NewSAP Cloud Application Programming Model
In the last 30 days
90 changes
Audit loggingcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door.
How to implement SAP BTP Audit log service in a CAP Applicationexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Implementing Custom Audit Logging in SAP CAP Applicationsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Show 8 more
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
SAP BTP Audit log Enable and retrieve logsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarpublishedWalks through pulling entries from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a
data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only entry arrive in QRadar as an offense.Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixpublishedWritten after the SAPwned disclosure in SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry RuntimeSAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp and SAP BTP, Kyma runtimeSAP BTP, Kyma runtimeA fully managed Kubernetes runtime on SAP BTP, based on the open-source project Kyma, where extensions to SAP solutions run as containerised microservices and serverless Functions.sap official, btp app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.
SAP BTP Audit log Enable and retrieve logspublishedWalks through enabling and retrieving records from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1publishedWalks through subscribing to the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerpublishedWalks through wiring an Identity Authentication tenant of Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp into the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.
Audit loggingcore coverage revisedcapire audit 2026-09-27: a page this capability owns was cited nowhere.
Authenticationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present.
cds-common-jwt-supportlifecycle revisedThe maintainer's GitHub profile states that the account was archived (profile changed 2026-10-11); the repositories are gone and the package stays published on npm. His words, quoted and dated, in the field made for a maker's statement about an end; nothing written about the person.
Authenticationecosystems revisedui5-middleware-oidc was staged in intake-20261019-bestofui5 under ui5-build-tooling because this capability was not open on the UI5 door. The UI5 reading comes from the README of SAP's backend-proxy-middleware.
Authenticationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.
Show 16 more
Building Custom Authentication in SAP CAPexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Evolving the identity lifecycle for an AI-first futureexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Execute [OAuth2 client credentials] protected REST request with SAP CAP Applicationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
How SAP secures enterprise AI agents with identity propagationexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
SAP CAP JWT Token Flow in codeexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Secure Service Consumption Across Hyperscalersexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Authenticationcoverage by ecosystem, facets, framing by ecosystem revisedThe paragraph counted two services while seven entries stand behind the door, the router and the Cloud Connector among them, so it told a reader the door was smaller than it is.
Cloud Identity Servicesprovides[capability:authentication] revisedThe only sentence about this service was its one-liner, so the capability page listed it beside the OAuth server with nothing to tell the two apart. SAP's trust and federation page states what the service is and what a tenant's own policies cover, and the default identity provider page states the corporate identity provider behind it, which is the property the BTP door now compares on.
SAP Authorization and Trust Management serviceprovides[capability:authentication] revisedThe edge said only that the service answers authentication, so the page could not say which part of the concern it answers. SAP's architecture page states the three: the trust, the assertion it receives, and the token it signs. The two properties the BTP door now compares options on are stated from the same page: a token with no user present, and a corporate identity provider behind it.
Evolving the identity lifecycle for an AI-first futurepublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design and Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationpublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design side and the per-hop check the authorisationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar KoscheGunnar Koschegave 1 talk, contributed to 1 entry and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Identity lifecycle and governance with SAP services and Microsoft EntrapublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicespublishedThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.
Authenticationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: the security overview and the product security overview were cited nowhere; the first carries a boundary SAP draws itself.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDpublishedA step-by-step configuration walkthrough for wiring SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the trust and user-correlation layer behind SAP Task CenterSAP Task CenterOne inbox across SAP applications: tasks from S/4HANA, SuccessFactors, Ariba and BTP workflows in one list, with a public API for a custom task provider.sap official, btp: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp jobs, and the principal-propagation trust the cloud connectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp needs to pass it through to an on-premise task provider.
Authorizationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door.
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
CAP-JAVA implementation for Authorization Management Service (AMS)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Dynamic authorisation with user attributes in SAP CAP and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Show 22 more
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrievalexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based Authorizationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Qualtrics integration with domain based authorization in CAP project on HANA cloudexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approachesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
SAP Business Technology Platform: Authorization and Trust Management Serviceexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Securing a CAP Node.js App with SAP AMS on BTP Cloud Foundryexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Securing CAP Applications with SAP Cloud Identity Services and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Useful CAP CDS and Fiori Commands to Accelerate Development and Deploymentexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Why developers should care about credential-types for xsuaa?explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
XSUAA Based Authentication - Using Managed Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
XSUAA Local Testingexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
SAP Business Technology Platform: Authorization and Trust Management ServicepublishedWalks through how the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.
CAP for nodejs安全的暴露接口练习publishedStarting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application StudioSAP Business Application StudioSAP's development environment for business applications, delivered as a cloud service and opened in a browser, where work happens in preconfigured dev spaces.sap official, btp's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticespublishedWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp (XSUAA), restricting CDS service definitions with
@restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap Node.jsNode.jsA cross-platform JavaScript runtime that servers, command line tools and scripts written in JavaScript are run with. For the things here, the prerequisite a repository names when its build is a set of npm scripts. example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentpublishedA command-by-command walkthrough of
@sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA CloudSAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp. cds add mta and fiori add deploy-config, from @sap/generator-fiori@sap/generator-fioriThe single entry point for generating a Fiori application — the user picks a template and the generator produces the project around it.sap official, cap, build the Cloud FoundrySAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.Authorizationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: a page this capability owns was cited nowhere.
