BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
Making the Case for Enhanced REST Adapter in SAP Integration Suite
Catalogues what SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's native HTTP adapter supports for authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handlingError handlingTurning a failure into a response a client can act on — protocol-correct error payloads, correlation, and a boundary between internal detail and what a caller sees.SAP and community, unassessed (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPIOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.SAP and community, narrow by design import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.
Where it sits
Explains
AuthenticationBTPAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.Error handlingError handlingTurning a failure into a response a client can act on — protocol-correct error payloads, correlation, and a boundary between internal detail and what a caller sees.OpenAPIBTPOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.
Source
reachable
Who is behind it
peter_ha3author
Properties
About this work
For authentication
Applies in
For openapi
Applies in
Group by52 of 52 pieces
Piece, what it offersStill applies
S/4HANA Custom Development - What happens in case of errors in BAPIs or RAP BOs?S/4HANA Custom Development - What happens in case of errors in BAPIs or RAP BOs?A Devtoberfest 2026 session on what a custom S/4HANA process does when a BAPI or a RAP business object fails. It is framed from project work rather than product development, with the same issues and challenges turning up on project after project, and it offers the ABAP Processing Center, ABAP-PRC, as what fills the gap it names in modern ABAP development. The edges rest on the opening, which states the session's subject as errors in S/4HANA custom development, read as error handling on the ABAP door, and names that framework.SAP Developers, published 2026-09-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecSAP Job Scheduling Service: 🔧 Generate Your Own Client Library from OpenAPI SpecA tutorial on generating a type-safe client library for the SAP Job Scheduling service's REST API from its OpenAPI specification, using the OpenAPI Generator CLI to target Node.js, TypeScript, Java, Python, Go or C#. It walks through OAuth 2.0 client-credentials authentication and the generated client's Jobs API, listing, creating and reading jobs with their cron schedules, and lists what the service's error statuses (400, 401, 404, 409, 429, 503) mean to a caller. It states that the official @sap/jobs-client will be deprecated and tells readers to use a generated client for now.DenisDuev, published 2026-05-04
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)A step-by-step build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter accepts JSON, a content modifier stores the currencies and amount as exchange properties, and a Request-Reply step calls an external rate API before a Groovy script renders the result as an HTML table. A Global Exception Subprocess centralizes error handling for the whole flow, turning the MPL ID, error type and message into HTML and mailing it as a notification to a support address.RajeshwerRao_G_1, published 2026-04-01
Connecting SAP Integration Suite with Slack: A Hands‑On Guide with Open ConnectorsConnecting SAP Integration Suite with Slack: A Hands‑On Guide with Open ConnectorsA walkthrough builds an integration flow on SAP Integration Suite that receives JSON over an HTTPS sender, transforms it with Groovy, and posts a formatted message to a Slack channel through the Slack Open Connector. An Exception Subprocess catches token, channel and connector-invocation failures and returns a structured error response, and the author verifies it by forcing a bad channel ID and confirming the error-notification email arrives.jareenabee_dudekula, published 2026-03-20
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
Use REST services in GraphUse REST services in GraphSAP Graph turns a REST service into a business data graph by pairing a data destination with a metadata destination that supplies its OpenAPI document, since plain REST has no $metadata endpoint of the kind OData exposes. It walks through creating both destinations on SAP BTP, including the OAuth2ClientCredentials authentication needed when the OpenAPI file is hosted through an API artifact, and shows how Graph flattens each REST operation's path and method into an unbound OData action or function, such as turning a DELETE on /users/pets into a POST to users_pets__delete.florian_moritz, published 2026-01-20
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
How to create a Purchase Order through BAPI in the SAP through program ( SE38 ) T-CODE .How to create a Purchase Order through BAPI in the SAP through program ( SE38 ) T-CODE .Walks through creating a purchase order from an ABAP report (SE38) by filling the BAPIMEPOHEADER/BAPIMEPOITEM structures and their X-indicator counterparts, then calling BAPI_PO_CREATE1 within the same session. Its error handling centres on the BAPIRET2 return table: looping over entries typed E or A, skipping BAPI_TRANSACTION_COMMIT when one is found, and displaying the returned message text rather than assuming success once the function module returns.chandu_kumar_badukuri, published 2025-12-18
Parallel Data Filtering and Dropbox Integration Using SAP Cloud IntegrationParallel Data Filtering and Dropbox Integration Using SAP Cloud IntegrationA step-by-step build of an integration flow in Cloud Integration: a Start Timer triggers the flow, a Parallel Multicast splits student records by gender through XPath filters, and each branch uploads its file to Dropbox over a Receiver Adapter authorized against a Dropbox app's OAuth2 credentials. An Exception Subprocess captures the error message and a Mail Adapter sends it over SMTP, centralizing error handling and an email notification for the whole flow.Vurumind03, published 2025-12-10
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
New tutorial for UI5 Middleware FE MockserverNew tutorial for UI5 Middleware FE MockserverA step-by-step tutorial accompanying a Devtoberfest session walks through @sap-ux/ui5-middleware-fe-mockserver across nine exercises: zero-config mock data generated from OData metadata, custom JSON datasets with consistent IDs and referential keys, JavaScript actions, multi-service and cross-service scenarios, tenant isolation through sap-client, returning 400/404/422/500/501 responses for UI error-handling tests, and offline end-to-end tests run with wdi5. A companion tool, ui5-middleware-odata-recorder, captures real backend OData traffic to generate the mock datasets used for offline replay.published 2025-10-14
