BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
Microsoft Sentinel for SAP goes agentless
Explains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp setup together with SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed maintenance view, with a user authorised to call them (RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design). It also covers calling the audit logAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.
Where it sits
Explains
Audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.DestinationsBTPDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.RFC connectivityBTPRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.
Source
reachable
Who is behind it
Martin PankrazMartin PankrazWrote this
In the atlas: maintains 1, contributes to 2, wrote 4@MartinPankrazauthor
In the atlas: maintains 1, contributes to 2, wrote 4@MartinPankrazauthor
Properties
About this work
For destinations
Applies in
For rfc-connectivity
Applies in
Group by52 of 52 pieces
Piece, what it offersStill applies
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]The consequence of decoupling: with the back end live on its own Cloud Foundry route, the front end needs a BTP destination to reach it rather than a relative path. Short, and it is the join the architecture creates.sanjucs, published 2026-05-18
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Implementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsImplementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsWhy environment variables are the wrong place for backend endpoints in a CAP application, and what replaces them: cockpit destinations resolved at runtime, with the subaccount or instance identified as the request is handled. The argument is about redeployment — an endpoint kept in the environment means a deploy every time it moves — and the shape it produces is one codebase serving several landscapes without a build per landscape.Dnyaneshwar Salve, published 2026-03-18
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
UI for the BTP Application Vulnerability ReportUI for the BTP Application Vulnerability ReportAn open-source SAPUI5 front end for SAP's Application Vulnerability Report API, backed by a CAP Node.js service that projects the external findings as an OData V4 entity and forwards each query with api.run(req.query). The CAP service reaches that API through a Destination service instance configured with OAuth2ClientCredentials authentication from a service key, so the address and credentials stay out of the application code.published 2026-02-10
Use REST services in GraphUse REST services in GraphSAP Graph turns a REST service into a business data graph by pairing a data destination with a metadata destination that supplies its OpenAPI document, since plain REST has no $metadata endpoint of the kind OData exposes. It walks through creating both destinations on SAP BTP, including the OAuth2ClientCredentials authentication needed when the OpenAPI file is hosted through an API artifact, and shows how Graph flattens each REST operation's path and method into an unbound OData action or function, such as turning a DELETE on /users/pets into a POST to users_pets__delete.florian_moritz, published 2026-01-20
Modernizing RFC/BAPI-based Integrations for a Clean Core with SAP Integration SuiteModernizing RFC/BAPI-based Integrations for a Clean Core with SAP Integration SuiteWalks a BAPI-based interface from SAP PO through three paths to SAP Integration Suite: lift-and-shift, which keeps the RFC connection to the ABAP system as-is and calls it through Integration Suite's RFC adapter; protocol modernization, which re-exposes the same BAPI as a SOAP web service; and clean core modernization, which replaces it with an SAP-managed API surfaced by the migration assessment report. Follows a BAPI_MATERIAL_AVAILABILITY interface through the first and third paths, showing the generated RFC-adapter iFlow against the OData API found for it.arunmaarirajha_kv, published 2025-10-10
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
IPS provisioning to ABAP Cloud Developer TrialIPS provisioning to ABAP Cloud Developer TrialWalks through provisioning users and groups from SAP Cloud Identity Services' Identity Provisioning into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud Connector and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Laurence, published 2025-09-04
