{"ref":"capability:authorization","page":"/capabilities/authorization","json":"/capabilities/authorization.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"authorization","name":"Authorization","domain":"security-and-compliance","ecosystems":["cap","btp","abap"],"universal":true,"description":"Deciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.","short":"Deciding who may read or change what, down to instance level","core_coverage":{"state":"core-and-community","assessed_at":"2026-09-27","relationship":"unassessed","what_core_does":"CAP's generic service providers enforce @requires and @restrict from the CDS model. A where condition on a privilege is pushed into the query for READ and rejects an UPDATE or DELETE on instances outside it. With SAP Cloud Identity Services for authentication, authorization is AMS policies: `cds add ams` generates them from the CDS model and the AMS plugin enforces the role restrictions at runtime, beta in CAP Java.","where_it_stops":"CAP checks a role and does not assign it: who holds one is set at runtime, in role collections of the [SAP Authorization and Trust Management service](artifact:btp-authorization-and-trust-management) or, under IAS, in Authorization Management Service policies of [Cloud Identity Services](artifact:btp-cloud-identity-services). Node.js evaluates the annotations on the target entity of a request only and Java does not check restrictions on composition children, so a rule on an expanded or deeply written child entity is a custom handler.","community_adds":"[cds-entra-id](artifact:vobu-cds-entra-id) maps Microsoft Entra ID groups and app roles onto CAP roles for an app on Azure App Service, and [cap-toolkit](artifact:eyupbaycol-cap-toolkit) wraps role and ownership checks as handler functions.","sources":[{"url":"https://cap.cloud.sap/docs/guides/security/authorization","title":"CAP-level Authorization","checked":"2026-09-20","quote":"This guide explains how to restrict access to data by adding respective declarations to CDS models, that are then enforced by CAP's generic service providers."},{"url":"https://cap.cloud.sap/docs/guides/security/authorization","title":"CAP-level Authorization — Simple Static Checks in Node.js","checked":"2026-09-20","quote":"pushed into the query for READ, or verified with a COUNT for UPDATE/DELETE"},{"url":"https://cap.cloud.sap/docs/guides/security/authorization","title":"CAP-level Authorization — Limitations in Node.js","checked":"2026-09-20","quote":"Currently, the security annotations are only evaluated on the target entity of the request."},{"url":"https://cap.cloud.sap/docs/guides/security/authorization","title":"CAP-level Authorization — Deep Authorizations in Java, Compositions","checked":"2026-09-20","quote":"Restrictions on compositions are not checked by the runtime. If you model dedicated restriction rules on child entity level, you need to add custom authorization handlers accordingly."},{"url":"https://cap.cloud.sap/docs/guides/security/cap-users","title":"CAP-level Users & Roles — Roles","checked":"2026-09-20","quote":"Independently of that, user administrators combine CAP roles in higher-level policies and assign them to business users in the platform's central authorization management solution at runtime."},{"url":"https://cap.cloud.sap/docs/guides/security/cap-users","title":"CAP-level Users & Roles — Role Assignment with AMS","checked":"2026-09-20","quote":"Unlike tokens issued by XSUAA, IAS tokens only contain static user information and cannot directly provide CAP roles."},{"url":"https://cap.cloud.sap/docs/guides/security/cap-users","title":"CAP-level Users & Roles — Assign Roles in SAP BTP Cockpit","checked":"2026-09-20","quote":"Next, you create a role collection that assigns these roles to your users."},{"url":"https://github.com/vobu/cds-entra-id","title":"vobu/cds-entra-id — README","checked":"2026-09-20","quote":"The plugin does not support any authentication flow, but the mapping of Entra ID artefacts to CAP roles for declarative authorization."},{"url":"https://github.com/eyupbaycol/cap-toolkit-core","title":"eyupbaycol/cap-toolkit-core — README","checked":"2026-09-20","quote":"srv.before('DELETE', 'Orders', AuthManager.requireRole('Admin'));"},{"url":"https://cap.cloud.sap/docs/java/ams","title":"IAS Authorization via AMS — capire","checked":"2026-09-27","quote":"CAP applications using Identity Authentication Service (IAS) for authentication must manage authorization via Authorization Management Service (AMS), which is also part of SAP Cloud Identity Services (SCI)."},{"url":"https://cap.cloud.sap/docs/java/ams","title":"IAS Authorization via AMS — capire","checked":"2026-09-27","quote":"Using the official AMS plugins (cds add ams), you can generate policies from the CDS model and get out-of-the-box enforcement of CAP role restrictions based on AMS policies during runtime."},{"url":"https://cap.cloud.sap/docs/guides/security/overview","title":"Overview of Security Concepts and Architecture — capire","checked":"2026-09-27","quote":"CAP divides the different security-related tasks into separate and independent building blocks, each with a standard CAP implementation suitable for most scenarios."}]},"changed_in":[{"version":"CAP Java 3.7.1","date":"2025-01-30","what_changed":"Instance-based @restrict conditions were pushed into the query on read, but a CREATE or UPDATE was not checked against them beyond ordinary field validation. CAP Java 3.7.1 added a beta check that also validates input data for CREATE and UPDATE events against the same instance-based condition, rejecting a write that would place a record outside the user's allowed instances with HTTP 400.","invalidates":"Advice that instance-based @restrict only guards reads and that a create or update payload has to be checked by hand for the same rule. That gap is closable now, behind cds.security.authorization.instanceBased.checkInputData — beta, and Java-only as of this release.","source":{"url":"https://cap.cloud.sap/docs/releases/2025/jan25","title":"CAP release notes, January 2025 — Authorization Checks On Input Data","checked":"2026-09-08","quote":"CAP Java now can also validate input data of CREATE and UPDATE events with regards to instance-based authorization conditions."},"applies_to":{"ecosystems":["cap"],"flavors":["java"]}},{"version":"@sap/cds-dk 8.6.0","date":"2024-12-19","applies_to":{"ecosystems":["cap"]},"what_changed":"cds add ams configures a project for authorization through the Authorization Management Service, and runs cds add ias for authentication through SAP Cloud Identity Services with it. Dated from npm.","invalidates":"Setup guides that wire AMS policies and the IAS binding by hand in a CAP Java project.","source":{"url":"https://cap.cloud.sap/docs/java/ams","title":"IAS Authorization via AMS — capire","checked":"2026-09-27","quote":"Since @sap/cds-dk 8.6.0, the cds add ams command has been available to configure the project for authorization via AMS."}}],"history":[{"date":"2026-08-31","field":"core_coverage.state","from":"core","to":"core-only","reason":"States renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately."},{"date":"2026-09-09","field":"ecosystems","from":"cap","to":"cap, btp","reason":"The BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install."},{"date":"2026-09-14","field":"ecosystems","from":"cap, btp","to":"cap, btp, abap","reason":"sap-usi-authority-check in this batch is an ABAP class that checks whether the user may run the current transaction, which is this concern on the ABAP door."},{"date":"2026-09-20","field":"core_coverage.state","from":"core-only","to":"core-and-community","reason":"Two independent artifacts provide this on CAP beside the SAP-official ones: cds-entra-id (vobu) and cap-toolkit (eyupbaycol). The state says who is present, so core-only no longer held. relationship is unassessed: no retrieved document gives the history between them and the core."},{"date":"2026-09-27","field":"core_coverage","from":"model annotations","to":"model annotations, and AMS policies with IAS","reason":"capire audit 2026-09-27: the Java AMS page was cited nowhere and carries a version marker."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27, proposed pages read once more: a page this capability owns was cited nowhere."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.note","from":"Every provider behind this door is an SAP BTP service, so core-only is a assessment of the corpus rather than a quote from the core. what_core_does is left empty: ...","to":"The BTP providers are SAP's own catalogue services, [OAuth 2.0 on SAP BTP](artifact:btp-oauth) among them for the token grant in Neo regions, so core-only follows from the catalogue. ...","reason":"Reassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door."}],"coverage_by_ecosystem":{"btp":{"state":"core-only","assessed_at":"2026-09-09","where_it_stops":"At the grant. Which rows a given user may see is evaluated where the query is built, so BTP narrows the question rather than answering it.","note":"The BTP providers are SAP's own catalogue services, [OAuth 2.0 on SAP BTP](artifact:btp-oauth) among them for the token grant in Neo regions, so core-only follows from the catalogue and is not a quote from the core. what_core_does is left empty: no page has been checked that states an intent here, and the services carry their own descriptions and links."},"abap":{"state":"core-and-community","assessed_at":"2026-09-14","what_core_does":"AUTHORITY-CHECK tests whether the user master record holds an authorization for an authorization object and the field values given, and CDS access control limits what a CDS view entity returns to the access conditions in a CDS role.","where_it_stops":"At the check. ABAP SQL triggers no authorization check in the database, so where a program checks, and against which object, is the programmer's to decide.","relationship":"unassessed","sources":[{"url":"https://help.sap.com/doc/abapdocu_752_index_htm/7.52/en-us/abapauthority-check.htm","title":"ABAP Keyword Documentation 7.52 — AUTHORITY-CHECK","checked":"2026-09-14","quote":"This statement checks whether an authorization is entered in the user master record of the current user"},{"url":"https://github.com/SAP-samples/abap-cheat-sheets/blob/main/25_Authorization_Checks.md","title":"ABAP cheat sheets — Authorization Checks","checked":"2026-09-14","quote":"Thus, it is up to the programmer to ensure that each user who can call the program is authorized to access the data it handles."}]}},"framing_by_ecosystem":{"btp":{"description":"[SAP Authorization and Trust Management](artifact:btp-authorization-and-trust-management) holds the scopes and role collections and issues the JWT that carries them. The decision still happens in the application that reads the token: the platform answers who may be granted what, never what a particular request may return."},"abap":{"description":"On ABAP authorization is objects and fields in the user master record, checked explicitly with AUTHORITY-CHECK or implicitly through CDS roles. [sap-usi-authority-check](https://github.com/SchwarzIT/sap-usi-authority-check) wraps one such check, whether the user may run the current transaction, in a class Schwarz IT's own guidelines require every USI report to call."}},"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"},{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:sap-ams","name":"@sap/ams","json":"/artifacts/sap-ams.json"},{"ref":"artifact:sap-ams-dev","name":"@sap/ams-dev","json":"/artifacts/sap-ams-dev.json"}]},"by_flavor":{"node":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:sap-ams","name":"@sap/ams","json":"/artifacts/sap-ams.json"},{"ref":"artifact:sap-ams-dev","name":"@sap/ams-dev","json":"/artifacts/sap-ams-dev.json"}]},"java":{"built_in":[{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[]}}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:sap-ams","name":"@sap/ams","json":"/artifacts/sap-ams.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:sap-ams-dev","name":"@sap/ams-dev","json":"/artifacts/sap-ams-dev.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:eyupbaycol-cap-toolkit","name":"cap-toolkit","json":"/artifacts/eyupbaycol-cap-toolkit.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:vobu-cds-entra-id","name":"cds-entra-id","json":"/artifacts/vobu-cds-entra-id.