AuthorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed decides what that identity may do; identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only manages its lifecycle across systems.
DomainAll ecosystems
Security & Compliance
Who is calling, what they may do, and what has to be recorded: authentication, authorization, audit, secrets and certificates, and the checks that keep input and dependencies safe.
Capabilities
Compare the concerns mapped here and open an ecosystem for its assessment. Artifact counts show providers; content counts show items linked directly to the capability.
13 of 13 capabilities
CapabilityEcosystems
Audit logging
Recording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler.
Authentication
Establishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application.
Authorization
Deciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.
Certificate management
Keeping the certificates a system trusts and presents over TLS current: importing root and intermediate CAs, requesting and importing its own signed certificate, and replacing one before it expires.
Change tracking
Keeping a readable history of what changed on a record, who changed it and when — as business history rather than database journalling.
Data privacy
Doing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.
Encryption and signing
Encrypting, decrypting and signing data from application code: a document wrapped for one recipient, a payload signed so its origin can be checked, a value enciphered with a key both sides hold.
Identity provisioning
Getting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs.
Malware scanning
Checking a file somebody uploaded before anyone else can download it — where the scan runs, what happens to the file meanwhile, and who is told when it fails.
Rate limiting
Capping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.
Secrets rotation
Rotating credentials a running service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying.
Vulnerability scanning
Finding known vulnerabilities in the open-source components an application depends on, in the project's dependency tree before it is deployed and in the application once it runs, and following each one until it is fixed.
Each ecosystem hexagon shows its own coverage assessment. Coverage is never combined across ecosystems.
Artifacts
Providers, examples and other artifacts mapped to this domain, from SAP and the community. Each artifact appears once.
85 of 85 artifacts
ArtifactSignals
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authThe client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.independent, btp
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
@cap-js-community/common@cap-js-community/commonSix independent features for CAP services in one package: replication cache, migration check, rate limiting, a Redis client broker, a local HTML5 repository and a CDM builder.community org, cap
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
@cap-js/audit-logging@cap-js/audit-loggingIntegration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.sap official, cap
@cap-js/change-tracking@cap-js/change-trackingOut-of-the-box change history for annotated entities.sap official, cap
@cap-js/data-privacy@cap-js/data-privacyIntegration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.sap official, cap
@marianfoo/sap-mcp-auth@marianfoo/sap-mcp-authA shared browser-login and session module for SAP MCP servers: it drives a Playwright browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.independent, btp
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
@sap/ams@sap/amsDecides what a signed-in user may do in a Node.js application that authenticates through SAP Cloud Identity Services, from policies written in DCL.sap official, cap
@sap/ams-dev@sap/ams-devCompiles the DCL authorization policies of SAP's Authorization Management Service to DCN, so an AMS-secured application runs and is tested on a laptop.sap official, cap
Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.
@sap/approuter@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp
@sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap
@saptools/cf-xsuaa@saptools/cf-xsuaaA command line and Node.js API that reads the XSUAA binding of a Cloud Foundry app and prints an OAuth2 client_credentials token for it, cached until it expires.independent, btp
abap_cloud_platformabap_cloud_platformA TypeScript library of the Cloud Foundry calls that walk down to an ABAP service instance, read its SAP_ADT service key and log a user in, so a tool outside the system can reach it.independent, btp
abap_jwt_generatorabap_jwt_generatorGenerates a signed JSON Web Token in ABAP from an explicit header and claim, a stored profile in table ZJWT_PROFILE, or a shared secret, signing through a PSE profile or with the secret.independent, abap
No published releases; repository quiet for 68 months.
abap-aws-sigv4abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.independent, abap
No published releases; repository quiet for 58 months.
abap-data-validatorabap-data-validatorA validation library for ABAP that checks values such as dates, emails, URLs, JSON and GUIDs against type rules through one interface, or a whole internal table against a set of rules.independent, abap
No published releases; repository quiet for 40 months.
abap-platform-reuse-servicesabap-platform-reuse-servicesA sample sales-order RAP business object that draws its key from a number range, records field changes in a change document, and fills a PDF through SAP Forms Service by Adobe.sap official, abap
abap-pwnedpasswordsabap-pwnedpasswordsChecks from ABAP whether a password appears in the Have I Been Pwned breached-password list, wrapping the Pwned Passwords API V3 in one call that answers with a boolean.independent, abap
abap2oauth2abap2oauth2An ABAP API for OAuth 2.0 authentication that registers a provider's client ID and secret as a named consumer and implements signature method 3, the one Google uses.independent, abap
No published releases; repository quiet for 97 months.
abapDomCheckabapDomCheckChecks a structure's field values against ABAP domain fixed values and check tables outside the GUI, such as during a data import, answering with a rejected flag and the messages behind it.independent, abap
No published releases; repository quiet for 54 months.