Configuring SAP Cloud Integration for an IBP to S/4HANA (on prem / private cloud) integrationConfiguring SAP Cloud Integration for an IBP to S/4HANA (on prem / private cloud) integrationWalks through creating the two BTP destinations an Cloud Integration iflow needs for an IBP-to-S/4HANA integration: one of type RFC with a WebSocket RFC server host and port for the IBP tenant, and one of type RFC with the on-premise proxy type, a Cloud Connector location ID and a virtual host for the S/4HANA system. It then has the reader copy SAP's prebuilt IBP integration packages into the Design workspace and deploy every reusable iflow in them before a business iflow can call the S/4HANA extractor through SAP Connectivity service.SofianePebre, published 2025-08-27
Sending Emails from SAP CAP Applications with Any SMTP ProviderSending Emails from SAP CAP Applications with Any SMTP ProviderWalks through sending mail from a CAP application with no dedicated mail service: create an SMTP destination for a Gmail account in the SAP BTP cockpit, bind it to the Cloud Foundry app, and call the sap-cf-mailer npm package from a CAP service handler naming that destination. The SAP Destination service holds the SMTP host, port and app password so the handler code names only the destination, and the same handler sends plain text, an HTML body, or a message with a base64-encoded attachment.MaheshSirsat1708, published 2025-08-19
Exposing SAP S4 Onprem data to external System || Odata Service || BTP || Destination-ConnectivityExposing SAP S4 Onprem data to external System || Odata Service || BTP || Destination-ConnectivityA walkthrough that wraps an IDOC-reprocessing function module in a RAP OData service on S/4HANA on-premise, then reaches it from a Python app on Cloud Foundry by looking the on-premise system up through the Destinations service and calling it through SAP Connectivity service proxies behind Cloud Connector. It walks through the destination and connectivity service keys, resolving the destination's URL and credentials, and the connectivity-service token and proxy call needed to reach the on-premise OData endpoint, noting the app must run on Cloud Foundry since destination and connectivity lookups do not work from a local machine.Ace_D, published 2025-07-24
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Using SAP managed iFlows for Time series data Integration in SAP IBP – Part 1 - Reading dataUsing SAP managed iFlows for Time series data Integration in SAP IBP – Part 1 - Reading dataWalks through a custom iFlow that reads time-series and master data out of SAP IBP by calling the RFC function modules IBP exposes under communication scenario SAP_COM_0931, reusing SAP's own "SAP IBP – Reusable Integration Flows" package discovered inside SAP Integration Suite and run from SAP Cloud Integration. The call itself goes through an SAP Destination service destination of type RFC — Proxy Type Internet, a communication-user's credentials and jco.client.* properties for host, port and serialization — rather than a connection wired by hand, which is the destination handling RFC connectivity asks for. It also covers the asynchronous read: a UUID transaction id and an offset-driven paging loop for pulling large result sets in packages.Domnic, published 2025-07-18
Using SAP managed iFlows for Time series data Integration in SAP IBP – Part 2 - Writing dataUsing SAP managed iFlows for Time series data Integration in SAP IBP – Part 2 - Writing dataWalks through building a custom integration flow in Cloud Integration that writes time-series and master data into SAP IBP by calling the SAP-managed reusable iFlows behind communication scenario SAP_COM_0931, which consume RFC function modules through a communication user. It details the BTP destination needed to reach them (Type RFC, Proxy Type Internet, and the jco.client.* properties), and the main-flow and local-integration-process design — payload validation in a Groovy script, batch creation, then the XML attributes and payloads for posting master data and key-figure values and for triggering post-processing.Domnic, published 2025-07-18
Set up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesSet up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesA step-by-step walkthrough of installing Cloud Connector, adding a subaccount, managing identity and trust certificates in STRUST, and mapping cloud-to-on-premise paths for an SAP HANA backend. It ends by creating a Destinations entry in SAP BTP with proxy type OnPremise and basic authentication, then testing it from SAP Business Application Studio.Thijn_Grilis, published 2025-06-12
Consuming data from SAP Datasphere in SAP BTP CAP ApplicationsConsuming data from SAP Datasphere in SAP BTP CAP ApplicationsDatasphere as the source a CAP application reads from — the case for it being that Datasphere already unified the SAP and non-SAP data, so the application does not have to. From a real project.sudheer-tammana, published 2025-06-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
