BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
SAP CAP(Cloud Application Programming)开发框架概述
A Chinese-language walkthrough of CAP built mainly from CAPire's own "About CAP" page: CDS entities, associations, compositions and aspects for data modellingData modellingDefining the shape of data before anything serves it: entities and their types, how they relate, and the projections and views that services and applications consume.SAP and community, unassessed, with an extend Books with @restrict: [{ grant:'WRITE', to:'admin' }] aspect as its authorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed example; CQL and CQN queries shown against both a local service and ODataODataExposing data and operations through OData, including the service model, metadata and protocol versions clients require. Version differences affect which clients can consume a service and which query features they can use.SAP and community, narrow by design's $select/$expand; and the service-and-event model — this.on, this.emit, srv.on — that carries CAP's async processingAsync processingDoing work outside the request that triggered it, with a guarantee that it eventually happens — deferred jobs, retries, and periodic work. Distinct from messaging, which is about telling other systems.SAP and community, narrow by design. It closes with the author's own setup: installing @sap/cds-dk, scaffolding a bookshop project with cds init, and running it with cds watch against local SQLite, mocked authentication and file-based messaging standing in for HANA Cloud, IAS and Kafka.
Where it sits
Explains
Data modellingCAPData modellingDefining the shape of data before anything serves it: entities and their types, how they relate, and the projections and views that services and applications consume.AuthorizationCAPAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.Async processingCAPAsync processingDoing work outside the request that triggered it, with a guarantee that it eventually happens — deferred jobs, retries, and periodic work. Distinct from messaging, which is about telling other systems.ODataCAPODataExposing data and operations through OData, including the service model, metadata and protocol versions clients require. Version differences affect which clients can consume a service and which query features they can use.
Since then
Data modelling has changed 3 times since this was published, most recently in @sap/cds 9.9.0, 2026-04-23
Source
reachable
Who is behind it
ArthurYangauthor
Before you read it
ApplicabilityCore changedData modelling has changed 3 times since this was published, most recently in @sap/cds 9.9.0, 2026-04-23.
This is a derived prompt to re-check the work, not a claim that the work is wrong. Exact stale statements are recorded separately after editorial review.
Properties
About this work
For data-modelling
Applies in
For authorization
Applies in
For async-processing
Applies in
For odata
Applies in
Group by66 of 66 pieces
Piece, what it offersStill applies
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
Deep Insert in SAP CAPM Using Composition and Fiori ElementsDeep Insert in SAP CAPM Using Composition and Fiori ElementsParent and children created in one transaction, which composition already gives you in the model — the post is about what Fiori elements does with it, and what the payload looks like when the UI sends both at once.published 2026-05-22
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4The write-up behind ODATANO, by its author: how a public blockchain gets reachable from CAP as an ordinary OData V4 service rather than through a bespoke client. The premise it starts from is worth the read on its own — SAP systems are trusted but mutable, which is what an immutable anchor is for — and Cardano is chosen for peer-reviewed research and formal methods rather than for popularity. Written as an experiment with feedback invited, not as a recommendation.maxalexweber, published 2026-05-15
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Automate BTP Custom Domain certificates using Let's EncryptAutomate BTP Custom Domain certificates using Let's EncryptCertificate lifecycle management as an application: a CAP backend, a Fiori elements UI, the Custom Domain service, Cloud Foundry routes and the Job Scheduler, so requests, renewals and cleanup stop being manual. Part two of the author's BTP Toolbox.Ben, published 2026-03-19
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
UI for the BTP Application Vulnerability ReportUI for the BTP Application Vulnerability ReportAn open-source SAPUI5 front end for SAP's Application Vulnerability Report API, backed by a CAP Node.js service that projects the external findings as an OData V4 entity and forwards each query with api.run(req.query). The CAP service reaches that API through a Destination service instance configured with OAuth2ClientCredentials authentication from a service key, so the address and credentials stay out of the application code.published 2026-02-10
Building an Enterprise Application Using Fiori Elements and CAP - Part 1Building an Enterprise Application Using Fiori Elements and CAP - Part 1Part one of three, and it is all backend: the CAP service the UI will sit on. The author states the constraint the series works under — simple enough for someone new to the stack, without departing from the standard project layout.Farooq, published 2025-12-10
