Everything in CAP / Java
64 of 743
Domain: 2
Signals
Content: 3
Java: Answers in Java
More
Group by: Capability
Domain Integration & MessagingDomain Security & ComplianceOffers A referenceOffers Runnable codeOffers A recipeClear all
EntryBySignalsLast activity
Async processingSAP only
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
DestinationsSAP only
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Connecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAPConnecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAPMail from CAP through a company's own SMTP server rather than a hosted one, which is the case the existing answers did not cover — the author names them and says why each failed here: one needed an SMTP provider like Mailtrap, another solved it in Java. What is left is the connectivity: an on-premise mail destination reached from Node, and a hybrid profile to test it against.codebrokerad, published 2023-02-14
Connecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAP
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Consume SOAP Web Services in SAP Cloud Application Programming ModelConsume SOAP Web Services in SAP Cloud Application Programming ModelCalling a SOAP service from CAP — the case the remote-service story does not cover, since CAP's own import path speaks OData and OpenAPI.SAP
Establishing connectivity between a local CAP runtime and on-premise systemsEstablishing connectivity between a local CAP runtime and on-premise systemsReaching S/4HANA, an on-premise HANA or any HTTP service from a CAP process running on your laptop — the case where the connectivity proxy the platform provides is not there and the tunnel has to be arranged.vLeonkev, published 2025-10-15
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
Extending SAP Sales and Service Cloud V2 Using CAPExtending SAP Sales and Service Cloud V2 Using CAPAn extension target that does not run on BTP at all — Sales and Service Cloud V2 sits directly on hyperscalers — so the separation between core and extension is enforced rather than encouraged. That constraint is what makes the post worth reading.Quablab, published 2025-07-09
How to Access On-premise OData from the Business Application Studio - CAPM DevelopmentHow to Access On-premise OData from the Business Application Studio - CAPM DevelopmentA destination-naming constraint found the hard way and then corrected in public: the post carries its own update saying that with a CAPM app, a standard destination works through the studio's proxy as long as the name matches [a-z0-9-]. The update credits a comment on the post, so the correction and its source are both in the record.laszlo_kajan2, published 2020-06-02
How to Access On-premise OData from the Business Application Studio - CAPM Development
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
How to Call a Remote OData API from Your Local CAP Java ProjectHow to Call a Remote OData API from Your Local CAP Java ProjectThe Business Accelerator Hub sandbox called from a CAP Java project on a laptop, with a concrete finish line — a localhost URL that returns business partners. Everything needed to get there is listed, Maven and JDK versions included.Umezuki, published 2025-08-11
Implementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsImplementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsWhy environment variables are the wrong place for backend endpoints in a CAP application, and what replaces them: cockpit destinations resolved at runtime, with the subaccount or instance identified as the request is handled. The argument is about redeployment — an endpoint kept in the environment means a deploy every time it moves — and the shape it produces is one codebase serving several landscapes without a build per landscape.Dnyaneshwar Salve, published 2026-03-18
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelInvoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelThe other direction: consuming an API described by an OpenAPI document from CAP, rather than publishing one. Worth pairing with the plugin entries here, which all serve the outbound half.wittro, published 2022-08-30
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming Model
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Part 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsPart 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsThe substantial part of a side-by-side extensibility series: CAP Node.js, Cloud SDK and Fiori elements against S/4HANA Cloud. Eighteen thousand characters, and the one to read if you only read one.former_member748, published 2020-12-01
Part 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
Part 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsPart 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsThe second part, continuing the same extension. Opens with a recap of the stack rather than of the steps, which makes it readable on its own.former_member748, published 2020-12-20
Part 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP CAP Remote Services & SAP Fiori ElementsSAP CAP Remote Services & SAP Fiori ElementsWhat happens to a generated UI when the data is not local: a CAP service projecting a remote one, with Fiori elements on top. The author explored it to find out where the abstraction holds, which is the useful register for this.Former Member, published 2021-05-20
SAP CAP Remote Services & SAP Fiori Elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKSAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKThe same thing again through SAP Cloud SDK, published as a deliberate comparison with the part before it — the author says outright that it does what the previous post did, differently. Reading both is how you see what the SDK is actually doing for you.CarlosRoggan, published 2019-07-26
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDK
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発SFSFとHANA Cloudを使用するCAPのアプリケーション開発In Japanese. A hands-on taking data between SuccessFactors and HANA Cloud through a CAP application — the connection setup, the data and service models, then read and write logic, and a Cloud Foundry deploy. Long enough to carry its own table of contents.rasai, published 2022-12-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Use SCP CF Destination service in NodeJs locallyUse SCP CF Destination service in NodeJs locallyReading a destination from a laptop, where the environment variable the destination service normally provides does not exist. A small gap with a real cost, since the alternative is deploying to test every change to a remote call.WouterLemaire, published 2020-05-28
Use SCP CF Destination service in NodeJs locally
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Use the SAP Cloud SDK in the SAP Cloud Application Programming ModelUse the SAP Cloud SDK in the SAP Cloud Application Programming ModelReaching for the Cloud SDK from inside a CAP service, for the calls CAP's own remote services do not make.SAP
Document outputUnmapped
Generating PDF on BTP CF using CAP and PuppeteerGenerating PDF on BTP CF using CAP and PuppeteerA headless browser rendering the PDF, which is the answer people reach for when the document is really a web page. The Cloud Foundry part is the difficulty: Puppeteer needs a browser in the buildpack, and that is what the post is actually about.ltomazeli58, published 2024-03-28
How to Generate and Download PDFs on the fly without persisting in CAP ApplicationHow to Generate and Download PDFs on the fly without persisting in CAP ApplicationStreaming a generated document straight to the client without writing it anywhere first — which sidesteps the retention question a stored file creates, and is the distinction worth having beside the attachments capability.HarsithKumarReddy, published 2024-06-18
Using Custom Actions to display PDF from SAP BTP Forms service into a CAP SAPUI5 applicationUsing Custom Actions to display PDF from SAP BTP Forms service into a CAP SAPUI5 applicationA requirement that arrived after the application was finished — render a PDF from the record currently open on an object page — and the join it needed: the Forms service bound to the CAP application, a custom action on the service, and a button on the object page header calling it.rodfior, published 2023-01-30
Event MeshSAP only
[Blog Post] SAP Event Mesh - Consuming S4 events simultaneously in CAP-based applications and SAP Integration Suite[Blog Post] SAP Event Mesh - Consuming S4 events simultaneously in CAP-based applications and SAP Integration SuiteOne S/4HANA event, two consumers at once: a CAP Java application and SAP Integration Suite. Late in a long Deep Dive series and written as such — the queues, the S/4HANA connection and the Integration Suite side were all established in earlier posts, so this is the part where they meet.AyushKumar and vipul.khullar, published 2023-03-24
[Blog Post] SAP Event Mesh - Consuming S4 events simultaneously in CAP-based applications and SAP Integration Suite
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects Runnable code.
[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant Scenario[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant ScenarioThe instalment of the Deep Dive series where the framework arrives. The earlier posts consumed Event Mesh over its REST API, so this one is explicitly a comparison: the same thing through CAP's messaging abstraction, with the three flavours — local, file-based and a real broker — named before the broker one is built.AyushKumar and vipul.khullar, published 2022-06-06
[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant Scenario
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
Complete Guide: Setting Up CAP Plugin for Advanced Event Mesh with OAuth AuthenticationComplete Guide: Setting Up CAP Plugin for Advanced Event Mesh with OAuth AuthenticationWritten because the plugin's own documentation stops short of the prerequisites and the author had to assemble them from three other sources and a help chapter. It joins them: the OIDC application in Identity Authentication, the OAuth profile in Broker Manager, the token checked before anything is wired, and only then the plugin. The author says plainly it came out of trial and error and was going to be a README.rpagni, published 2025-11-10
Event Driven Architecture with Event Mesh - Part-1Event Driven Architecture with Event Mesh - Part-1Continues the author's own CDS entity-relationship example rather than starting a fresh one, which is the point of it — the same model gains events. Concepts first, then a message client and queue on BTP, then a Postman check that the queue works before any CAP code is written, and finally the emit from a CAP REST service.Avinash_Vaidya, published 2022-12-04
Event Driven Architecture with Event Mesh - Part-1
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
Event Driven Architecture with Event Mesh – Part-2Event Driven Architecture with Event Mesh – Part-2Part 1 published a message and stopped there; this closes the loop by giving it somewhere to go. A REST API built in Integration Suite is registered as a webhook on the Event Mesh queue, and the chain is run end to end — CAP to Event Mesh to Integration Suite to Twilio — so the consumer side and the webhook configuration are what this adds.Avinash_Vaidya, published 2023-01-30
Event Driven Architecture with Event Mesh – Part-2
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
How to use a CAP application to manage DMQ messages on SAP Advanced Event MeshHow to use a CAP application to manage DMQ messages on SAP Advanced Event MeshA CAP application built for the failure path rather than the happy one. Messages that land in a Dead Message Queue are deleted for good when their TTL expires, so this pulls them out first and holds them in quarantine, where a Fiori elements UI lets someone inspect a payload, correct it and reinject it. An operations tool, and a rare write-up of what to do after delivery has already failed.stefan-keuker, published 2025-12-31
How to use a CAP application to manage DMQ messages on SAP Advanced Event Mesh
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects Runnable code.
Implementing Event-Driven Architecture in CAP Java using SAP Event MeshImplementing Event-Driven Architecture in CAP Java using SAP Event MeshPublish and consume from the Java stack, which most of the Event Mesh writing on the community does not cover. The MTA declaration and the credentials come first, then the emit and the handler, then the two sections that make it worth keeping: error handling with retries, and securing the events with OAuth.Soumya-Pirlamarla, published 2025-11-26
Implementing Event-Driven Architecture in CAP Java using SAP Event Mesh
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Publish events from CAP Node.js applications to Event Mesh of Integration SuitePublish events from CAP Node.js applications to Event Mesh of Integration SuiteThe smallest complete example: cds init, a service with one function, cds.connect.to('messaging') and an emit to a topic. Deliberately scoped — the Event Mesh setup is skipped and the subaccount is assumed to be the same one — so what remains is the handful of lines on the CAP side and the binding that makes them reach the broker.KevinWang_ST_Consultancy, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration Suite
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Triggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) AppsTriggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) AppsThe two routes out of a CAP application into a process, side by side: a destination with OAuth2ClientCredentials, the same destination with principal propagation, and Event Mesh with a CloudEvents payload. Written before @cap-js/process existed, so it is the record of what the plugin now does for you — useful when the plugin does not fit, and useful for reading what it is actually doing underneath.ATheobaldt, published 2024-12-09
Triggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) Apps
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe, Runnable code.
Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 1/2Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 1/2The theory half of a pair introducing cds-kafka: what the plugin is for and what it can do, with event-driven architecture set up as the reason rather than assumed. Nothing is deployed here — the running application is part two — so this is the post to read if the question is whether Kafka belongs in the picture at all rather than how to wire it.published 2025-01-02
Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 2/2Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 2/2The practical half: concrete use cases for cds-kafka, running locally and on BTP. It opens by placing the plugin among SAP's own event-driven offerings rather than beside them, which is the part that decides whether you reach for this or for Event Mesh — a comparison a plugin's own README rarely makes about itself.published 2025-01-13
NotificationsSAP only
Connecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAPConnecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAPMail from CAP through a company's own SMTP server rather than a hosted one, which is the case the existing answers did not cover — the author names them and says why each failed here: one needed an SMTP provider like Mailtrap, another solved it in Java. What is left is the connectivity: an on-premise mail destination reached from Node, and a hybrid profile to test it against.codebrokerad, published 2023-02-14
Connecting On Premise Mail Destination and Sending Email Using SAP Cloud SDK JavaScript Version 3 on SAP CAP
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
RFC connectivityUnmapped
Consume ABAP RFC Function Modules in CAPConsume ABAP RFC Function Modules in CAPCalling an existing RFC function module from CAP instead of asking somebody to build an OData service for it — which is the actual decision, since the alternative is custom development on the ABAP side for a function that already works.published 2025-03-28
Introducing open-rfc: Calling SAP RFC from Node.js Without the SDKIntroducing open-rfc: Calling SAP RFC from Node.js Without the SDKopen-rfc is a TypeScript and JavaScript RFC client for Node.js with no runtime dependencies and no SAP NetWeaver RFC SDK, written after SAP archived node-rfc and PyRFC and while the connector below @sap/cds-rfc needs an S-user, an SAP Build Code licence and a private registry. The history of RFC connectivity from Node.js is the first half; the second shows the package on its own, as an npm alias for node-rfc, and through an npm override as the connector below an unchanged @sap/cds-rfc. The 0.2.3 beta stops at direct application-server connections with password authentication and classic Unicode RFC: no message-server load balancing, SNC, tRFC, qRFC, bgRFC or server mode.published 2026-08-10
Audit loggingSAP only
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
AuthenticationSAP only
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
AuthorizationSAP only
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Change trackingSAP only
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Data privacyUnmapped
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP only
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP