Everything in CAP / Java
55 of 738
Domain: 2
Signals
Content: 3
Java: Answers in Java
More
Group by: Capability
Domain Protocols & APIsDomain Security & ComplianceOffers A recipeOffers A referenceOffers Runnable codeClear all
EntryBySignalsLast activity
Error handlingSAP only
Effective Axios Error Logging for Robust SAP IntegrationsEffective Axios Error Logging for Robust SAP IntegrationsTwo logged failures printed side by side, and the point is made by looking at them: one tells you what went wrong and one does not. Axios buries the useful part of an HTTP error, and this is what to unwrap before logging it from a CAP service.Sahil2508, published 2025-08-31
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
GraphQLUnmapped
CAP: GraphQL as new protocolCAP: GraphQL as new protocolWritten days after @cap-js/graphql appeared, by somebody who went looking for it — an introduction to GraphQL alongside what the adapter actually does to a CAP service. The first outside account of the capability, and still one of very few.jhodel18, published 2023-03-18
CAP: GraphQL as new protocol
@cap-js/graphql has been through 11 major lines since this was published, most recently 0.12 (2025-05), 0.13 (2025-07), 0.14 (2025-10). Affects Runnable code.
ODataSAP and community
#BTP #SAPCAP: Quirky Nuggets (N03-N04)#BTP #SAPCAP: Quirky Nuggets (N03-N04)Two unrelated findings in one post, which is the format of the series: the OData operators tried against a CAP service — with a schema of deliberately awkward types to try them on — and undeploying database artifacts, which is the half people hit in anger. Numbered N03 and N04 of a run that continues either side.Ajit_K_Panda, published 2023-06-05
#BTP #SAPCAP: Quirky Nuggets (N03-N04)
Deployment changed in @sap/cds-dk 8.9.0, 2025-03-31. Affects A recipe, Runnable code.
Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4The write-up behind ODATANO, by its author: how a public blockchain gets reachable from CAP as an ordinary OData V4 service rather than through a bespoke client. The premise it starts from is worth the read on its own — SAP systems are trusted but mutable, which is what an immutable anchor is for — and Cardano is chosen for peer-reviewed research and formal methods rather than for popularity. Written as an experiment with feedback invited, not as a recommendation.maxalexweber, published 2026-05-15
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Create a Business Service using CDS, Node.js, SQLite and a OData serviceCreate a Business Service using CDS, Node.js, SQLite and a OData serviceThe stack at its smallest — CDS, Node, SQLite, an OData service — worked through at length. Nothing cloud in it, which is the point: it is the shape of a CAP service before any of the platform arrives.raybanton, published 2021-07-12
Create a Business Service using CDS, Node.js, SQLite and a OData service
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Custom Functions in OData V4 – SAP Cloud Application Programming ModelCustom Functions in OData V4 – SAP Cloud Application Programming ModelFunctions rather than actions, and the distinction is where it starts: a function must return data and must never change any, so it is the read-only half of custom operations. Then how to declare and implement one on a CAP service.Roopa_N, published 2021-04-28
Custom Functions in OData V4 – SAP Cloud Application Programming Model
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe.
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
How to add OData v2 adapter proxy to your CAP projectHow to add OData v2 adapter proxy to your CAP projectThe problem is stated in one line — a UI5 application that only speaks OData v2 in front of a CAP service that speaks v4 — and the answer is a proxy in the middle rather than a rewrite of either end. Written while v4 support in the UI5 stack was still patchy, which is the whole reason the adapter exists.published 2020-06-30
How to add OData v2 adapter proxy to your CAP project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects Runnable code.
