CapabilitySecurity & ComplianceJava, read from its artifacts

Authorization

Deciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.

Showing artifacts, examples and content with confirmed Java applicability. View All CAP

Overview

SAP SHIPS

com.sap.cds:cds-services-bom

Evaluates the @requires and @restrict authorization annotations from the CDS model on every request, enforced by CAP's generic service providers without custom code.

SourceCAP-level Authorizationchecked 2026-09-19

A Java coverage assessment has not been written. View all flavors

THE COMMUNITY ADDS

No community artifact is confirmed here for Java.

A Java coverage assessment has not been written. View all flavors

Artifacts2

2 of 2 artifacts

ArtifactSignals

Packages1

com.sap.cds:cds-services-bomMaven bill of materials pinning CAP Java module versions

Signals

none

Services1

SAP Authorization and Trust Management serviceOAuth server issuing JWTs and holding scopes for BTP apps

Signals

none

Seen working2

ArtifactSignals

Samples2

cap-ams-a2aApp-to-app setups between CAP Java and CAP Node.js under AMS and IAS

No license

cap-java-auth-checkCAP Java authorization checks tried case by case

No license

Details

What changed — and what it makes stale1

CAP Java 3.7.12025-01-30, CAP, Java

Instance-based @restrict conditions were pushed into the query on read, but a CREATE or UPDATE was not checked against them beyond ordinary field validation. CAP Java 3.7.1 added a beta check that also validates input data for CREATE and UPDATE events against the same instance-based condition, rejecting a write that would place a record outside the user's allowed instances with HTTP 400.

Makes stale:

Advice that instance-based @restrict only guards reads and that a create or update payload has to be checked by hand for the same rule. That gap is closable now, behind cds.security.authorization.instanceBased.checkInputData — beta, and Java-only as of this release.

SourceCAP release notes, January 2025 — Authorization Checks On Input Datachecked 2026-09-08

Coverage

statecore only, CAP, Java, derived

domainSecurity & Compliance

also inBTP/BAIP, ABAP

For your agent

Ref: capability:authorization
JSON: /capabilities/authorization.json
MCP: Connecting an agent