Configure Journal Entry Posting Approval from Store Template in Build Process AutomationConfigure Journal Entry Posting Approval from Store Template in Build Process AutomationWalks through deploying SAP's Journal Entry Posting Approval template from the SAP Build Process Automation Store against an on-premise S/4HANA system that has no Secure Network Connection: destinations for S/4HANA via Cloud Connector, for SAP Document Management service, integration option to hold the approval's supporting documents, and for the BPA service and its SMTP mail. It then swaps the template's SNC action groups for basic-connection BAPI calls and deploys the approval's UI5 applications so the task lands in My Inbox, with a Desktop Agent registered to run the unattended document-check and document-post automations.published 2025-01-28
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Hey ABAP Cloud please let me save my data export to Azure Storage please🥺🙏- part 4Hey ABAP Cloud please let me save my data export to Azure Storage please🥺🙏- part 4Walks through reaching Azure Blob Storage from ABAP Cloud without an intermediary Cloud Foundry app: an OAuth2 client credentials flow against Microsoft Entra ID, driven either through cl_http_destination_provider and the SAP Destination service at subaccount or Cloud Foundry-space level, or through the SAP_COM_0276 communication scenario and Communication Management. Notes that SAP marks the destination-service route deprecated for ABAP Cloud even though it alone offers management APIs and cross-tenant reuse, and closes on automating the resulting client-secret rotation with Azure Key Vault.published 2023-11-21
从BTP Launchpad里的sapui5应用里调用部署的CPI IFLOW从BTP Launchpad里的sapui5应用里调用部署的CPI IFLOWA short follow-up to the author's earlier post on calling a deployed CPI iflow from a standalone-router SAPUI5 app, adjusted for the case where the app runs inside the BTP Launchpad: the fetch call is built from the launchpad component's own base URI, and the app's xs-app.json approuter route maps a /cpi/* path to a destination that fronts the CPI iflow runtime, with XSUAA authentication on the route. It also walks the MTA build and cf deploy commands used to push the app, scaffolded with generator-easy-ui5, to BTP.Jacky_Liu1, published 2023-06-13
CAP Service to Fetch + Create Sales Order in S4 HANA Public CloudCAP Service to Fetch + Create Sales Order in S4 HANA Public CloudA CAP Node.js walkthrough imports SAP S/4HANA Cloud's Sales Order OData API with cds import, adds csrf handling to the generated service definition, and forwards a custom REST action's reads and writes to the remote proxy through cds.connect.to, the pattern Service integration covers. The mta.yaml binds the SAP S/4HANA Cloud extensibility service and a SAP Destination service instance so the S/4HANA Public Cloud system's address and credentials stay outside the application, per Destinations.Mujeeb, published 2023-05-30
SAP BTP Destinations in a Nutshell Part 1 - Motivation & NoAuthentication DestinationsSAP BTP Destinations in a Nutshell Part 1 - Motivation & NoAuthentication DestinationsOpens a series on SAP BTP Destinations by walking through the simplest case, a NoAuthentication destination from one CAP Node.js app to another on Cloud Foundry, shown two ways: executeHttpRequest from @sap-cloud-sdk/http-client, and a manual sequence that reads the destination service's credentials from VCAP_SERVICES, fetches an OAuth token, and requests the destination by name before calling its URL. The manual path is written deliberately verbose to show what the Cloud SDK call does behind the scenes; later parts of the series cover the other destination types.JakobFra, published 2023-05-23
SAP SuccessFactors extensibility easy with SAP BTP, Kyma runtimeSAP SuccessFactors extensibility easy with SAP BTP, Kyma runtimeSuccessFactors extensibility called directly from Kyma, with OAuth2SAMLBearerAssertion doing the identity part. Long, and code-first — the author leads with the sample rather than with the architecture.quovadis, published 2023-05-22
Surviving and Thriving with the SAP Cloud Application Programming Model: Local development hurdlesSurviving and Thriving with the SAP Cloud Application Programming Model: Local development hurdlesThree hurdles in running a CAP application locally: services mocked with cds run --with-mocks return no data across OData associations until the ON clause is hand-written into the imported CDS, an on-premise API reached through the SAP Cloud Connector times out because its proxy is part of destinations and connectivity and reachable only from inside SAP BTP, and a Fiori frontend served from the HTML5 Application Repository needs the HTML5 Repo Mock to reach a local backend at all. It closes with the launch configurations the author uses for debugging cds watch locally and attaching to a running Cloud Foundry instance.maxstreifeneder, published 2023-02-02
SFSFとHANA Cloudを使用するCAPのアプリケーション開発SFSFとHANA Cloudを使用するCAPのアプリケーション開発In Japanese. A hands-on taking data between SuccessFactors and HANA Cloud through a CAP application — the connection setup, the data and service models, then read and write logic, and a Cloud Foundry deploy. Long enough to carry its own table of contents.rasai, published 2022-12-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
HTML5.Timeout for CAP destinations in mta.yaml longer than defaultHTML5.Timeout for CAP destinations in mta.yaml longer than defaultA page and a half about one property that has to be raised when a CAP destination is slower than the default allows — and it now opens with its own correction, dated October 2025, that the property is called timeout rather than HTML5.Timeout, credited to a commenter. The correction is why it is worth keeping.NilsJanen, published 2022-11-09
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Extend SAP SuccessFactors on SAP BTP with CAP - Import SAP SuccessFactors OData Services definitionsExtend SAP SuccessFactors on SAP BTP with CAP - Import SAP SuccessFactors OData Services definitionsWalks through importing the ECEmployeeProfile and PLTUserManagement OData services from SAP API Business Hub into a CAP project: downloading their EDMX files, running cds import in SAP Business Application Studio to generate the CSN under srv/external, and pointing the resulting cds.requires entries at a destination. The second half creates a destination and an XSUAA service instance on BTP and binds their service keys into a default-env.json file so the project can reach SAP SuccessFactors during local development.published 2022-03-21
How to use SAP Data Intelligence with SAP Cloud ConnectorHow to use SAP Data Intelligence with SAP Cloud ConnectorWalks through reaching an on-premise network from SAP Data Intelligence Cloud with Cloud Connector: installing the client, assigning the Cloud_Connector_Administrator role, registering the subaccount, and mapping on-premise systems as ABAP, HANA or HTTP back-ends in Data Intelligence's Connection Manager. For an ABAP back-end it names the function-module whitelist and the gateway port format RFC access needs, per SAP Note 2835207.Former Member, published 2021-03-16
Use SCP CF Destination service in NodeJs locallyUse SCP CF Destination service in NodeJs locallyReading a destination from a laptop, where the environment variable the destination service normally provides does not exist. A small gap with a real cost, since the alternative is deploying to test every change to a remote call.WouterLemaire, published 2020-05-28
Use SCP CF Destination service in NodeJs locally
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
Introducing the Cloud Application Programming Model (CAP)Introducing the Cloud Application Programming Model (CAP)SAP's own general-availability announcement for CAP, laid out as a Golden Path: a data model and service defined in CDS gets a generated service provider that serves metadata publishing and CRUD requests, fills in primary keys and audit data, and writes trace and audit logs without application code. The same CDS model carries annotations that translate to OData vocabularies and generate a Fiori elements app skeleton, which is how Fiori annotations work in CAP.Daniel7, published 2018-06-05
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Hey ABAP Cloud please let me save my data export to Azure Storage please🥺🙏- part 4Hey ABAP Cloud please let me save my data export to Azure Storage please🥺🙏- part 4Walks through reaching Azure Blob Storage from ABAP Cloud without an intermediary Cloud Foundry app: an OAuth2 client credentials flow against Microsoft Entra ID, driven either through cl_http_destination_provider and the SAP Destination service at subaccount or Cloud Foundry-space level, or through the SAP_COM_0276 communication scenario and Communication Management. Notes that SAP marks the destination-service route deprecated for ABAP Cloud even though it alone offers management APIs and cross-tenant reuse, and closes on automating the resulting client-secret rotation with Azure Key Vault.published 2023-11-21
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Details
Graph
Audit loggingcapability, core only
Destinationscapability, core and community
RFC connectivitycapability, core and community
SAP Communitypublishing source
SAP Communityintegration-suite-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- Entered the atlasDiscovered via SAP Community · integration-suite-tag.
For your agent
- Ref
content:microsoft-sentinel-for-sap-goes-agentless- JSON
- /content/microsoft-sentinel-for-sap-goes-agentless.json
- MCP
- Connecting an agent