abapNTLMabapNTLMAn HTTP NTLM client for ABAP, with the RC4, MD4 and DES algorithms the protocol needs implemented in ABAP, which its maintainer says seems to work only some of the time.independent, abap
abapOAuthAzureabapOAuthAzureAn Enhancement Spot OA2C_SPECIFICS implementation for Microsoft Azure, written against ABAP's OAuth 2.0 Client API, with a one-sentence README that leaves configuration to SAP's help page.independent, abap
No published releases; repository quiet for 27 months.
abapPGPabapPGPAn OpenPGP implementation in ABAP, scoped to signing and marked work in progress, whose own README warns that it will most certainly contain severe bugs and points to established PGP software.independent, abap
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
abapPM/ABAP-StrustabapPM/ABAP-StrustA class-based wrapper around ABAP Trust Management (STRUST) for adding, updating, removing and listing certificates from a program, with installer and updater programs for the certificates a domain needs.independent, abap
analytics-cloud-scim-api-samplesanalytics-cloud-scim-api-samplesAround 45 Postman collections that call the SAP Analytics Cloud SCIM API to create, update and transport users and teams.sap official, btp
API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp
Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp
assert-targetassert-targetA minimal sample of which paths fire @assert.target: an OData POST and this.run do, cds.run and db.run do not, and the ASSERT_TARGET message is overridden per locale in messages.properties.independent, cap
Neither the package manifest nor the repository tree declares a licence.
audit-summaryaudit-summaryA command line that summarises npm audit results by root dependency, with severity counts, current against latest versions and thresholds that exit with code 1.independent, general
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
auth-samplesauth-samplesTwo CAP services and a UI over them, set up so role and instance restrictions can be tried out against three mock users instead of a real identity provider.independent, cap
Neither the package manifest nor the repository tree declares a licence.
auth-transport2auth-transport2Three MTA projects that declare a role collection in one xs-security.json out of role templates owned by the other two, so it can be transported rather than recreated in each subaccount.independent, btp
Neither the package manifest nor the repository tree declares a licence.
bookshop-amsbookshop-amsCAP bookshop wired to the Authorization Management Service.independent, cap
Neither the package manifest nor the repository tree declares a licence.
btp-ui5-show-userinfobtp-ui5-show-userinfoA UI5 app that reads the signed-in user two ways, through the Fiori launchpad shell service and through the @sap/approuter User API, and records which environments each answers in.independent, ui5
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.
btp-user-management-microservicebtp-user-management-microserviceA CAP microservice, backed by the XSUAA APIs, that manages business applications' users and their authorizations on SAP BTP, with a Fiori Elements UI for testing the role assignments.sap official, cap
btpvulnerabilityreportbtpvulnerabilityreportA CAP application that displays findings from the BTP Application Vulnerability Report, a working CAP and Fiori app running on HANA.independent, cap
Neither the package manifest nor the repository tree declares a licence.
cap-ams-a2acap-ams-a2aFour app-to-app configurations between CAP Java and CAP Node.js under AMS and IAS, each recording which destination setup makes user propagation and token validation hold.independent, cap
Neither the package manifest nor the repository tree declares a licence.
cap-azure-ad-b2ccap-azure-ad-b2cAuthenticating a CAP service against Azure AD B2C — an identity provider outside the SAP platform.independent, cap
cap-java-auth-checkcap-java-auth-checkCAP Java authorization checked case by case against cds-services-bom 4.8.0 — what a WRITE grant does not cover on a bound action, and where a where-condition carries over.independent, cap
Neither the package manifest nor the repository tree declares a licence.
cap-toolkitcap-toolkitA utility bundle for CAP handlers, with a chainable HandlerBuilder, role checks, validation rules and query helpers, collecting boilerplate that otherwise repeats across projects into one dependency.independent, cap
It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.
capvalcapvalReplaces the message a failed input validation annotation returns, and adds @validation.handler, which names a class that runs a check of the developer's own.independent, cap
cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, cap
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
cds-common-jwt-supportcds-common-jwt-supportJWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.independent, cap
Last released April 2022 at 0.0.2, and no repository is declared on the package.
cds-entra-idcds-entra-idA CAP plugin that maps Microsoft Entra ID groups and app roles onto cds.User roles, so @requires and @restrict keep working for a CAP app hosted on Azure App Services.independent, cap
Quiet Release and repository quiet for 25 months.
Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.
cds-rate-limitcds-rate-limitA CAP plugin that applies a rate-limit pattern inside the CAP Node.js runtime, capping how many requests a caller gets where tenant and user are already resolved rather than at an approuter or gateway.independent, cap
Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.
cds-validatecds-validateA package that runs Zod schemas as CAP validation middleware, so one schema replaces the hand-written checks at the top of a handler and failures come back as OData 422 errors per field.independent, cap
cdsmbt01cdsmbt01This is CDS plugin that enable OData change tracking for CAP applicationsindependent, cap
Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp
Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngA CAP Java plugin that sends audit log events to the SAP Audit Log service in the format the Audit Log Event Catalog expects.sap official, cap
com.sap.cds:cds-feature-auditlog-v2com.sap.cds:cds-feature-auditlog-v2The CAP Java handler that sends the SDK's AuditLog events to the SAP Audit Log service over its API version 2, once a service binding is present.sap official, cap
com.sap.cds:cds-feature-change-trackingcom.sap.cds:cds-feature-change-trackingRecords who changed which annotated field on a CDS entity and when, as a queryable change log for CAP Java, covering every modifying CQN statement but not native SQL or JDBC.sap official, cap
com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identityThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, cap
com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaaThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, cap
com.sap.cds:cds-services-bomcom.sap.cds:cds-services-bomThe Maven bill of materials for CAP Java, pinning every com.sap.cds module in a release, from the API and core runtime to the Spring Boot starters and the CQN engine, to the same version.sap official, cap
decodesapsso2decodesapsso2A TypeScript library that decodes a MYSAPSSO2 logon ticket into its user, client, system and validity fields, and returns the signature without validating it, so it never shows a ticket is genuine.independent, abap
DSTDSTIrreversibly anonymises PII and PHI data in non-production SAP systems, against a scrambling template the user creates.independent, abap
hhelibeb/blowfish-abaphhelibeb/blowfish-abapA Blowfish cipher implemented directly in ABAP after Bruce Schneier's definition, encrypting and decrypting strings in ECB and CBC mode through one class, on ABAP 750 or higher.independent, abap
No published releases; repository quiet for 83 months.
OAuth 2.0 on SAP BTPOAuth 2.0 on SAP BTPOAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.sap official, btp
s4hana-hana-audit-policiess4hana-hana-audit-policiesSQL templates for the SAP HANA audit policies of the database tenant an SAP S/4HANA system uses, in four sets from the mandatory default policies to scenario examples.sap official, btp
SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp
SAP Cloud Identity Services - Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp
SAP Credential StoreSAP Credential StoreA vault for an application's passwords, keys and keyrings, reached over a REST API with a binding — so a secret is fetched at runtime and rotated in one place, never shipped in an environment variable.sap official, btp
SAP Custom Domain ServiceSAP Custom Domain ServiceExposes a BTP application publicly under the customer's own domain instead of the default subdomain, with the TLS/SSL certificate and TLS configuration that domain is served with.sap official, btp
SAP Customer Identity and Access Management for B2CSAP Customer Identity and Access Management for B2CSAP's customer identity service: registration, login and consent for the users of a company's websites and apps, kept in one profile per customer, with regional data storage and risk-based authentication as options.sap official, btp
SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp
SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp
SAP Keystore ServiceSAP Keystore ServiceA repository for cryptographic keys and certificates in SAP BTP's Neo data centres, which an application retrieves at runtime for signing, encryption and SSL communication.sap official, btp
SAP Malware Scanning serviceSAP Malware Scanning serviceScans an uploaded file over a REST call, with ClamAV behind it — the check an attachments plugin runs before a file is served back.sap official, btp
SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp
sap-cap-validator-pluginsap-cap-validator-pluginA CAP plugin that checks incoming data against JSON Schema rules written as @Validator annotations on model elements, evaluated by Ajv, with no handler to register.independent, cap
Quiet Release and repository quiet for 30 months.
Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.
sap-concur-user-provisioning-service-apissap-concur-user-provisioning-service-apisA Postman collection whose requests demonstrate the SAP Concur User Provisioning Service APIs for creating users in bulk and assigning their approvers.sap official, btp
SAP-samples/ams-samples-javaSAP-samples/ams-samples-javaSample Java applications, on Javalin, Spring Boot and CAP Java, showing policy-based authorization through the Authorization Management Service on SAP BTP, with DCL policies checked against JWT tokens.sap official, btp
SAP-samples/ams-samples-nodeSAP-samples/ams-samples-nodeSample Node.js applications, a CAP bookshop and an Express shopping app, showing policy-based authorization through the Authorization Management Service on SAP BTP with policies written in DCL.sap official, btp
SAP-samples/btp-secure-developmentSAP-samples/btp-secure-developmentA hands-on OWASP Top 10 workshop that exploits and then fixes security flaws in a CAP Node.js application, covering broken access control, SQL injection and audit logging for sensitive data.sap official, cap
SAP-samples/concur-joule-ips-jobsSAP-samples/concur-joule-ips-jobsPre-configured Identity Provisioning jobs that source users from SAP Concur and write the SAP Global ID back, the prerequisite for enabling Joule and Task Center.sap official, btp
SAP-samples/e-mobility-driver-appSAP-samples/e-mobility-driver-appA CAP-based progressive web app that lets electric-vehicle drivers manage charging badges, start and stop charging sessions, and find stations, proxying three SAP E-Mobility OData APIs.sap official, cap
sap-security-mcpsap-security-mcpAn entirely read-only security analysis surface: nineteen tools, five resources and eight prompts for audits, SOX and segregation-of-duties review, behind OAuth 2.0 with PKCE. The vendor hosts an endpoint, and the README documents running it yourself.independent, abap
Read-only does not mean low-stakes: a complete picture of who can do what in an SAP system is exactly what an attacker would want, and the ready-made endpoint is the vendor's rather than yours — the README also documents running the server yourself. The authentication is careful; the question of what leaves your landscape is still yours.