Basic code's of ABAPBasic code's of ABAPNine standalone ABAP reports built around REUSE_ALV_GRID_DISPLAY and CL_SALV_TABLE, covering display, screen validation, spool creation, Excel upload and table maintenance without SM30. One report raises and catches a custom exception class with RAISE EXCEPTION and TRY/CATCH, the class-based mechanism error handling names for ABAP; another submits a job to spool, converts it to PDF with CONVERT_ABAPSPOOLJOB_2_PDF and exports a CL_SALV_TABLE result to Excel before mailing both, producing document output from spool rather than Form Builder.RakeshZore, published 2025-09-30
Migration Journey from MuleSoft to SAP Integration Suite (CI)Migration Journey from MuleSoft to SAP Integration Suite (CI)Maps MuleSoft Anypoint's error handling onto SAP Integration Suite: the Global Error Handler and MuleSoft's built-in retries become Exception Subprocesses with scripted Groovy retry logic or JMS-based retry, since Cloud Integration has no automatic equivalent. MuleSoft's searchable logger text becomes Content Modifier headers and Groovy-scripted Message Log entries, correlated by application message ID and correlation ID for traceability across complex interfaces. The mapping is drawn from the author's own migration project across assessment, development and validation phases, and is explicitly flagged as not an SAP- or MuleSoft-approved design.Shailaja, published 2025-09-21
Effective Axios Error Logging for Robust SAP IntegrationsEffective Axios Error Logging for Robust SAP IntegrationsTwo logged failures printed side by side, and the point is made by looking at them: one tells you what went wrong and one does not. Axios buries the useful part of an HTTP error, and this is what to unwrap before logging it from a CAP service.Sahil2508, published 2025-08-31
How to subscribe or fetch data from solace to CPI using AEM Adapter : part-5How to subscribe or fetch data from solace to CPI using AEM Adapter : part-5Closes a series on event-driven architecture with Solace by detailing the subscriber side of an iFlow in Cloud Integration: an advanced event mesh adapter feeds an exception subprocess, and a Groovy step classifies each failure as recoverable, left to Solace's own retry, or non-recoverable, answered with a custom property that tells Solace to stop retrying before the message reaches an escalation layer. The escalation layer names email, ServiceNow and Loggly as destinations without explaining any of them.pavanKolla, published 2025-08-03
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Beginners Guide to Advanced Event MeshBeginners Guide to Advanced Event MeshA scenario-by-scenario walkthrough of Advanced Event Mesh, run through Cloud Integration iFlows: publishing and consuming queue messages, dead message queue setup with retry counts and acknowledgment modes, direct messages, durable topic endpoints and selectors, time-to-live, REST Delivery Points, replay by replication group message ID, parallel consumers with partition keys, and the request-reply pattern. Each scenario is built and verified step by step against a Solace trial account standing in for AEM.PriyankaChak, published 2025-07-24
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
SAP: Email Functionality in SAP with a Custom Function ModuleSAP: Email Functionality in SAP with a Custom Function ModuleA custom ABAP function module, ZFM_SEND_EMAIL, sends mail through Business Communication Services' CL_BCS and CL_DOCUMENT_BCS classes, adding TO/CC/BCC recipients and multiple attachments by building the HTML document in application code on top of what CL_BCS delivers, which is how ABAP's notifications capability describes mail going out. The send sits in a TRY structure whose three CATCH blocks for CL_BCS's class-based exceptions are empty, so what reaches the caller is a BAPIRET2 table that BAPI_MESSAGE_GETDETAIL fills on the paths without an exception: no recipients given, sent to all, or not sent. That conversion into a caller-facing message table is what ABAP's error handling capability leaves to the application.Surendra_Karma, published 2024-12-16
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Don't "let it crash", is this the new CAP guideline?Don't "let it crash", is this the new CAP guideline?Dinu traces a change in error handling in CAP's Node.js runtime: @sap/cds@8.2.0 adds a cds.server.shutdown_on_uncaught_errors config flag, defaulting to true, but invoking an operation with an undefined variable no longer takes the server down, with or without the flag, where the same code crashed it on cds@6 and cds@7, and the author notes the old behaviour was already missing in cds@8.1. It still crashes with features.odata_new_adapter turned off to use the old OData parser, so it is the new OData adapter, like the REST adapter before it, that answers an uncaught error with a 500 instead of taking the process down.Dinu, published 2024-09-06
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
Swagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsSwagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsA blog post wrapped around a video playlist from the SAP HANA Academy — Swagger UI for CDS, added to the BTP extension generator series. The written half is an ingredients list and a table of contents; the substance is in the recordings.dvankempen, published 2021-07-09
SAP Cloud Application Programming Model（CAP）：カスタムロジックの実装 – Part 2SAP Cloud Application Programming Model（CAP）：カスタムロジックの実装 – Part 2A walkthrough of implementing custom logic in a CAP Node.js service for the capire bookshop sample, registering before, on and after handlers around the generated CRUD service for its Books and Orders entities. The before handler validates an incoming order's amount and runs a transactional CQN UPDATE to decrement stock, raising a 400 or 409 through req.error when the amount is invalid or no rows match; an after handler on READ appends a discount note to overstocked books.rasai, published 2021-01-01
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Authenticationcapability, core and community
Error handlingcapability, core and community
OpenAPIcapability, core and community
SAP Communitypublishing source
SAP Communityintegration-suite-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- Entered the atlasDiscovered via SAP Community · integration-suite-tag.
For your agent
- Ref
content:making-the-case-for-enhanced-rest-adapter-in-sap-integration-suite- JSON
- /content/making-the-case-for-enhanced-rest-adapter-in-sap-integration-suite.json
- MCP
- Connecting an agent