Change trackingcore coverage, coverage by ecosystem revisedReassessed against the graph (check:capabilities): removed a count, and linked the entry the graph holds instead of its repository.
BTP CAP : Custom plugin to separate generic change log capture logicexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
New and improved: Change Tracking pluginexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1publishedFirst of a three-part series on designing a CAP application on BTP that uses the platform's data privacyData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp, SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp, SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp and SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18 and Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18.
Data privacycore coverage revisedcapire audit 2026-09-27, judgement pages read a fifth time: the description says data privacy is doing what the law requires, and the security index's table calls data privacy a legal concept and data protection a suite of security measures; the row is quotable as written.
Input validationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): no artifact carries a provides edge to this capability for the UI5 door, because openui5-validator provides ui5-data-binding. The state follows the edges, and the core stays present through the block's sourced what_core_does.
CAPVAL: A project is bornpublishedThis second CAPVAL post announces CAPVALcapvalReplaces the message a failed input validation annotation returns, and adds @validation.handler, which names a class that runs a check of the developer's own.independent, cap version 2.0, made compatible with CAP v8 after breaking changes there, with the fix shown as a custom
cds.middlewares.after error handler. It restates the plugin's @validation.message annotation alongside standard annotations such as @mandatory as the input validationInput validationRejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.SAP and community, unassessed mechanic the project builds on, and the release otherwise adds automated tests and release-automation GitHub Actions rather than new annotations.Input validationecosystems revisedopenui5-validator was staged in intake-20261019-bestofui5 under ui5-data-binding because this capability was not open on the UI5 door. The UI5 reading comes from the OpenUI5 pages on data types and validation messages.
[Part - 1] Enrich CAP based Services with Behaviors using Annotationsexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Show 7 more
#CAP-TechBytes Input Validationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL Pluginexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
Learn how to define constraints declaratively in your CDS modelexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
[Part - 1] Enrich CAP based Services with Behaviors using AnnotationspublishedWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.
Input validationchanged in, core coverage revisedcapire audit 2026-09-27, proposed pages read a third time: the boundary said the check past the constraints is a before handler of the developer's own, and the two pages that document that handler were cited nowhere; the Node.js page states the order the boundary implies, declarative first.
capvaladded to the atlasCustom messages and handler classes for CAP input validation
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL Pluginexplains, summary, authors revisedThe actor entered with the artifact. The post says "I have written a plugin called CAPVAL" and sends the reader to GitHub, where the repository is MertSAP/CAPVAL, and npm lists mertsap as the maintainer of capval.
Rate limitingcore coverage revisedReassessed against the graph (check:capabilities): API Management, an SAP-official service on the BTP door, lists CAP in serves_ecosystems and provides this capability, so the core is present for CAP beside the in-process community plugins. The relationship stays unassessed for lack of documentary evidence on the history.
cds-rate-limitlifecycle revisedThe maintainer's GitHub profile states that the account was archived (profile changed 2026-10-11); the repositories are gone and the package stays published on npm. His words, quoted and dated, in the field made for a maker's statement about an end; nothing written about the person.
🔴 Your Agent Wants to Call SAP. Now What?publishedDevtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp inside SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and Rate limitingRate limitingCapping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.SAP and community, unassessed hold. For totals across all sales orders they send the agent to SAP Business Data CloudSAP Business Data CloudSAP's umbrella over the data estate: installed intelligent content and data products, a governed catalog they are published through, and a path out to SAP Databricks.sap official, btp instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.
MCP Gateway in Practice: Architecture, configuration, and hands-onpublishedA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systemsAgent access to your systemsGiving an AI agent access to the business data, configuration or operations of systems you run through an MCP server. Serving your application over MCP exposes your own service contract; system access reaches the systems behind it, and one implementation may do both. Development assistance belongs to agent access to your code.SAP and community, narrow by design edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.
Show 5 more
Powering Enterprise-Ready Agentic AI with SAP Integration SuitepublishedA Devtoberfest 2026 session (INT-31) from SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposureServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and the tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed the edges rest on. Three AI features inside Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.
API Composition: Seamless Enterprise Data Access for Developers and AI Agentsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
SAP PI Migration to BTP Integration Suite Patterns and learning experiencespublishedWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp iFlows — API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.
API Managementprovides[mcp-servers], provides, description revisedIndependent source review supports prompts guiding agent interaction rather than templates; retains both sourced tool-count limits as an explicit MCP-specific discrepancy.
Road map for SAP Integration Suite: What ships next across all capabilitiespublishedSAP's road map for SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp across its capability areas: API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.
Secrets rotationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): SAP Credential Store is sap-official and lists cap in serves_ecosystems, so SAP is present for CAP.
Secrets rotationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.
audit-summaryadded to the atlasGroups npm audit findings by root dependency, with failing thresholds
Vulnerability scanningecosystems, description revisedPublic feedback issue #10. CAP and UI5 coverage assessed as unmapped: no atlas artifact provides the dependency-tree check there yet.
Under no capability
auth-samplesadded to the atlasCAP services and a UI for trying role restrictions with mock users