sap-usi-authority-checksap-usi-authority-checkA helper class, /USI/CL_AUTH, that checks whether the current user is authorized for the running transaction, mandatory for SchwarzIT's USI reports under their internal development guidelines.independent, abap
Sumu-Ning/AESSumu-Ning/AESAES and Rijndael encryption and decryption utilities for ABAP, covering six cipher modes and three padding schemes, installed by copying the source or through abapGit.independent, abap
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
teched2025-XP260teched2025-XP260An SAP TechEd 2025 workshop on embedding security into CAP applications on SAP BTP, worked through three of the OWASP Top 10 risks: broken access control, SQL injection and logging failures.sap official, cap
teched2025-XP261teched2025-XP261An SAP TechEd on Tour hands-on session that integrates Cloud Identity Services with Microsoft Entra to provision users across cloud and on-premises SAP systems.sap official, btp
zstrustzstrustA tool that updates the root certificate authorities in an SAP NetWeaver server from Mozilla's certificate store, checking first that each certificate is valid and not already on the system.independent, abap
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
Related capabilities
AuthorizationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed decides what that identity may do; identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only manages its lifecycle across systems.
Storing and rotating passwords and keys an application reads is secrets rotationSecrets rotationRotating credentials a running service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles.SAP only.
Not input validationInput validationRejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.SAP and community, unassessed: that checks a value, this checks a transition.
Checking a file somebody uploaded is malware scanningMalware scanningChecking a file somebody uploaded before anyone else can download it — where the scan runs, what happens to the file meanwhile, and who is told when it fails.SAP only, and checking an application's own source for flaws is static analysisStatic analysisCatching problems in code before it runs: naming, obsolete statements, security findings, and compatibility with a target environment. Style linting, security scanning and cloud-readiness checks are often treated as one concern.SAP and community, narrow by design.
Checking a file somebody uploaded is malware scanningMalware scanningChecking a file somebody uploaded before anyone else can download it — where the scan runs, what happens to the file meanwhile, and who is told when it fails.SAP only, and checking an application's own source for flaws is static analysisStatic analysisCatching problems in code before it runs: naming, obsolete statements, security findings, and compatibility with a target environment. Style linting, security scanning and cloud-readiness checks are often treated as one concern.SAP and community, narrow by design.
General
ArtifactSignals
audit-summaryaudit-summaryA command line that summarises npm audit results by root dependency, with severity counts, current against latest versions and thresholds that exit with code 1.independent, general
It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.
Content
Content includes reference architectures. Each item appears once; filter by type to narrow the list.
156 of 156 content items
ContentStill applies
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
#BTP #SAPCAP: Quirky Nuggets (N01-N02)#BTP #SAPCAP: Quirky Nuggets (N01-N02)Walks through two CAP gotchas: the on/before/after phases of custom event handlers, shown with an after handler whose edits only reach the result when the handler returns an object or array, never a primitive; and the @assert.unique annotation, which builds a database uniqueness constraint from the model. For Input validation, the catch is that once the constrained property is nested, @assert.unique must name it by its model dot path (assignment.type) rather than the flattened column data modelling compiles it to (assignment_type).published 2023-06-05
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1First of a three-part series on designing a CAP application on BTP that uses the platform's data privacy services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data Manager, SAP Data Retention Manager, SAP Data Privacy Integration and SAP Audit Log service. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2 and Part 3.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & Target🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning Service, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Yogananda, published 2025-08-30
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
AI needs a foundation: A map of the plug-in ecosystem for CAPAI needs a foundation: A map of the plug-in ecosystem for CAPA map of the plug-ins for CAP (@sap/cds), official, community and independent, drawn across regions such as integration, performance and tooling, so that a team can see what exists to reuse and what it would have to build: the question plugin authoring answers from the other side. SAP's abstract places CAP at the centre of its AI strategy, with model context protocol support, and the map is offered as the foundation under that. A TechEd 2026 session (Tuesday 27 October, Community Theater, Berlin), presented by Mike Zaschka, written here from SAP's abstract; the recording is not yet published.
