then lists the eleven controls by group, shows the two-line configuration that activates each half, and notes that this version is actually deployed on BTP behind both a standalone approuter and Work Zone. It closes on the demo repository, written with no library source in it as the test that the package stands alone.published 2026-08-31
UI5 AI Features library is now an npm Package
cds 8, line ended. Affects Runnable code.
RAG on CDSUnmapped
Building agentic applications with SAP HANA CloudBuilding agentic applications with SAP HANA CloudA CAP application extended with semantic search and agent features on top of SAP HANA Cloud's vector engine and SAP AI Core, built in a hands-on workshop. The abstract names the parts, CAP, the vector engine and AI Core, and the two additions: semantic search, the retrieval half of retrieval-augmented generation, and LLM-supported agent capabilities inside the application, which is agent tooling. Which embedding model, which CAP runtime and how the agent calls its tools are not stated. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Hui Li, Ritty Joseph, Shraddha Shetty and Tanuja Jadhav, written here from SAP's abstract; the recording is not yet published.
Document GroundingDocument GroundingDocument Grounding is a managed retrieval-augmented-generation service under the Generative AI Hub on BTP, which SAP's page on SAP AI Core places inside that service: it ingests documents from Amazon S3, SharePoint, SAP Document Management Service, SAP Work Zone or an SFTP server, and handles chunking, embedding and retrieval itself, refreshing content automatically when a source document changes. The page states this managed path is recommended for most enterprise scenarios because it covers the whole lifecycle end to end, and offers a separate Document Grounding Vector API for data that is already chunked and embedded, for cases that need finer control over chunking and metadata.
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
HANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingHANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingTwo ways to produce the same embedding, run side by side: HANA Cloud's own VECTOR_EMBEDDING function against Azure OpenAI through the CAP LLM plugin. The CDS side is short — an element of type cds.Vector maps to REAL_VECTOR on deploy — so what remains is the comparison, which is the thing you cannot get from either product's documentation alone.lalitmohan, published 2025-04-09
RAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPRAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPThe end-to-end version: a CAP service exposing the vector engine and the AI hub behind a couple of endpoints, answering where a CodeJam is on a given date. It has aged in a way the author has marked in the page itself — the section on the CAP LLM plugin now carries "(Outdated)" in its own heading — so read the embedding preparation and the retrieval shape, and check the plugin part against the package.KevinR, published 2024-05-21
Using HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPUsing HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPEmbeddings generated inside the database rather than fetched from AI Core or an external model — a Q4 2024 HANA Cloud function, used from CAP. The shift it describes is where the embedding step lives, which changes what has to be deployed and what has to be called.published 2025-03-02
Tool governanceUnmapped
A Clearer View of Your SAP Integrations Under the New API PolicyA Clearer View of Your SAP Integrations Under the New API PolicyThe SAP API Policy Evidence Skill assesses one SAP interface or usage pattern at a time against SAP API Policy v.4.2026a, reading evidence from five MCP servers, among them servers for the Business Accelerator Hub and SAP Notes, mcp-sap-docs and a read-only ARC-1, and returns one of four labels with a confidence level, an evidence table, residual risk and questions for SAP. It gives no compliant or not compliant answer on purpose, because SAP's FAQ (Q49) declines to publish a binding decision matrix, and it sends legal, commercial and roadmap questions to SAP and lowers its confidence when a source is not connected. Four sample runs show the method, among them ODP-RFC extraction labelled likely not aligned under SAP Note 3255746 and the same API_SALES_ORDER_SRV assessed differently for an autonomous agent behind a custom gateway and for a Boomi middleware flow; the SAP Notes and Business Accelerator Hub servers read SAP sites through a browser login, which the post says to use at your own risk.published 2026-06-02
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Audit loggingSAP only
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
AuthenticationSAP only
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
AuthorizationSAP only
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Change trackingSAP only
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Data privacyUnmapped
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP only
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP