BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
Developing Business Services with Cloud Application Programming(CAP) Model in SAP Business Studio
A step-by-step build of a CAP Node.js service in SAP Business Application StudioSAP Business Application StudioSAP's development environment for business applications, delivered as a cloud service and opened in a browser, where work happens in preconfigured dev spaces.sap official, btp: a CDS schema for banks, customers, accounts and transactions using compositions, associations, enumerated types and the @assert.unique constraint, followed by authorization layered on with @restrict and @requires annotations and mock users assigned the authenticated-user and Manager roles in .cdsrc.json. Custom event handlers registered through @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap (srv.before/srv.after) and sample HTTP requests round out the example.
Where it sits
Explains
Data modellingData modellingDefining the shape of data before anything serves it: entities and their types, how they relate, and the projections and views that services and applications consume.AuthorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.
Who is behind it
Ranjithauthor
Properties
About this work
Published
Published on
Group by74 of 74 pieces
Piece, what it offersStill applies
CDS Associations & JoinsCDS Associations & JoinsA Devtoberfest 2026 session from SAP's performance and scalability team on what an ABAP CDS association becomes on SAP HANA, taken as an excerpt from their internal performance training. The CDS edge rests on the three ways an association is used: a path expression and an explicit join both put a left outer join into the generated view, while exposing the association leaves the view without one and adds the join only for a query that asks for its fields, which the session calls join on demand. The data modelling edge is the advice that follows and the demo under it — cardinality written as precisely as the data allows, because the optimiser trusts it, shown with a view whose missing cardinality let SELECT COUNT(*) prune the join and return 18 rows where selecting the columns returned 56, plus the left-hand, right-hand and left-outer-to-inner rewrites that correct cardinalities make possible.SAP Developers, published 2026-10-12
Developing authorizations for business users in SAP Business AI Platform, ABAP environmentDeveloping authorizations for business users in SAP Business AI Platform, ABAP environmentA Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the authorization edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The ABAP CDS edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.published 2026-10-12
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleBuilding and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleA hands-on walkthrough of building a native MCP server artifact on SAP Integration Suite's Integration Cell runtime: an API artifact built from an OpenAPI 3.0 specification (the author converted the SAP Business Accelerator Hub's Swagger 2.0 OData spec) through API Management policies, with the MCP artifact's own Authorization policy set to the api.invoke scope for Developer Hub credentials or a custom role such as ESBMessaging.send for BTP OAuth credentials. The same server is then wired to Claude as a custom connector over an OAuth redirect, and to a Joule Studio agent through BTP destinations carrying the sap.mcp.tools.enabled property, with three worked agents (CPI monitoring, a SuccessFactors testing flow, IDoc reprocessing) run from both.Padmanathan_Vijayan, published 2026-09-11
052: 10 Minutes from Start to Launchpad052: 10 Minutes from Start to LaunchpadWalks a RAP application from a root CDS view entity through a consumption projection and its associations to a metadata extension: a facet per field group, a hidden field via UI.hidden, and a selection field on the ABAP package, all in a Customer-layer DDLX source read by the generated Fiori elements app. It then covers the parts ABAP CDS modelling and annotation stop short of — service definition and binding, generating the UI in Business Application Studio, and wiring the deployed app into the Fiori Launchpad through an IAM App and business catalog.Björn S., published 2026-09-07
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Beyond READ_TEXT: Decoding SAPscript Long Texts (STXL) with SQLScript in CDS/AMDPBeyond READ_TEXT: Decoding SAPscript Long Texts (STXL) with SQLScript in CDS/AMDPSTXL stores a SAPscript long text as a compressed ABAP cluster container — LZ77 plus canonical Huffman — so the only official reads are READ_TEXT, one call per text, and its mass variant READ_TEXT_TABLE, both of which ship every decompressed line to the application server and stay invisible to ABAP CDS. The author reverse-engineered that on-disk format and ported the decoder into SQLScript, wrapped in an AMDP procedure and exposed through CDS table functions, turning long texts into a joinable, filterable column read directly in the database. On ABAP 7.56 a table function needs the driver-and-filter pattern shown because a parameter cannot bind to a calling column; on ABAP 7.58/S/4HANA 2023 the same result becomes a parameter-less CDS scalar function with true filter push-down.aamelin1, published 2026-08-20
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
RAP - Feature Control (Part 2)RAP - Feature Control (Part 2)Implements a reusable AUTHORITY-CHECK wrapper class and wires it into a RAP behaviour implementation's Feature Control, both the static global check on Create and the instance-based, partner-scoped checks on Update and Delete, so that an authorization decision greys out an action in the Fiori UI rather than only rejecting it after the save. Part two of the author's Sales App series, it also flags a newer, more strictly typed Feature Control flag SAP introduced since the first article, since using the older type produces a warning and can leave a flag silently without effect.Björn S., published 2026-08-14
BTP - Restriction TypeBTP - Restriction TypeWalks through creating a Restriction Type and Restriction Field for an ABAP RAP authorization object, so the values an IAM app would otherwise fix as static entries can instead be maintained per Business Role in the Fiori Launchpad. Read and Write access on the restriction still follow the activities defined on the authorization object itself (03 for read, 01/02/06 for write), and the piece shows the effect end to end: a Fiori app narrowed to only the business partners assigned on the role. This is the ABAP door's authorization mechanism made dynamic — an access decision moved from the IAM app's fixed values onto the role, without touching the underlying CDS access control.Björn S., published 2026-08-11
BTP - Authorization ObjectBTP - Authorization ObjectWalks through building a classic ABAP authorization object for the ABAP environment — an authorization field, the object itself created in ABAP Development Tools rather than the classic SU21 transaction, and its activities (01 create, 02 change, 03 display, and others) — then wires it into a CDS role's access control with the pfcg_auth aspect on the WHERE condition, which is authorization's ABAP form: CDS access control limiting what a view entity returns to the conditions in a CDS role. The check inherits down to a consumption view and even the Data Preview, and the piece notes the WITH PRIVILEGED ACCESS addition developers use in the SQL console to bypass it while testing.Björn S., published 2026-08-07
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
Deep Insert in SAP CAPM Using Composition and Fiori ElementsDeep Insert in SAP CAPM Using Composition and Fiori ElementsParent and children created in one transaction, which composition already gives you in the model — the post is about what Fiori elements does with it, and what the payload looks like when the UI sends both at once.published 2026-05-22
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Calculating IBP Technical Week "Key Figure Date" in S/4HANA Using CDS ViewCalculating IBP Technical Week "Key Figure Date" in S/4HANA Using CDS ViewA custom ABAP CDS view entity, selecting from the standard I_CalendarDate view, to derive the first date of an SAP IBP "technical week" — the split IBP applies when a calendar week crosses a month boundary, a date S/4HANA does not expose natively. The calculated field is built with a case/when expression over dats_add_days, giving any calendar date's technical-week key figure date.bharatbajaj, published 2026-02-18
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Building an Enterprise Application Using Fiori Elements and CAP - Part 1Building an Enterprise Application Using Fiori Elements and CAP - Part 1Part one of three, and it is all backend: the CAP service the UI will sit on. The author states the constraint the series works under — simple enough for someone new to the stack, without departing from the standard project layout.Farooq, published 2025-12-10
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
How to Check Fiori Apps Related Authorization Object MassHow to Check Fiori Apps Related Authorization Object MassA structured, table-driven method for mass-checking which authorization objects back a set of Fiori apps: map each Fiori App ID to its OData service, look up that service's hash in USOBHASH, then resolve the hash to its authorization objects (S_SERVICE, S_RFC, among others) in USOBTC. The author reports the method's limits in practice — apps built on a transaction code are already findable directly in USOBTC, and the same approach resolved only 5 of 300 Web Dynpro apps, which needed a manual catalog-and-hash workaround instead.MehmetSaidDemir, published 2025-10-07
Create CDS Views and expose through OData service in CAPMCreate CDS Views and expose through OData service in CAPMViews defined in CDS and then exposed, which is the whole of what a small CAP service is. Written step by step from cds init onward in Business Application Studio.VenkateshMundru, published 2025-08-11
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesSecuring SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management service (XSUAA), restricting CDS service definitions with @restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds Node.js example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Soumya-Pirlamarla, published 2025-07-14
A CAP Plugin for Flexible Number Range Management: cds-numberrange-pluginA CAP Plugin for Flexible Number Range Management: cds-numberrange-pluginThe author's own plugin, and the reason given for writing it is about plugins rather than about number ranges: a year of using them convinced them that this was the way to extend CAP without leaving marks on the application. Sequential document numbers are the thing it does; keeping the host project clean is the thing it argues for.abdulbasit, published 2025-06-17
Understanding Projections in CAPM: Select Only What You Need!Understanding Projections in CAPM: Select Only What You Need!One concept, explained by someone who had just learned it and says so — what a projection is, why it matters, and an analogy. The register is unusual here and suits the subject: projections are the first thing that makes CDS feel different from a table.Avisek_, published 2025-06-10
How to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHow to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHiding Create, Edit and custom action buttons according to what the user may actually do — the join between the authorisation model and the annotations, which is where the two usually fail to agree and the UI offers something the service will refuse.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
CAPM Basics - Part 4CAPM Basics - Part 4Part 4 of a CAPM Basics series binds the deployed XSUAA and SAP HANA Cloud service instances with cds bind and runs the project against them from a laptop via cds watch --profile hybrid, the hybrid-testing loop @sap/cds-dk provides. It then restricts the service with @restrict (READ granted to a Viewer role, full access to Admin) and adds OData Capabilities restrictions plus @odata.draft.enabled so a Fiori elements client renders create, update and delete without UI code. It closes by adding a UI module with the SAP Fiori Generator, wiring an approuter via cds add approuter to forward the auth token, and updating the SAP Authorization and Trust Management service instance with the generated redirect URI before redeploying.archisman92, published 2025-05-10
Generating Adobe Form Using RAP framework OData ServicesGenerating Adobe Form Using RAP framework OData ServicesModels a RAP root view entity and consumption view over a custom sales-order table, built with ABAP CDS, and exposes it through a service definition and an OData V2 UI service binding. A separate SEGW project implements GET_STREAM to call an Adobe Form driver class and stream the rendered PDF back as the response, with a computed link field added to the CDS view so the UI can open it. The PDF is generated in the backend and returned to the calling program rather than sent straight to a printer.Megastar, published 2025-03-18
CAP-JAVA implementation for Authorization Management Service (AMS)CAP-JAVA implementation for Authorization Management Service (AMS)Short and deliberately narrow: the author defers the concepts to kevin_li's post and writes only the CAP Java part — the development flow, designing the authorization model, and assigning and checking a policy. Read the other one first; this is the half that touches the code.Harvey_Yao, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
My CAP Projects ToolboxMy CAP Projects ToolboxA working inventory of daily CAP tooling: scaffolding a project with cds init and growing it facet by facet through cds add (TypeScript, seed data, an .http test file, a handler stub), then running it with cds watch and setting a breakpoint in a custom handler from SAP Business Application Studio's JavaScript Debug Terminal. It also walks through an @open entity that accepts properties the model never declared, and reading temporal data defined with CAP's temporal aspect, where a plain read returns only what is valid now and a custom handler is needed to retrieve every time slice.vvdries, published 2024-12-23
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
SAP Incentive Management - Understanding of CSN file & CLI Command to generateSAP Incentive Management - Understanding of CSN file & CLI Command to generateCSN met from the far end: not as CAP's compiled model but as the interchange format a product hands to Analytics Cloud so a story knows the shape of the data. Explains what CSN is, why the format matters here, and the command that produces one.Yogananda, published 2024-11-19
Authorization Management Service in SAP Cloud Identity ServiceAuthorization Management Service in SAP Cloud Identity ServiceStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.kevin_li, published 2024-10-17
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
CAP, CDS, CDL, CSN and jq - finding associationsCAP, CDS, CDL, CSN and jq - finding associationsHow associations are actually represented once CDL is compiled into CSN, worked out by parsing the machine-readable form with jq. Useful less as a recipe than as a way in: anything that wants to reason about a CDS model without the compiler has to read CSN, and this is what that looks like from the outside.published 2024-04-16
SAP CAP(Cloud Application Programming)开发框架概述SAP CAP(Cloud Application Programming)开发框架概述A Chinese-language walkthrough of CAP built mainly from CAPire's own "About CAP" page: CDS entities, associations, compositions and aspects for data modelling, with an extend Books with @restrict: [{ grant:'WRITE', to:'admin' }] aspect as its authorization example; CQL and CQN queries shown against both a local service and OData's $select/$expand; and the service-and-event model — this.on, this.emit, srv.on — that carries CAP's async processing. It closes with the author's own setup: installing @sap/cds-dk, scaffolding a bookshop project with cds init, and running it with cds watch against local SQLite, mocked authentication and file-based messaging standing in for HANA Cloud, IAS and Kafka.ArthurYang, published 2024-01-07
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
Use Aspects, Association and Convert OData V4 to V2 using ProxyUse Aspects, Association and Convert OData V4 to V2 using ProxyTwo halves that turn out to belong together: aspects and associations in the model, and then the v4-to-v2 proxy in front of it. The model decides what the proxy has to carry, which is why the author put them in one post.rahul_rajagopal, published 2023-08-28
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
#BTP #SAPCAP: Quirky Nuggets (N01-N02)#BTP #SAPCAP: Quirky Nuggets (N01-N02)Walks through two CAP gotchas: the on/before/after phases of custom event handlers, shown with an after handler whose edits only reach the result when the handler returns an object or array, never a primitive; and the @assert.unique annotation, which builds a database uniqueness constraint from the model. For Input validation, the catch is that once the constrained property is nested, @assert.unique must name it by its model dot path (assignment.type) rather than the flattened column data modelling compiles it to (assignment_type).published 2023-06-05
[Part – 2] Enrich CAP based Services with Behaviors using Annotations[Part – 2] Enrich CAP based Services with Behaviors using AnnotationsThe second half of a two-part walkthrough of CAP's behavioral annotations, following on from access control and input validation in the first part. This post works through @cds.autoexpose, @cds.api.ignore, @cds.persistence.exists/skip, @cds.on.insert/@cds.on.update and the @odata.Type/@odata.singleton mapping overrides, all shaping how a CDS model is projected into a service, which is data modelling. Alongside these it covers @cds.query.limit for default and maximum page sizes (pagination and streaming), @odata.etag with exclusive and shared locks for optimistic concurrency (concurrency control), and @cds.search for scoping $search to chosen elements (search), each with a CDS code example.published 2023-01-29
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Understanding entity relationships in CDSUnderstanding entity relationships in CDSModels a CAP task-management domain in CDS — Users, Roles, Tasks and Categories joined by to-one associations, a composition of tasks owned by a user, and a self-referencing association from a user to its parent — using the managed and cuid aspects from @sap/cds/common. It then visualises that model in Business Application Studio's CDS Graphical Modeler and adds a CAP Java before-handler that sets a generated password on user creation.Avinash_Vaidya, published 2022-11-22
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
SAP CAP Recent Enhancements the HANA Dev Should Know AboutSAP CAP Recent Enhancements the HANA Dev Should Know AboutThomas Jung walks through CAP features for HANA database developers that landed through late 2021: doc comments in the data model (CDL comments propagated into generated database objects via the package.json cdsc.docs compiler option), and schema evolution reaching general availability in the November 2021 release, using the @cds.persistence.journal annotation and cds.hana.journal settings to generate incremental hdbmigrationtable migration scripts instead of dropping and recreating tables. It also walks through two features outside those two: window functions in view column definitions, added in the December 2021 release, and a beta assert_integrity setting that generates database foreign-key constraints from 1:1 associations and compositions.published 2022-02-15
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
SAP CAP Adapter to expose OData as custom REST ServiceSAP CAP Adapter to expose OData as custom REST ServiceWalks through consuming an external OData V2 service in a CAP project — cds import converts the Northwind service's EDMX into a CSN and cds.connect.to wires up the remote proxy — then re-exposing it as plain REST with the @protocol:'rest' annotation instead of OData's own envelope. Shows two ways to reshape the response, renaming and dropping fields in a CDS projection or rewriting the returned objects in a custom service handler, and remaps ?pageSize and ?offset onto OData's $top and $skip in that same handler.Former Member, published 2021-09-15
Creating structured types, enums and named aspects using the CDS Graphical ModelerCreating structured types, enums and named aspects using the CDS Graphical ModelerThe modelling constructs that are awkward to draw — structured types, enums, named aspects — done in the graphical modeller rather than in CDL.Xiao-fei_Song, published 2021-05-26
Importing @sap/cds common.cds to your CAP project using the CDS Graphical ModelerImporting @sap/cds common.cds to your CAP project using the CDS Graphical ModelerPulling the common aspects and code lists from @sap/cds into a model through the modeller, so the reuse types appear in the diagram rather than only in the file.Xiao-fei_Song, published 2021-05-06
First Java Cap ApplicationFirst Java Cap ApplicationA step-by-step walkthrough of a first CAP Java project: com.sap.cds:cds-services-archetype scaffolds the initial Maven project, and the domain model is then rewritten in the db folder with entities, the cuid and managed aspects, associations, compositions and a CodeList, so a hand-coded event handler serving a single entity gives way to a service that CAP's generic persistence handling serves without custom code. It deploys that model to SQLite for local development — cds deploy --to sqlite, then a Spring profile pointing at the generated database file — and ends by adding an index.cds so the model and service can be published as a reusable npm module.bruce_wang3, published 2020-12-08
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Using Postman for API Testing with XSUAAUsing Postman for API Testing with XSUAAA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.mariusobert, published 2020-03-02
Computed field example in CAPComputed field example in CAPAn answer to a Community question — how to count the entities on the far side of an association — written up as a short post rather than left in a thread. The answer combines CDS with Node.js service events, which is the seam worth noticing: some of what looks like modelling is expressed in the model and some has to be computed when the request arrives, and the boundary between them is not obvious from either side.published 2019-08-21
Computed field example in CAP
Data modelling has changed 3 times since this was published, most recently in @sap/cds 9.9.0, 2026-04-23. Affects A recipe, Runnable code.
SAP Cloud Platform Backend service: Tutorial [11]: CDS : magic: key: generationSAP Cloud Platform Backend service: Tutorial [11]: CDS : magic: key: generationExplains CDS's UUID key type: giving a key property UUID gets its value generated automatically instead of a hand-picked unused number, as data modelling lets an element's type do, at the cost of a 36-character value unfit for a user-facing display. It then works out how that generated value is addressed in a single-entity read URL — bare brackets in OData V4 against the guid'...' literal V2 requires — citing the OData specification for the difference.CarlosRoggan, published 2019-03-15
Develop a full stack Business application with SAP Cloud Application Programming ModelDevelop a full stack Business application with SAP Cloud Application Programming ModelBuilds a full-stack CAP application in SAP Web IDE Full Stack's now-retired 'SAP Cloud Platform Business Application' template: a data-model.cds entity with its own service definition, then Fiori annotations on the generated OData. Building the project compiles that model into Catalog.xml and csn.json, the EDMX and CSN that metadata publishing says every exposed service gets. The entity and service definitions it writes by hand are the basic shape data modelling covers, though the webIDE and MTA tooling staged around them is gone.former_member584731, published 2018-11-29
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Explore the declarative power of status-transition flowsExplore the declarative power of status-transition flowsModelling which state a record may move to next, declaratively, rather than scattering the rule across the handlers that move it.SAP
Analyze and optimize ABAP Cloud model apps built on core data servicesAnalyze and optimize ABAP Cloud model apps built on core data servicesPerformance anti-patterns in data models built with ABAP CDS under ABAP Cloud applications, and the tools that find them: the abstract names ABAP cross trace, the SQL analyzer (PlanViz) in Visual Studio Code and the SAP HANA database explorer as what the session uses to follow a bottleneck from the application to the database. The anti-patterns are taken from real business applications, which is where the data modelling edge holds; which ones are shown is not in the abstract. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Ingo Braeuninger, Robert Werlich, Steffen Siegmund and Thomas Fiedler, written here from SAP's abstract; the recording is not yet published.
Building trusted applications on SAP Business AI Platform by designBuilding trusted applications on SAP Business AI Platform by designBuilding cloud applications on SAP Business AI Platform with security and compliance built in: the identity, connectivity, governance and security services SAP groups under the platform, secure-by-design development, and authorisation and access controls for AI agents. The edges are to Authorization and to Tool governance, the concern of what an agent may call with which authorisations; the abstract names the service categories and no service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christian Cohrs and Regine Schimmer, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Data modellingcapability, core and community
Authorizationcapability, core and community
SAP Communitypublishing source
SAP Communitycap-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- Entered the atlasDiscovered via SAP Community · cap-tag.
For your agent
- Ref
content:developing-business-services-with-cloud-application-programming-cap-model-in-sap- JSON
- /content/developing-business-services-with-cloud-application-programming-cap-model-in-sap.json
- MCP
- Connecting an agent