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Authorization Management Service in SAP Cloud Identity ServiceAuthorization Management Service in SAP Cloud Identity ServiceStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.kevin_li, published 2024-10-17
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
BTP - Authorization ObjectBTP - Authorization ObjectWalks through building a classic ABAP authorization object for the ABAP environment — an authorization field, the object itself created in ABAP Development Tools rather than the classic SU21 transaction, and its activities (01 create, 02 change, 03 display, and others) — then wires it into a CDS role's access control with the pfcg_auth aspect on the WHERE condition, which is authorization's ABAP form: CDS access control limiting what a view entity returns to the conditions in a CDS role. The check inherits down to a consumption view and even the Data Preview, and the piece notes the WITH PRIVILEGED ACCESS addition developers use in the SQL console to bypass it while testing.Björn S., published 2026-08-07
BTP - Restriction TypeBTP - Restriction TypeWalks through creating a Restriction Type and Restriction Field for an ABAP RAP authorization object, so the values an IAM app would otherwise fix as static entries can instead be maintained per Business Role in the Fiori Launchpad. Read and Write access on the restriction still follow the activities defined on the authorization object itself (03 for read, 01/02/06 for write), and the piece shows the effect end to end: a Fiori app narrowed to only the business partners assigned on the role. This is the ABAP door's authorization mechanism made dynamic — an access decision moved from the IAM app's fixed values onto the role, without touching the underlying CDS access control.Björn S., published 2026-08-11
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
BTP CAP : Custom plugin to separate generic change log capture logicBTP CAP : Custom plugin to separate generic change log capture logicWalks through building a custom [CAP](ecosystem:cap) plugin that centralises change-log capture: on cds.once('served') it collects entities annotated @audit, then hooks srv.before('UPDATE') to read the existing record, diff it field by field against the incoming payload, and record old/new values with the user and timestamp. It also documents a cds build failure packaging the plugin's own directory into gen/srv for MTA deployment, fixed by adding it as a copyfiles build-parameter step in mta.yaml.sreehari_vpillai, published 2023-05-10
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleBuilding and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleA hands-on walkthrough of building a native MCP server artifact on SAP Integration Suite's Integration Cell runtime: an API artifact built from an OpenAPI 3.0 specification (the author converted the SAP Business Accelerator Hub's Swagger 2.0 OData spec) through API Management policies, with the MCP artifact's own Authorization policy set to the api.invoke scope for Developer Hub credentials or a custom role such as ESBMessaging.send for BTP OAuth credentials. The same server is then wired to Claude as a custom connector over an OAuth redirect, and to a Joule Studio agent through BTP destinations carrying the sap.mcp.tools.enabled property, with three worked agents (CPI monitoring, a SuccessFactors testing flow, IDoc reprocessing) run from both.Padmanathan_Vijayan, published 2026-09-11
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Building Secure SAPUI5 Applications: Best Practices for DevelopersBuilding Secure SAPUI5 Applications: Best Practices for DevelopersA developer-facing rundown of secure coding habits for SAPUI5 apps: typed bindings and custom formatters to reject bad input before it reaches a handler, encodeHTML() instead of rendering untrusted HTML, keeping tokens and URLs out of local and session storage, and CSRF token handling on the ODataModel. It sets up linting with ESLint and an eslint-config-ui5 rule set to catch unsafe DOM access, eval calls and unused imports as part of CI, alongside the same input validation instinct: reject invalid input early rather than trust the backend to catch it.Manisha_19, published 2025-12-10
Building trusted applications on SAP Business AI Platform by designBuilding trusted applications on SAP Business AI Platform by designBuilding cloud applications on SAP Business AI Platform with security and compliance built in: the identity, connectivity, governance and security services SAP groups under the platform, secure-by-design development, and authorisation and access controls for AI agents. The edges are to Authorization and to Tool governance, the concern of what an agent may call with which authorisations; the abstract names the service categories and no service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christian Cohrs and Regine Schimmer, written here from SAP's abstract; the recording is not yet published.
CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787CAP Developers - Call to Action to mitigate and Apply Solution provided in SAP Note 3747787Four malicious npm package versions published on 29 April 2026 that exfiltrate credentials and propagate into adjacent repositories, and what a CAP developer should check. A security advisory rather than a technique, and dated precisely for that reason.Yogananda, published 2026-05-01
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
CAP Heaven? Not Yet — But You Can See It from HereCAP Heaven? Not Yet — But You Can See It from HereAn assessment from someone with Java, Azure and AWS behind them as well as ABAP and Fiori, which is a rarer vantage point than it sounds. The title is the verdict.published 2026-02-07
CAP is important because it's not importantCAP is important because it's not importantAn essay rather than a technique: what CAP actually is, what it gives you, and the case for treating it as foundational precisely because it is not the interesting part of an application. Written in 2019, when that argument still had to be made, and the title is the argument. Also recorded as a Tech Aloud podcast episode and a CodeTalk, both linked from the post.published 2019-11-06
CAP-JAVA implementation for Authorization Management Service (AMS)CAP-JAVA implementation for Authorization Management Service (AMS)Short and deliberately narrow: the author defers the concepts to kevin_li's post and writes only the CAP Java part — the development flow, designing the authorization model, and assigning and checking a policy. Read the other one first; this is the half that touches the code.Harvey_Yao, published 2024-12-27
CAP, RAP, or Both: Stop Hiding Behind 'It Depends'CAP, RAP, or Both: Stop Hiding Behind 'It Depends'Opens by refusing the answer every other post on this gives — "both are complementary, choose based on context" — and then commits to a framework, including the parts usually left out: the staffing bias behind the decision, and what to do about a landscape with thousands of Z-objects. Argument, not tutorial.published 2026-04-09
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
CAPM Basics - Part 2CAPM Basics - Part 2Walks through deploying a CAP application to SAP BTP, Cloud Foundry Runtime: provisioning a SAP HANA Cloud instance and HDI container, then running cds add hana and cds add xsuaa --for production, cds build --production, and an MTA build and deploy. Tests the deployed service in Postman with an OAuth 2.0 client credentials token from the XSUAA binding (SAP Authorization and Trust Management service), explicitly leaving out any role templates or scopes.archisman92, published 2025-02-28
CAPM Basics - Part 4CAPM Basics - Part 4Part 4 of a CAPM Basics series binds the deployed XSUAA and SAP HANA Cloud service instances with cds bind and runs the project against them from a laptop via cds watch --profile hybrid, the hybrid-testing loop @sap/cds-dk provides. It then restricts the service with @restrict (READ granted to a Viewer role, full access to Admin) and adds OData Capabilities restrictions plus @odata.draft.enabled so a Fiori elements client renders create, update and delete without UI code. It closes by adding a UI module with the SAP Fiori Generator, wiring an approuter via cds add approuter to forward the auth token, and updating the SAP Authorization and Trust Management service instance with the generated redirect URI before redeploying.archisman92, published 2025-05-10
CAPVAL: A project is bornCAPVAL: A project is bornThis second CAPVAL post announces CAPVAL version 2.0, made compatible with CAP v8 after breaking changes there, with the fix shown as a custom cds.middlewares.after error handler. It restates the plugin's @validation.message annotation alongside standard annotations such as @mandatory as the input validation mechanic the project builds on, and the release otherwise adds automated tests and release-automation GitHub Actions rather than new annotations.published 2024-08-26
Configure an MCP Server Created from an HTTP EndpointConfigure an MCP Server Created from an HTTP EndpointDocuments configuring API Management’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Developing authorizations for business users in SAP Business AI Platform, ABAP environmentDeveloping authorizations for business users in SAP Business AI Platform, ABAP environmentA Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the authorization edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The ABAP CDS edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.published 2026-10-12
Developing Business Services with Cloud Application Programming(CAP) Model in SAP Business StudioDeveloping Business Services with Cloud Application Programming(CAP) Model in SAP Business StudioA step-by-step build of a CAP Node.js service in SAP Business Application Studio: a CDS schema for banks, customers, accounts and transactions using compositions, associations, enumerated types and the @assert.unique constraint, followed by authorization layered on with @restrict and @requires annotations and mock users assigned the authenticated-user and Manager roles in .cdsrc.json. Custom event handlers registered through @sap/cds (srv.before/srv.after) and sample HTTP requests round out the example.Ranjith, published 2020-05-27
Don't "let it crash", is this the new CAP guideline?Don't "let it crash", is this the new CAP guideline?Dinu traces a change in error handling in CAP's Node.js runtime: @sap/cds@8.2.0 adds a cds.server.shutdown_on_uncaught_errors config flag, defaulting to true, but invoking an operation with an undefined variable no longer takes the server down, with or without the flag, where the same code crashed it on cds@6 and cds@7, and the author notes the old behaviour was already missing in cds@8.1. It still crashes with features.odata_new_adapter turned off to use the old OData parser, so it is the new OData adapter, like the REST adapter before it, that answers an uncaught error with a 500 instead of taking the process down.Dinu, published 2024-09-06
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Edge Integration Cell - what's new?Edge Integration Cell - what's new?A Devtoberfest 2026 integration-track session (INT-41) on Edge Integration Cell, the runtime of SAP Integration Suite a customer runs on their own Kubernetes cluster while design, configuration and monitoring stay in the cloud tenant. It names what the customer has to provide — a supported Kubernetes platform, SAP HANA or PostgreSQL, Redis or Valkey as data store, a load balancer — then the Edge Lifecycle Management cockpit with its monthly rolling updates, the inbuilt and the external Cloud Connector options and why a DMZ placement calls for the second, and the adapters available only on Edge: RFC sender, NFS, OFTP2 and UNF. The demo deploys an OFTP-to-file flow to the Edge runtime and shows the same flow rejected when its runtime profile is switched to cloud, which is where the Integration flows edge holds.SAP Developers
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
Future-ready access governance from SAP: Strategy and innovationFuture-ready access governance from SAP: Strategy and innovationStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioning, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Getting started with cds.ql in NodeJS for CAP - 101 on how to query dataGetting started with cds.ql in NodeJS for CAP - 101 on how to query dataWalks through cds.ql, the query API @sap/cds gives a Node.js CAP service's custom handlers, with worked SELECT, UPDATE, DELETE and INSERT examples against a sample schema — filters, AND/OR conditions, column projections, ordering, limiting, grouping and joining two entities through a schema view. An added correction notes that cds.tx(req) is no longer needed to run a query in newer CAP versions, contradicting the post's own original guidance.published 2022-06-21
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
Hello React & Vue : SAP CAP’s New UI Layer is Here!Hello React & Vue : SAP CAP’s New UI Layer is Here!CAP gaining a UI layer for React and Vue, which changes the default assumption that the front end is UI5. Short, and the significance is larger than the length.Yogananda, published 2026-06-25
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
How to Check Fiori Apps Related Authorization Object MassHow to Check Fiori Apps Related Authorization Object MassA structured, table-driven method for mass-checking which authorization objects back a set of Fiori apps: map each Fiori App ID to its OData service, look up that service's hash in USOBHASH, then resolve the hash to its authorization objects (S_SERVICE, S_RFC, among others) in USOBTC. The author reports the method's limits in practice — apps built on a transaction code are already findable directly in USOBTC, and the same approach resolved only 5 of 300 Web Dynpro apps, which needed a manual catalog-and-hash workaround instead.MehmetSaidDemir, published 2025-10-07
How to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHow to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHiding Create, Edit and custom action buttons according to what the user may actually do — the join between the authorisation model and the annotations, which is where the two usually fail to agree and the UI offers something the service will refuse.published 2025-05-14
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?Explains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity Services already generates the SCIM ID and Global User ID in uuid format for each record.1Gunnar, published 2023-09-12
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
How to Implement SAP Change DocumentHow to Implement SAP Change DocumentBuilds SAP's Change Document framework on two custom tables, ZZCUSTOMER and ZZCUSTOMER_BANK: creating the Change Document Object in transaction SCDO, then wrapping each INSERT, MODIFY and DELETE on the Z-tables together with a call to the generated WRITE method inside one ABAP class, so both commit in the same Logical Unit of Work. Because the generated method cannot read old values back from the database itself, the class reads them before the update and holds them in memory; a Managed RAP application skips this step by specifying the Change Document Object directly in its Behaviour Definition instead. This is the ABAP side of change tracking: a change document object logs who changed a field, and when, into CDHDR and CDPOS.Subhasree1, published 2026-07-09
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
How to use SAP Data Intelligence with SAP Cloud ConnectorHow to use SAP Data Intelligence with SAP Cloud ConnectorWalks through reaching an on-premise network from SAP Data Intelligence Cloud with Cloud Connector: installing the client, assigning the Cloud_Connector_Administrator role, registering the subaccount, and mapping on-premise systems as ABAP, HANA or HTTP back-ends in Data Intelligence's Connection Manager. For an ABAP back-end it names the function-module whitelist and the gateway port format RFC access needs, per SAP Note 2835207.Former Member, published 2021-03-16
Identity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesIdentity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesSAP Cloud Identity Services is the central identity interface for single sign-on across an SAP landscape: browser-based applications authenticate through SAML 2.0 or OpenID Connect, while applications reached over RFC rather than HTTP use Secure Login Client and Secure Login Service instead, since those web protocols do not apply there. That RFC path issues short-lived X.509 certificates from SCI-authenticated identities, carrying the same multi-factor authentication into on-premise access, with Kerberos tokens or local client certificates as alternatives.OxanaJ, published 2025-07-25