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKSAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKThe same thing again through SAP Cloud SDK, published as a deliberate comparison with the part before it — the author says outright that it does what the previous post did, differently. Reading both is how you see what the SDK is actually doing for you.CarlosRoggan, published 2019-07-26
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDK
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
The Complete Guide to Calling Actions in UI5 with Custom CodeThe Complete Guide to Calling Actions in UI5 with Custom CodeWritten because the documentation is thin and the samples sparse, and openly as a note to the author's future self — hand-coding an action call has become a rare task for anyone mostly working in Fiori elements, which is exactly why it is hard to look up when it comes round. Comes with a CAP sample project, so the service half is there too.published 2025-07-21
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectThe End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectOne CAP service exposing OData V2, OData V4 and REST at the same time, which is unusual enough to be worth the read on its own. Part of an end-to-end series, deployed on Cloud Foundry against HANA Cloud, so the protocol question sits inside a whole application rather than a snippet.KRiedelsheimer, published 2021-05-06
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single Project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
OpenAPIUnmapped
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceAdding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceThe problem stated from the other side of the wire: a CAP and HANA backend consumed by frontend developers with no SAP background, who said in the first meeting that they could not work from what the service offered. A browsable API page is the answer, and this is the post the Swagger UI plugin indexed here exists to serve.published 2020-01-23
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js Service
cds-swagger-ui-express has been through 11 major lines since this was published, most recently 0.9 (2024-07), 0.10 (2024-10), 0.11 (2026-02). Affects Runnable code.
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelInvoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelThe other direction: consuming an API described by an OpenAPI document from CAP, rather than publishing one. Worth pairing with the plugin entries here, which all serve the outbound half.wittro, published 2022-08-30
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming Model
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Serve your application over MCPSAP only
Add MCP capabilities to a CAP serviceAdd MCP capabilities to a CAP serviceA fifteen-minute walkthrough of turning a plain CAP service into an MCP server: annotate the service with @mcp, install @cap-js/mcp, and it is served alongside OData at /mcp/<path>. The part worth reading it for is what happens next — cds watch writes the endpoint into the local agent's own configuration file, so OpenCode or Claude Code can call the service without anyone editing JSON by hand. It is built on the tiny-sample facet, so there is nothing to prepare, and it shows the protocol traffic rather than only the result. Written while the adapter was in beta, and it says so.published 2026-08-13
Agentic CAP: Build MCP servers and enterprise AI agentsAgentic CAP: Build MCP servers and enterprise AI agentsCAP applications become AI agents over the Model Context Protocol and the Agent2Agent protocol, which is the serve your application over MCP concern, and SAP AI Core is the LLM integration through which AI is embedded in a CAP app, with recommendations from the SAP-RPT-1 model as the abstract's example. The abstract names the two protocols and the one model and does not say which packages carry them. A two-hour TechEd 2026 session in a hands-on room (Tuesday 27 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Sami Lechner, written here from SAP's abstract; the recording is not yet published.
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
CAP Node.js Expert Session #6 - The MCP AdapterCAP Node.js Expert Session #6 - The MCP AdapterDaniel Schlachter and DJ Adams add @cap-js/mcp to a bookshop service, inspect its describe, query and action tools, and query the catalogue through an AI agent. The session distinguishes this runtime adapter from the development-time MCP server and demonstrates automatic registration of the running service with a local agent. The recording describes the adapter as beta in July 2026, with read-only queries and writes through unbound actions.
Examine the details of the Model Context Protocol on startupExamine the details of the Model Context Protocol on startupWhat the MCP adapter actually does when a CAP server boots, watched rather than described — the companion to the tutorial that switches it on.
Model Context Protocol Adapter — CAP guideModel Context Protocol Adapter — CAP guideDocuments @cap-js/mcp and com.sap.cds:cds-adapter-mcp, service annotations, generated describe/query/call tools and local client setup. The guide records Java doc-comment configuration, unbound-action-based data changes, incomplete XSUAA PKCE support and the adapter’s governance boundaries.
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
The Easiest Way to Expose a CAP Node.js Project as an MCP ServerThe Easiest Way to Expose a CAP Node.js Project as an MCP ServerFrom cds init to a running MCP server in a handful of steps, ending at the MCP Inspector so the result is something you can see rather than something you have to trust. The claim it makes for the plugin is the absence of work: no REST wiring by hand, the CAP application exposed as a server because the package is installed. A walkthrough rather than an argument — the reasoning about what should be exposed lives elsewhere.Jacky Liu, published 2026-07-03
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
WebSocketUnmapped
CAP WebSocketsCAP WebSocketsThe early one, from 2021, before an adapter existed to make it ordinary. Read for what the problem looked like when it had to be solved by hand.vvdries, published 2021-01-26
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
Audit loggingSAP only
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
AuthenticationSAP only
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
AuthorizationSAP only
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Change trackingSAP only
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Data privacyUnmapped
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Input validationSAP only
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP