Everything in CAP / Java
78 of 743
Domain: 2
Signals
Content: 3
Java: Answers in Java
More
Group by: Capability
Domain Protocols & APIsDomain Security & ComplianceOffers A recipeOffers Runnable codeOffers The reasoningClear all
EntryBySignalsLast activity
Error handlingSAP only
Effective Axios Error Logging for Robust SAP IntegrationsEffective Axios Error Logging for Robust SAP IntegrationsTwo logged failures printed side by side, and the point is made by looking at them: one tells you what went wrong and one does not. Axios buries the useful part of an HTTP error, and this is what to unwrap before logging it from a CAP service.Sahil2508, published 2025-08-31
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
GraphQLUnmapped
CAP: GraphQL as new protocolCAP: GraphQL as new protocolWritten days after @cap-js/graphql appeared, by somebody who went looking for it — an introduction to GraphQL alongside what the adapter actually does to a CAP service. The first outside account of the capability, and still one of very few.jhodel18, published 2023-03-18
CAP: GraphQL as new protocol
@cap-js/graphql has been through 11 major lines since this was published, most recently 0.12 (2025-05), 0.13 (2025-07), 0.14 (2025-10). Affects Runnable code.
SAP GraphQL in CAPm (node.js)SAP GraphQL in CAPm (node.js)Adding the GraphQL protocol adapter to a CAP project when it was new — an entity, some data, the feature switched on, and a check that it answers. Short, and it is the earliest account here of CAP speaking something other than OData.enric101, published 2021-11-29
Metadata publishingSAP only
CAP, CDS, CDL, CSN and jq - finding associationsCAP, CDS, CDL, CSN and jq - finding associationsHow associations are actually represented once CDL is compiled into CSN, worked out by parsing the machine-readable form with jq. Useful less as a recipe than as a way in: anything that wants to reason about a CDS model without the compiler has to read CSN, and this is what that looks like from the outside.published 2024-04-16
ODataSAP and community
#BTP #SAPCAP: Quirky Nuggets (N03-N04)#BTP #SAPCAP: Quirky Nuggets (N03-N04)Two unrelated findings in one post, which is the format of the series: the OData operators tried against a CAP service — with a schema of deliberately awkward types to try them on — and undeploying database artifacts, which is the half people hit in anger. Numbered N03 and N04 of a run that continues either side.Ajit_K_Panda, published 2023-06-05
#BTP #SAPCAP: Quirky Nuggets (N03-N04)
Deployment changed in @sap/cds-dk 8.9.0, 2025-03-31. Affects A recipe, Runnable code.
Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4The write-up behind ODATANO, by its author: how a public blockchain gets reachable from CAP as an ordinary OData V4 service rather than through a bespoke client. The premise it starts from is worth the read on its own — SAP systems are trusted but mutable, which is what an immutable anchor is for — and Cardano is chosen for peer-reviewed research and formal methods rather than for popularity. Written as an experiment with feedback invited, not as a recommendation.maxalexweber, published 2026-05-15
AI-assisted full stack development using model context protocol serversAI-assisted full stack development using model context protocol serversMCP servers in Visual Studio Code used to configure, query and change a full-stack application built with CAP, CDS and OData: the agent access to your code concern, a coding assistant reading and changing the project it works in. The abstract names no server, so neither @cap-js/mcp-server nor any other is attached, and it does not say which changes are made. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Sergio Guerrero, written here from SAP's abstract; the recording is not yet published.
Calling bound / unbound CAP actions from Fiori elements application.Calling bound / unbound CAP actions from Fiori elements application.invokeAction from the Fiori elements Edit flow API, with the difference between bound and unbound actions spelled out first because the call shape differs. Under three thousand characters and it answers exactly one question.vidhyasagarmule, published 2024-09-07
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Create a Business Service using CDS, Node.js, SQLite and a OData serviceCreate a Business Service using CDS, Node.js, SQLite and a OData serviceThe stack at its smallest — CDS, Node, SQLite, an OData service — worked through at length. Nothing cloud in it, which is the point: it is the shape of a CAP service before any of the platform arrives.raybanton, published 2021-07-12
Create a Business Service using CDS, Node.js, SQLite and a OData service
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Custom Functions in OData V4 – SAP Cloud Application Programming ModelCustom Functions in OData V4 – SAP Cloud Application Programming ModelFunctions rather than actions, and the distinction is where it starts: a function must return data and must never change any, so it is the read-only half of custom operations. Then how to declare and implement one on a CAP service.Roopa_N, published 2021-04-28
Custom Functions in OData V4 – SAP Cloud Application Programming Model
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe.
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
How to add OData v2 adapter proxy to your CAP projectHow to add OData v2 adapter proxy to your CAP projectThe problem is stated in one line — a UI5 application that only speaks OData v2 in front of a CAP service that speaks v4 — and the answer is a proxy in the middle rather than a rewrite of either end. Written while v4 support in the UI5 stack was still patchy, which is the whole reason the adapter exists.published 2020-06-30
How to add OData v2 adapter proxy to your CAP project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects Runnable code.
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
Resolving date serialization issues when using an external OData v2 service with CAPResolving date serialization issues when using an external OData v2 service with CAPDates coming out of an external OData v2 service in a shape CAP does not expect, and what to do about it. A narrow bug report with a fix, and the kind of thing that costs an afternoon if nobody has written it down.pieterjanssens, published 2020-07-09
SAP BTP SDK for iOS & CAP with OData V4 supportSAP BTP SDK for iOS & CAP with OData V4 supportThe iOS SDK gaining OData V4, which until then made connecting a native app to a CAP service awkward — CAP defaults to v4 and the SDK did not speak it. Short, and it marks the date that stopped being a problem.KRiedelsheimer, published 2021-04-21
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKSAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKThe same thing again through SAP Cloud SDK, published as a deliberate comparison with the part before it — the author says outright that it does what the previous post did, differently. Reading both is how you see what the SDK is actually doing for you.CarlosRoggan, published 2019-07-26
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDK
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
The Complete Guide to Calling Actions in UI5 with Custom CodeThe Complete Guide to Calling Actions in UI5 with Custom CodeWritten because the documentation is thin and the samples sparse, and openly as a note to the author's future self — hand-coding an action call has become a rare task for anyone mostly working in Fiori elements, which is exactly why it is hard to look up when it comes round. Comes with a CAP sample project, so the service half is there too.published 2025-07-21
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectThe End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectOne CAP service exposing OData V2, OData V4 and REST at the same time, which is unusual enough to be worth the read on its own. Part of an end-to-end series, deployed on Cloud Foundry against HANA Cloud, so the protocol question sits inside a whole application rather than a snippet.KRiedelsheimer, published 2021-05-06
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single Project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
OpenAPIUnmapped
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceAdding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceThe problem stated from the other side of the wire: a CAP and HANA backend consumed by frontend developers with no SAP background, who said in the first meeting that they could not work from what the service offered. A browsable API page is the answer, and this is the post the Swagger UI plugin indexed here exists to serve.published 2020-01-23
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js Service
cds-swagger-ui-express has been through 11 major lines since this was published, most recently 0.9 (2024-07), 0.10 (2024-10), 0.11 (2026-02). Affects Runnable code.
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelInvoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelThe other direction: consuming an API described by an OpenAPI document from CAP, rather than publishing one. Worth pairing with the plugin entries here, which all serve the outbound half.wittro, published 2022-08-30
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming Model
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Swagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsSwagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsA blog post wrapped around a video playlist from the SAP HANA Academy — Swagger UI for CDS, added to the BTP extension generator series. The written half is an ingredients list and a table of contents; the substance is in the recordings.dvankempen, published 2021-07-09
Serve your application over MCPSAP only
Add MCP capabilities to a CAP serviceAdd MCP capabilities to a CAP serviceA fifteen-minute walkthrough of turning a plain CAP service into an MCP server: annotate the service with @mcp, install @cap-js/mcp, and it is served alongside OData at /mcp/<path>. The part worth reading it for is what happens next — cds watch writes the endpoint into the local agent's own configuration file, so OpenCode or Claude Code can call the service without anyone editing JSON by hand. It is built on the tiny-sample facet, so there is nothing to prepare, and it shows the protocol traffic rather than only the result. Written while the adapter was in beta, and it says so.published 2026-08-13
Agentic CAP: Build MCP servers and enterprise AI agentsAgentic CAP: Build MCP servers and enterprise AI agentsCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCP concern, and SAP AI Core is the LLM integration through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
CAP Node.js Expert Session #6 - The MCP AdapterCAP Node.js Expert Session #6 - The MCP AdapterDaniel Schlachter and DJ Adams add @cap-js/mcp to a bookshop service, inspect its describe, query and action tools, and query the catalogue through an AI agent. The session distinguishes this runtime adapter from the development-time MCP server and demonstrates automatic registration of the running service with a local agent. The recording describes the adapter as beta in July 2026, with read-only queries and writes through unbound actions.
Examine the details of the Model Context Protocol on startupExamine the details of the Model Context Protocol on startupWhat the MCP adapter actually does when a CAP server boots, watched rather than described — the companion to the tutorial that switches it on.
Model Context Protocol Adapter — CAP guideModel Context Protocol Adapter — CAP guideDocuments @cap-js/mcp and com.sap.cds:cds-adapter-mcp, service annotations, generated describe/query/call tools and local client setup. The guide records Java doc-comment configuration, unbound-action-based data changes, incomplete XSUAA PKCE support and the adapter’s governance boundaries.
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
The Easiest Way to Expose a CAP Node.js Project as an MCP ServerThe Easiest Way to Expose a CAP Node.js Project as an MCP ServerFrom cds init to a running MCP server in a handful of steps, ending at the MCP Inspector so the result is something you can see rather than something you have to trust. The claim it makes for the plugin is the absence of work: no REST wiring by hand, the CAP application exposed as a server because the package is installed. A walkthrough rather than an argument — the reasoning about what should be exposed lives elsewhere.Jacky Liu, published 2026-07-03
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
WebSocketUnmapped
A Practical Real-Time CTI Widget for SAP Sales Cloud V2A Practical Real-Time CTI Widget for SAP Sales Cloud V2A small CAP backend, a WebSocket channel and a UI5 widget in an iframe — enough to get telephony events into Sales Cloud without any custom backend inside the CRM. The smallness is the design.gizemsoylutr, published 2025-11-28
CAP WebSocketsCAP WebSocketsThe early one, from 2021, before an adapter existed to make it ordinary. Read for what the problem looked like when it had to be solved by hand.vvdries, published 2021-01-26
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
Audit loggingSAP only
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
AuthenticationSAP only
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicesRoad map: SAP Business AI Platform security and SAP Cloud Identity ServicesThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity Services and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
AuthorizationSAP only
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Change trackingSAP only
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Data privacyUnmapped
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP only
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Rate limitingUnmapped
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.