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Quick tip: event/task scheduling in CAP Node.js (in alpha state)Quick tip: event/task scheduling in CAP Node.js (in alpha state)A note on something spotted in capire's May 2025 release notes rather than a technique: CAP Node.js is to support scheduling events — actions and functions included — with callbacks, currently alpha and explicitly subject to change. Useful as a dated marker of the core moving into ground the community has been covering, and the alpha caveat is the point rather than a footnote.published 2025-10-30
Create CDS Views and expose through OData service in CAPMCreate CDS Views and expose through OData service in CAPMViews defined in CDS and then exposed, which is the whole of what a small CAP service is. Written step by step from cds init onward in Business Application Studio.VenkateshMundru, published 2025-08-11
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
The Complete Guide to Calling Actions in UI5 with Custom CodeThe Complete Guide to Calling Actions in UI5 with Custom CodeWritten because the documentation is thin and the samples sparse, and openly as a note to the author's future self — hand-coding an action call has become a rare task for anyone mostly working in Fiori elements, which is exactly why it is hard to look up when it comes round. Comes with a CAP sample project, so the service half is there too.published 2025-07-21
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesSecuring SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management service (XSUAA), restricting CDS service definitions with @restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds Node.js example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Soumya-Pirlamarla, published 2025-07-14
A CAP Plugin for Flexible Number Range Management: cds-numberrange-pluginA CAP Plugin for Flexible Number Range Management: cds-numberrange-pluginThe author's own plugin, and the reason given for writing it is about plugins rather than about number ranges: a year of using them convinced them that this was the way to extend CAP without leaving marks on the application. Sequential document numbers are the thing it does; keeping the host project clean is the thing it argues for.abdulbasit, published 2025-06-17
Understanding Projections in CAPM: Select Only What You Need!Understanding Projections in CAPM: Select Only What You Need!One concept, explained by someone who had just learned it and says so — what a projection is, why it matters, and an analogy. The register is unusual here and suits the subject: projections are the first thing that makes CDS feel different from a table.Avisek_, published 2025-06-10
How to Perform Initial Loads from S/4HANA to Advanced Event Mesh with Odata PollHow to Perform Initial Loads from S/4HANA to Advanced Event Mesh with Odata PollWalks through building a Cloud Integration flow that polls the S/4HANA Business Partner OData API on a timer, splits the response into individual records, and publishes each as an event to Advanced Event Mesh through its adapter, with the topic set dynamically from a grouping property. Selects fields and expands associations with $select/$expand against an EDMX from the API Business Hub, and works around the OData V2 adapter's lack of JSON support by falling back to the HTTP adapter with an XML-to-JSON converter. Flags the trade-off: the pattern needs no backend change beyond activating the API, but the polled payload has to stay aligned with whatever event format the ERP pushes on change.AlexPfeil, published 2025-04-04
CAP-JAVA implementation for Authorization Management Service (AMS)CAP-JAVA implementation for Authorization Management Service (AMS)Short and deliberately narrow: the author defers the concepts to kevin_li's post and writes only the CAP Java part — the development flow, designing the authorization model, and assigning and checking a policy. Read the other one first; this is the half that touches the code.Harvey_Yao, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Calling bound / unbound CAP actions from Fiori elements application.Calling bound / unbound CAP actions from Fiori elements application.invokeAction from the Fiori elements Edit flow API, with the difference between bound and unbound actions spelled out first because the call shape differs. Under three thousand characters and it answers exactly one question.vidhyasagarmule, published 2024-09-07
CAP, CDS, CDL, CSN and jq - finding associationsCAP, CDS, CDL, CSN and jq - finding associationsHow associations are actually represented once CDL is compiled into CSN, worked out by parsing the machine-readable form with jq. Useful less as a recipe than as a way in: anything that wants to reason about a CDS model without the compiler has to read CSN, and this is what that looks like from the outside.published 2024-04-16
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
#BTP #SAPCAP: Quirky Nuggets (N03-N04)#BTP #SAPCAP: Quirky Nuggets (N03-N04)Two unrelated findings in one post, which is the format of the series: the OData operators tried against a CAP service — with a schema of deliberately awkward types to try them on — and undeploying database artifacts, which is the half people hit in anger. Numbered N03 and N04 of a run that continues either side.Ajit_K_Panda, published 2023-06-05
#BTP #SAPCAP: Quirky Nuggets (N03-N04)
Deployment changed in @sap/cds-dk 8.9.0, 2025-03-31. Affects A recipe, Runnable code.