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:btp-oauth","name":"OAuth 2.0 on SAP BTP","json":"/artifacts/btp-oauth.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-authorization-and-trust-management","name":"SAP Authorization and Trust Management service","json":"/artifacts/btp-authorization-and-trust-management.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:schwarzit-sap-usi-authority-check","name":"sap-usi-authority-check","json":"/artifacts/schwarzit-sap-usi-authority-check.json","ecosystem":"abap","origin_ring":"independent"}],"samples":[{"ref":"artifact:miyasuta-auth-samples","name":"auth-samples","json":"/artifacts/miyasuta-auth-samples.json"},{"ref":"artifact:miyasuta-auth-transport2","name":"auth-transport2","json":"/artifacts/miyasuta-auth-transport2.json"},{"ref":"artifact:gregorwolf-bookshop-ams","name":"bookshop-ams","json":"/artifacts/gregorwolf-bookshop-ams.json"},{"ref":"artifact:sap-samples-btp-user-management-microservice","name":"btp-user-management-microservice","json":"/artifacts/sap-samples-btp-user-management-microservice.json"},{"ref":"artifact:miyasuta-cap-ams-a2a","name":"cap-ams-a2a","json":"/artifacts/miyasuta-cap-ams-a2a.json"},{"ref":"artifact:miyasuta-cap-java-auth-check","name":"cap-java-auth-check","json":"/artifacts/miyasuta-cap-java-auth-check.json"},{"ref":"artifact:sap-samples-ams-samples-java","name":"SAP-samples/ams-samples-java","json":"/artifacts/sap-samples-ams-samples-java.json"},{"ref":"artifact:sap-samples-ams-samples-node","name":"SAP-samples/ams-samples-node","json":"/artifacts/sap-samples-ams-samples-node.json"},{"ref":"artifact:sap-samples-btp-secure-development","name":"SAP-samples/btp-secure-development","json":"/artifacts/sap-samples-btp-secure-development.json"},{"ref":"artifact:sap-samples-e-mobility-driver-app","name":"SAP-samples/e-mobility-driver-app","json":"/artifacts/sap-samples-e-mobility-driver-app.json"},{"ref":"artifact:sap-samples-teched2023-xp185v","name":"teched2023-XP185v","json":"/artifacts/sap-samples-teched2023-xp185v.json"},{"ref":"artifact:sap-samples-teched2025-xp260","name":"teched2025-XP260","json":"/artifacts/sap-samples-teched2025-xp260.json"}],"explained_by":[{"ref":"content:devtoberfest-2026-rap-authorizations-business-users","name":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","json":"/content/devtoberfest-2026-rap-authorizations-business-users.json"},{"ref":"content:no-code-mcp-servers-with-sap-integration-suite-from-rest-api-to-ai-agent","name":"No-Code MCP Servers with SAP Integration Suite: From REST API to AI Agent","json":"/content/no-code-mcp-servers-with-sap-integration-suite-from-rest-api-to-ai-agent.json"},{"ref":"content:building-and-consuming-an-mcp-server-in-sap-integration-suite-connecting-it-to-c","name":"Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and Joule","json":"/content/building-and-consuming-an-mcp-server-in-sap-integration-suite-connecting-it-to-c.json"},{"ref":"content:running-ai-agents-against-sap-ecc-6-0-lessons-from-building-an-in-system-mcp-ser","name":"Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP server","json":"/content/running-ai-agents-against-sap-ecc-6-0-lessons-from-building-an-in-system-mcp-ser.json"},{"ref":"content:named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","name":"Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integration","json":"/content/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c.json"},{"ref":"content:connecting-a-custom-mcp-server-to-joule-work-desktop-a-seamless-and-secure-authe","name":"Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication Flow","json":"/content/connecting-a-custom-mcp-server-to-joule-work-desktop-a-seamless-and-secure-authe.json"},{"ref":"content:rap-feature-control-part-2","name":"RAP - Feature Control (Part 2)","json":"/content/rap-feature-control-part-2.json"},{"ref":"content:btp-restriction-type","name":"BTP - Restriction Type","json":"/content/btp-restriction-type.json"},{"ref":"content:btp-authorization-object","name":"BTP - Authorization