{"ref":"capability:audit-logging","page":"/capabilities/audit-logging","json":"/capabilities/audit-logging.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"audit-logging","name":"Audit logging","domain":"security-and-compliance","ecosystems":["cap","btp"],"universal":true,"description":"Recording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.","short":"Recording who touched personal or sensitive data, for auditors","core_coverage":{"state":"core-only","assessed_at":"2026-09-27","what_core_does":"[@cap-js/audit-logging](artifact:cap-js-audit-logging) reads the @PersonalData annotations, logs writes to personal data and reads of sensitive data without handler code, and sends the messages through the transactional outbox to the [SAP Audit Log service](artifact:btp-audit-log), or to the console in development. CAP Java ships an AuditLogService for personal data access, personal data modification, configuration change and security events, with a default handler that writes to the application log and [com.sap.cds:cds-feature-auditlog-v2](artifact:cap-java-cds-feature-auditlog-v2) as the handler that reaches the platform service.","where_it_stops":"The automatic part stops at what the model annotates as personal data: configuration changes and security events are defined as event types, and only the application's own code sends them, through audit.log in Node.js or the AuditLogService methods in Java. It writes the trail and does not read it back: production needs a premium-plan instance of the [SAP Audit Log service](artifact:btp-audit-log), and retrieval goes through a separate auditlog-management instance or the SAP Audit Log Viewer.","sources":[{"url":"https://cap.cloud.sap/docs/guides/security/dpp-audit-logging","title":"Audit Logging","checked":"2026-09-20","quote":"In addition to the generic audit logging provided out of the box, applications can also log custom events with custom data using the programmatic API."},{"url":"https://cap.cloud.sap/docs/java/auditlog","title":"Audit Logging (CAP Java)","checked":"2026-09-20","quote":"By default, the CAP Java SDK provides an AuditLog handler that writes the AuditLog messages to the application log."},{"url":"https://github.com/cap-js/audit-logging","title":"cap-js/audit-logging — README","checked":"2026-09-20","quote":"The end-to-end out-of-the-box functionality provided by this plugin requires a paid-for instance of the SAP Audit Log service for customers."},{"url":"https://cap.cloud.sap/docs/guides/security/dpp-annotations","title":"Annotating Personal Data — capire","checked":"2026-09-27","quote":"In order to automate audit logging, personal data management, and data retention management as much as possible, the first and frequently only task to do as an application developer is to identify entities and elements (potentially) holding personal data using @PersonalData annotations."}]},"history":[{"date":"2026-08-31","field":"core_coverage.state","from":"core","to":"core-only","reason":"States renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately."},{"date":"2026-09-09","field":"ecosystems","from":"cap","to":"cap, btp","reason":"The BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install."},{"date":"2026-09-14","field":"ecosystems","from":"cap, btp","to":"cap, btp, hana","reason":"SAP-samples' s4hana-hana-audit-policies defines HANA audit policies for the database tenant under S/4HANA, recording security-relevant actions at database level, the same concern one layer below the application."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27: a page this capability owns was cited nowhere."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.note","from":"Every provider behind this door is an SAP BTP service, so core-only is a assessment of the corpus rather than a quote from the core. what_core_does is left empty: ...","to":"Core-only here reads the SAP-published entries behind the door: the SAP Audit Log service and s4hana-hana-audit-policies. It is an assessment of the corpus, and what_core_does is left empty: ...","reason":"Reassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door."}],"coverage_by_ecosystem":{"btp":{"state":"core-only","assessed_at":"2026-09-09","where_it_stops":"At ingestion and the default ninety days. Reading the trail back, and keeping it longer than that, are separate services — so \"the platform records it\" does not by itself answer the question an auditor asks.","note":"Core-only here reads the SAP-published entries behind the door: the [SAP Audit Log service](artifact:btp-audit-log) and [s4hana-hana-audit-policies](artifact:sap-samples-s4hana-hana-audit-policies), which defines audit policies for the HANA database tenant under S/4HANA. It is an assessment of the corpus, and what_core_does is left empty: no page has been checked that states an intent here, and the entries carry their own descriptions and links."}},"framing_by_ecosystem":{"btp":{"description":"On BTP the audit trail is a service an application writes to, not a library it links. [SAP Audit Log service](artifact:btp-audit-log) ingests compliance audit data from BTP services and from the applications running on them, and keeps it ninety days by default."