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
SAP CAP function and action with Unstructured/Dynamic Type Input/OutputSAP CAP function and action with Unstructured/Dynamic Type Input/OutputA CAP action or function can take or return an unstructured type: annotate the service @protocol: 'rest', declare the parameter or return value as @open type object {}, and a handler shapes the payload however a given request needs, shown here with a bound action and a function that returns a different structure per input. The text states plainly that OData V4 and GraphQL services require a fixed structure for action and function parameters, so the dynamic type works only over CAP's REST protocol.published 2022-12-08
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Extend SAP SuccessFactors on SAP BTP with CAP - Create the CAP ServiceExtend SAP SuccessFactors on SAP BTP with CAP - Create the CAP ServiceWalks through writing a service definition in SAP Business Application Studio that projects entities from an existing CDS model: one entity gets @odata.draft.enabled because Fiori Elements only shows CRUD actions on a draft-enabled entity, and a read-only projection of an already-imported SuccessFactors OData entity fails with the generic handlers because the call is delegated to the remote service, so a custom handler is needed. Running cds watch then serves the entities, drafts and $metadata at the declared service path.published 2022-03-23
SAP CAP Recent Enhancements the HANA Dev Should Know AboutSAP CAP Recent Enhancements the HANA Dev Should Know AboutThomas Jung walks through CAP features for HANA database developers that landed through late 2021: doc comments in the data model (CDL comments propagated into generated database objects via the package.json cdsc.docs compiler option), and schema evolution reaching general availability in the November 2021 release, using the @cds.persistence.journal annotation and cds.hana.journal settings to generate incremental hdbmigrationtable migration scripts instead of dropping and recreating tables. It also walks through two features outside those two: window functions in view column definitions, added in the December 2021 release, and a beta assert_integrity setting that generates database foreign-key constraints from 1:1 associations and compositions.published 2022-02-15
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
SAP CAP Adapter to expose OData as custom REST ServiceSAP CAP Adapter to expose OData as custom REST ServiceWalks through consuming an external OData V2 service in a CAP project — cds import converts the Northwind service's EDMX into a CSN and cds.connect.to wires up the remote proxy — then re-exposing it as plain REST with the @protocol:'rest' annotation instead of OData's own envelope. Shows two ways to reshape the response, renaming and dropping fields in a CDS projection or rewriting the returned objects in a custom service handler, and remaps ?pageSize and ?offset onto OData's $top and $skip in that same handler.Former Member, published 2021-09-15
Create a Business Service using CDS, Node.js, SQLite and a OData serviceCreate a Business Service using CDS, Node.js, SQLite and a OData serviceThe stack at its smallest — CDS, Node, SQLite, an OData service — worked through at length. Nothing cloud in it, which is the point: it is the shape of a CAP service before any of the platform arrives.raybanton, published 2021-07-12
Create a Business Service using CDS, Node.js, SQLite and a OData service
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Creating structured types, enums and named aspects using the CDS Graphical ModelerCreating structured types, enums and named aspects using the CDS Graphical ModelerThe modelling constructs that are awkward to draw — structured types, enums, named aspects — done in the graphical modeller rather than in CDL.Xiao-fei_Song, published 2021-05-26
Importing @sap/cds common.cds to your CAP project using the CDS Graphical ModelerImporting @sap/cds common.cds to your CAP project using the CDS Graphical ModelerPulling the common aspects and code lists from @sap/cds into a model through the modeller, so the reuse types appear in the diagram rather than only in the file.Xiao-fei_Song, published 2021-05-06
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectThe End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectOne CAP service exposing OData V2, OData V4 and REST at the same time, which is unusual enough to be worth the read on its own. Part of an end-to-end series, deployed on Cloud Foundry against HANA Cloud, so the protocol question sits inside a whole application rather than a snippet.KRiedelsheimer, published 2021-05-06
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single Project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
Custom Functions in OData V4 – SAP Cloud Application Programming ModelCustom Functions in OData V4 – SAP Cloud Application Programming ModelFunctions rather than actions, and the distinction is where it starts: a function must return data and must never change any, so it is the read-only half of custom operations. Then how to declare and implement one on a CAP service.Roopa_N, published 2021-04-28
Custom Functions in OData V4 – SAP Cloud Application Programming Model
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe.