Object","json":"/content/btp-authorization-object.json"},{"ref":"content:securing-a-cap-nodejs-app-with-sap-ams-on-btp-cloud-foundry","name":"Securing a CAP Node.js App with SAP AMS on BTP Cloud Foundry","json":"/content/securing-a-cap-nodejs-app-with-sap-ams-on-btp-cloud-foundry.json"},{"ref":"content:effective-from-june-30th-2026-xsuaa-deprecation-of-get-method-for-oauth-token-re","name":"Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrieval","json":"/content/effective-from-june-30th-2026-xsuaa-deprecation-of-get-method-for-oauth-token-re.json"},{"ref":"content:from-xsuaa-to-ams-policy-based-authorization-for-s4hana-extensions","name":"From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based Authorization","json":"/content/from-xsuaa-to-ams-policy-based-authorization-for-s4hana-extensions.json"},{"ref":"content:restrict-crud-operations-in-capm-with-capabilities-and-readonly","name":"How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .http","json":"/content/restrict-crud-operations-in-capm-with-capabilities-and-readonly.json"},{"ref":"content:dynamic-authorisation-with-user-attributes-in-sap-cap-and-ams","name":"Dynamic authorisation with user attributes in SAP CAP and AMS","json":"/content/dynamic-authorisation-with-user-attributes-in-sap-cap-and-ams.json"},{"ref":"content:agentic-ai-on-btp-a-single-agent-with-langgraph","name":"Agentic AI on BTP: a Single Agent with LangGraph","json":"/content/agentic-ai-on-btp-a-single-agent-with-langgraph.json"},{"ref":"content:xsuaa-attribute-based-vs-authority-based-configuration","name":"SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approaches","json":"/content/xsuaa-attribute-based-vs-authority-based-configuration.json"},{"ref":"content:securing-cap-applications-with-cloud-identity-services-and-ams","name":"Securing CAP Applications with SAP Cloud Identity Services and AMS","json":"/content/securing-cap-applications-with-cloud-identity-services-and-ams.json"},{"ref":"content:authorization-management-with-opensearch-s-document-level-security-sap-cloud-log","name":"Authorization management with OpenSearch's Document Level Security - SAP Cloud Logging","json":"/content/authorization-management-with-opensearch-s-document-level-security-sap-cloud-log.json"},{"ref":"content:how-to-check-fiori-apps-related-authorization-object-mass","name":"How to Check Fiori Apps Related Authorization Object Mass","json":"/content/how-to-check-fiori-apps-related-authorization-object-mass.json"},{"ref":"content:joule-studio-cap","name":"Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみた","json":"/content/joule-studio-cap.json"},{"ref":"content:securing-sap-cap-applications-xsuaa-roles-and-authorization-best-practices","name":"Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best Practices","json":"/content/securing-sap-cap-applications-xsuaa-roles-and-authorization-best-practices.json"},{"ref":"content:control-visibility-of-crud-and-custom-actions-based-on-authorization","name":"How to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on Authorization","json":"/content/control-visibility-of-crud-and-custom-actions-based-on-authorization.json"},{"ref":"content:ac-sap-iam-integration-with-sap-cloud-identity-services","name":"SAP IAM integration with SAP Cloud Identity Services","json":"/content/ac-sap-iam-integration-with-sap-cloud-identity-services.json"},{"ref":"content:capm-basics-part-4","name":"CAPM Basics - Part 4","json":"/content/capm-basics-part-4.json"},{"ref":"content:cap-java-implementation-for-authorization-management-service","name":"CAP-JAVA implementation for Authorization Management Service (AMS)","json":"/content/cap-java-implementation-for-authorization-management-service.json"},{"ref":"content:enabling-authorization-policies-in-ias-with-ams-and-cap","name":"Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP","json":"/content/enabling-authorization-policies-in-ias-with-ams-and-cap.json"},{"ref":"content:cap-for-nodejs","name":"CAP for nodejs安全的暴露接口练习","json":"/content/cap-for-nodejs.json"},{"ref":"content:authorization-management-service-in-sap-cloud-identity-service","name":"Authorization Management Service in SAP Cloud Identity Service","json":"/content/authorization-management-service-in-sap-cloud-identity-service.json"},{"ref":"content:xsuaa-local-testing","name":"XSUAA Local Testing","json":"/content/xsuaa-local-testing.json"},{"ref":"content:sap-cap-cloud-application-programming","name":"SAP CAP(Cloud Application Programming)开发框架概述","json":"/content/sap-cap-cloud-application-programming.json"},{"ref":"content:xsuaa-based-authentication-using-managed-approuter","name":"XSUAA Based Authentication - Using Managed Approuter","json":"/content/xsuaa-based-authentication-using-managed-approuter.json"},{"ref":"content:xsuaa-based-authentication-using-standalone-approuter","name":"XSUAA Based Authentication - Using Standalone Approuter","json":"/content/xsuaa-based-authentication-using-standalone-approuter.json"},{"ref":"content:part-1-enrich-cap-based-services-with-behaviors-using-annotations","name":"[Part - 1] Enrich CAP based Services with Behaviors using Annotations","json":"/content/part-1-enrich-cap-based-services-with-behaviors-using-annotations.json"},{"ref":"content:securing-a-cap-endpoint-called-by-the-job-scheduling-service","name":"SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)","json":"/content/securing-a-cap-endpoint-called-by-the-job-scheduling-service.json"},{"ref":"content:useful-cap-cds-and-fiori-commands-to-accelerate-development-and-deployment","name":"Useful CAP CDS and Fiori Commands to Accelerate Development and Deployment","json":"/content/useful-cap-cds-and-fiori-commands-to-accelerate-development-and-deployment.json"},{"ref":"content:qualtrics-integration-with-domain-based-authorization-in-a-cap-project","name":"Qualtrics integration with domain based authorization in CAP project on HANA cloud","json":"/content/qualtrics-integration-with-domain-based-authorization-in-a-cap-project.json"},{"ref":"content:securing-multiple-cap-java-apps-with-one-xsuaa-instance","name":"An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instance","json":"/content/securing-multiple-cap-java-apps-with-one-xsuaa-instance.json"},{"ref":"content:sap-business-technology-platform-authorization-and-trust-management-service","name":"SAP Business Technology Platform: Authorization and Trust Management Service","json":"/content/sap-business-technology-platform-authorization-and-trust-management-service.json"},{"ref":"content:get-authenticated-user-information-with-cap-using-the-xsuaa-api","name":"How to get authenticated user information with CAP in three different ways – Using the XSUAA API","json":"/content/get-authenticated-user-information-with-cap-using-the-xsuaa-api.json"},{"ref":"content:why-developers-should-care-about-credential-types-for-xsuaa","name":"Why developers should care about credential-types for xsuaa?","json":"/content/why-developers-should-care-about-credential-types-for-xsuaa.json"},{"ref":"content:insights-of-cloud-sdk-cap-xsuaa-ssh-and-other-btp-topics-from-2021","name":"Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021","json":"/content/insights-of-cloud-sdk-cap-xsuaa-ssh-and-other-btp-topics-from-2021.json"},{"ref":"content:developing-business-services-with-cloud-application-programming-cap-model-in-sap","name":"Developing Business Services with Cloud Application Programming(CAP) Model in SAP Business Studio","json":"/content/developing-business-services-with-cloud-application-programming-cap-model-in-sap.json"},{"ref":"content:understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta","name":"Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.","json":"/content/understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta.json"},{"ref":"content:using-postman-for-api-testing-with-xsuaa","name":"Using Postman for API Testing with XSUAA","json":"/content/using-postman-for-api-testing-with-xsuaa.json"},{"ref":"content:teched-2026-xp101","name":"Building trusted applications on SAP Business AI Platform by design","json":"/content/teched-2026-xp101.json"},{"ref":"content:teched-2026-xp112","name":"How SAP secures enterprise AI agents with identity propagation","json":"/content/teched-2026-xp112.json"}],"normative_context":[]}}