}},"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":{"built_in":[{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:cap-js-audit-logging","name":"@cap-js/audit-logging","json":"/artifacts/cap-js-audit-logging.json"},{"ref":"artifact:cap-java-cds-feature-auditlog-ng","name":"com.sap.cds:cds-feature-auditlog-ng","json":"/artifacts/cap-java-cds-feature-auditlog-ng.json"},{"ref":"artifact:cap-java-cds-feature-auditlog-v2","name":"com.sap.cds:cds-feature-auditlog-v2","json":"/artifacts/cap-java-cds-feature-auditlog-v2.json"}]},"by_flavor":{"node":{"built_in":[],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:cap-js-audit-logging","name":"@cap-js/audit-logging","json":"/artifacts/cap-js-audit-logging.json"}]},"java":{"built_in":[{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:cap-java-cds-feature-auditlog-ng","name":"com.sap.cds:cds-feature-auditlog-ng","json":"/artifacts/cap-java-cds-feature-auditlog-ng.json"},{"ref":"artifact:cap-java-cds-feature-auditlog-v2","name":"com.sap.cds:cds-feature-auditlog-v2","json":"/artifacts/cap-java-cds-feature-auditlog-v2.json"}]}}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:cap-js-audit-logging","name":"@cap-js/audit-logging","json":"/artifacts/cap-js-audit-logging.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:cap-java-cds-feature-auditlog-ng","name":"com.sap.cds:cds-feature-auditlog-ng","json":"/artifacts/cap-java-cds-feature-auditlog-ng.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:cap-java-cds-feature-auditlog-v2","name":"com.sap.cds:cds-feature-auditlog-v2","json":"/artifacts/cap-java-cds-feature-auditlog-v2.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:sap-samples-s4hana-hana-audit-policies","name":"s4hana-hana-audit-policies","json":"/artifacts/sap-samples-s4hana-hana-audit-policies.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-audit-log","name":"SAP Audit Log service","json":"/artifacts/btp-audit-log.json","ecosystem":"btp","origin_ring":"sap-official"}],"samples":[{"ref":"artifact:sap-samples-btp-secure-development","name":"SAP-samples/btp-secure-development","json":"/artifacts/sap-samples-btp-secure-development.json"},{"ref":"artifact:sap-samples-teched2022-xp260","name":"teched2022-XP260","json":"/artifacts/sap-samples-teched2022-xp260.json"},{"ref":"artifact:sap-samples-teched2023-xp185v","name":"teched2023-XP185v","json":"/artifacts/sap-samples-teched2023-xp185v.json"},{"ref":"artifact:sap-samples-teched2025-xp260","name":"teched2025-XP260","json":"/artifacts/sap-samples-teched2025-xp260.json"}],"explained_by":[{"ref":"content:devtoberfest-2026-cap-the-road-ahead","name":"CAP: The Road Ahead - Simplicity in an AI Era","json":"/content/devtoberfest-2026-cap-the-road-ahead.json"},{"ref":"content:named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","name":"Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integration","json":"/content/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c.json"},{"ref":"content:btp-audit-log-mcp-server-security-monitoring-with-ai-assistants","name":"BTP Audit Log MCP Server: Security Monitoring with AI Assistants","json":"/content/btp-audit-log-mcp-server-security-monitoring-with-ai-assistants.json"},{"ref":"content:sap-btp-audit-log-access-just-got-easier-here-s-what-s-new","name":"SAP BTP Audit Log Access Just Got Easier - Here’s What’s New","json":"/content/sap-btp-audit-log-access-just-got-easier-here-s-what-s-new.json"},{"ref":"content:implementing-custom-audit-logging-in-cap-applications","name":"Implementing Custom Audit Logging in SAP CAP Applications","json":"/content/implementing-custom-audit-logging-in-cap-applications.json"},{"ref":"content:integrating-sap-cloud-identity-services-identity-authentication-ias-with-sap-aud","name":"Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log Viewer","json":"/content/integrating-sap-cloud-identity-services-identity-authentication-ias-with-sap-aud.json"},{"ref":"content:how-to-enable-sap-audit-log-viewer-service-to-collect-all-audit-logs-from-btp-se","name":"How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1","json":"/content/how-to-enable-sap-audit-log-viewer-service-to-collect-all-audit-logs-from-btp-se.json"},{"ref":"content:how-to-implement-sap-btp-audit-log-service-in-a-cap-application","name":"How to implement SAP BTP Audit log service in a CAP Application","json":"/content/how-to-implement-sap-btp-audit-log-service-in-a-cap-application.json"},{"ref":"content:microsoft-sentinel-for-sap-goes-agentless","name":"Microsoft Sentinel for SAP goes agentless","json":"/content/microsoft-sentinel-for-sap-goes-agentless.json"},{"ref":"content:nice-patch-sap-revisiting-your-sap-btp-security-measures-after-ai-core-vulnerabi","name":"Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fix","json":"/content/nice-patch-sap-revisiting-your-sap-btp-security-measures-after-ai-core-vulnerabi.json"},{"ref":"content:sap-btp-audit-log-enable-and-retrieve-logs","name":"SAP BTP Audit log Enable and retrieve logs","json":"/content/sap-btp-audit-log-enable-and-retrieve-logs.json"},{"ref":"content:integrate-sap-business-technology-platform-audit-logs-with-ibm-security-qradar","name":"Integrate SAP Business Technology Platform audit logs with IBM Security QRadar","json":"/content/integrate-sap-business-technology-platform-audit-logs-with-ibm-security-qradar.json"},{"ref":"content:introducing-the-cloud-application-programming-model-cap","name":"Introducing the Cloud Application Programming Model (CAP)","json":"/content/introducing-the-cloud-application-programming-model-cap.json"}],"normative_context":[]}}