SAP BTP SDK for iOS & CAP with OData V4 supportSAP BTP SDK for iOS & CAP with OData V4 supportThe iOS SDK gaining OData V4, which until then made connecting a native app to a CAP service awkward — CAP defaults to v4 and the SDK did not speak it. Short, and it marks the date that stopped being a problem.KRiedelsheimer, published 2021-04-21
First Java Cap ApplicationFirst Java Cap ApplicationA step-by-step walkthrough of a first CAP Java project: com.sap.cds:cds-services-archetype scaffolds the initial Maven project, and the domain model is then rewritten in the db folder with entities, the cuid and managed aspects, associations, compositions and a CodeList, so a hand-coded event handler serving a single entity gives way to a service that CAP's generic persistence handling serves without custom code. It deploys that model to SQLite for local development — cds deploy --to sqlite, then a Spring profile pointing at the generated database file — and ends by adding an index.cds so the model and service can be published as a reusable npm module.bruce_wang3, published 2020-12-08
Resolving date serialization issues when using an external OData v2 service with CAPResolving date serialization issues when using an external OData v2 service with CAPDates coming out of an external OData v2 service in a shape CAP does not expect, and what to do about it. A narrow bug report with a fix, and the kind of thing that costs an afternoon if nobody has written it down.pieterjanssens, published 2020-07-09
How to add OData v2 adapter proxy to your CAP projectHow to add OData v2 adapter proxy to your CAP projectThe problem is stated in one line — a UI5 application that only speaks OData v2 in front of a CAP service that speaks v4 — and the answer is a proxy in the middle rather than a rewrite of either end. Written while v4 support in the UI5 stack was still patchy, which is the whole reason the adapter exists.published 2020-06-30
How to add OData v2 adapter proxy to your CAP project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects Runnable code.
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Computed field example in CAPComputed field example in CAPAn answer to a Community question — how to count the entities on the far side of an association — written up as a short post rather than left in a thread. The answer combines CDS with Node.js service events, which is the seam worth noticing: some of what looks like modelling is expressed in the model and some has to be computed when the request arrives, and the boundary between them is not obvious from either side.published 2019-08-21
Computed field example in CAP
Data modelling has changed 3 times since this was published, most recently in @sap/cds 9.9.0, 2026-04-23. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKSAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKThe same thing again through SAP Cloud SDK, published as a deliberate comparison with the part before it — the author says outright that it does what the previous post did, differently. Reading both is how you see what the SDK is actually doing for you.CarlosRoggan, published 2019-07-26
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDK
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
SAP Cloud Platform Backend service: Tutorial [11]: CDS : magic: key: generationSAP Cloud Platform Backend service: Tutorial [11]: CDS : magic: key: generationExplains CDS's UUID key type: giving a key property UUID gets its value generated automatically instead of a hand-picked unused number, as data modelling lets an element's type do, at the cost of a 36-character value unfit for a user-facing display. It then works out how that generated value is addressed in a single-entity read URL — bare brackets in OData V4 against the guid'...' literal V2 requires — citing the OData specification for the difference.CarlosRoggan, published 2019-03-15
Develop a full stack Business application with SAP Cloud Application Programming ModelDevelop a full stack Business application with SAP Cloud Application Programming ModelBuilds a full-stack CAP application in SAP Web IDE Full Stack's now-retired 'SAP Cloud Platform Business Application' template: a data-model.cds entity with its own service definition, then Fiori annotations on the generated OData. Building the project compiles that model into Catalog.xml and csn.json, the EDMX and CSN that metadata publishing says every exposed service gets. The entity and service definitions it writes by hand are the basic shape data modelling covers, though the webIDE and MTA tooling staged around them is gone.former_member584731, published 2018-11-29
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Analyze and optimize ABAP Cloud model apps built on core data servicesAnalyze and optimize ABAP Cloud model apps built on core data servicesPerformance anti-patterns in data models built with ABAP CDS under ABAP Cloud applications, and the tools that find them: the abstract names ABAP cross trace, the SQL analyzer (PlanViz) in Visual Studio Code and the SAP HANA database explorer as what the session uses to follow a bottleneck from the application to the database. The anti-patterns are taken from real business applications, which is where the data modelling edge holds; which ones are shown is not in the abstract. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Ingo Braeuninger, Robert Werlich, Steffen Siegmund and Thomas Fiedler, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
AI-assisted full stack development using model context protocol serversAI-assisted full stack development using model context protocol serversMCP servers in Visual Studio Code used to configure, query and change a full-stack application built with CAP, CDS and OData: the agent access to your code concern, a coding assistant reading and changing the project it works in. The abstract names no server, so neither @cap-js/mcp-server nor any other is attached, and it does not say which changes are made. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Sergio Guerrero, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Data modellingcapability, core and community
Authorizationcapability, core and community
Async processingcapability, core and community
ODatacapability, core and community
SAP Communitypublishing source
SAP Communitycap-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- explains → applies_to on capability:data-modelling (cap); capability:authorization (cap); capability:async-processing (cap); capability:odata (cap)Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
- Entered the atlasDiscovered via SAP Community · cap-tag.
For your agent
- Ref
content:sap-cap-cloud-application-programming- JSON
- /content/sap-cap-cloud-application-programming.json
- MCP
- Connecting an agent