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Introducing the Cloud Application Programming Model (CAP)Introducing the Cloud Application Programming Model (CAP)SAP's own general-availability announcement for CAP, laid out as a Golden Path: a data model and service defined in CDS gets a generated service provider that serves metadata publishing and CRUD requests, fills in primary keys and audit data, and writes trace and audit logs without application code. The same CDS model carries annotations that translate to OData vocabularies and generate a Fiori elements app skeleton, which is how Fiori annotations work in CAP.Daniel7, published 2018-06-05
IPS provisioning to ABAP Cloud Developer TrialIPS provisioning to ABAP Cloud Developer TrialWalks through provisioning users and groups from SAP Cloud Identity Services' Identity Provisioning into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud Connector and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Laurence, published 2025-09-04
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
MCP Gateway in Practice: Architecture, configuration, and hands-onMCP Gateway in Practice: Architecture, configuration, and hands-onA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration Suite: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API Management, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systems edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.SAP Developers
Microsoft Sentinel for SAP goes agentlessMicrosoft Sentinel for SAP goes agentlessExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud Connector setup together with SAP Integration Suite: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's Destinations maintenance view, with a user authorised to call them (RFC connectivity). It also covers calling the audit log API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.published 2024-12-17
Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Proof Key for Code Exchange against Identity Authentication, revisited by the author after an earlier post on the same subject — the flow that lets a mobile or single-page client authenticate without a secret it cannot keep. Sample repository under SAP-samples.martinfrick, published 2023-09-21
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
Open Source UI5 Form ValidatorOpen Source UI5 Form ValidatorWalks through @learnin/ui5-validator, an open-source library the author built because UI5's standard constraints-based validation only fires on value change and cannot do batch validation on save, required-field checks across a whole view, or correlation checks between fields such as a start date against an end date. It coexists with UI5's own required attribute and message model rather than adding custom attributes, and the post shows the manifest.json wiring, a controller calling Validator#validate on save, and a registered cross-field validator comparing a fromDate and toDate DatePicker pair.actor:learnin, published 2025-02-04
Open Sourcing CAP – how to learn more or get involvedOpen Sourcing CAP – how to learn more or get involvedA roundup of CAP's open-sourcing, begun at TechEd the year before, pointing to a webinar recording, a podcast episode and reCAP 2023 talks for background. Among the components it names are a feature toggle library giving Node.js CAP apps live-updatable toggles backed by Redis, a new pluggable database layer with SQLite and PostgreSQL implementations plus a generic SQL layer, and a change tracking component that builds a change history for data from CDS models.Fempel, published 2023-10-02
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
RAP - Feature Control (Part 2)RAP - Feature Control (Part 2)Implements a reusable AUTHORITY-CHECK wrapper class and wires it into a RAP behaviour implementation's Feature Control, both the static global check on Create and the instance-based, partner-scoped checks on Update and Delete, so that an authorization decision greys out an action in the Fiori UI rather than only rejecting it after the save. Part two of the author's Sales App series, it also flags a newer, more strictly typed Feature Control flag SAP introduced since the first article, since using the older type produces a warning and can leave a flag silently without effect.Björn S., published 2026-08-14
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicesRoad map: SAP Business AI Platform security and SAP Cloud Identity ServicesThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity Services and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP CAP(Cloud Application Programming)开发框架概述SAP CAP(Cloud Application Programming)开发框架概述A Chinese-language walkthrough of CAP built mainly from CAPire's own "About CAP" page: CDS entities, associations, compositions and aspects for data modelling, with an extend Books with @restrict: [{ grant:'WRITE', to:'admin' }] aspect as its authorization example; CQL and CQN queries shown against both a local service and OData's $select/$expand; and the service-and-event model — this.on, this.emit, srv.on — that carries CAP's async processing. It closes with the author's own setup: installing @sap/cds-dk, scaffolding a bookshop project with cds init, and running it with cds watch against local SQLite, mocked authentication and file-based messaging standing in for HANA Cloud, IAS and Kafka.ArthurYang, published 2024-01-07
SAP CAPv7 - Node.js Highlights and ExperiencesSAP CAPv7 - Node.js Highlights and ExperiencesAn account of upgrading a 100+ table CAP Node.js project from v6 to v7, working through breaking changes in @sap/cds 7: event handlers now always receive an array, service paths move under /odata/v4/... unless serve_on_root is set, and cds-serve replaces cds run. It goes deepest on the GraphQL plugin, @cap-js/graphql: the /graphql endpoint it serves, Composition results wrapped in a nodes connection, and offset-based pagination reached through OData's top and skip rather than GraphQL's own limit and offset.published 2023-08-03
SAP Cloud Application Programming Model (CAP) - start hereSAP Cloud Application Programming Model (CAP) - start hereThe orientation post for CAP, published in 2018 and revised in 2020 and again in 2021 with help credited to Iwona Hahn — which is the unusual part: a starting-point index that was maintained rather than left to rot, and says so at the top. Read as the shape of what a newcomer was pointed at, and as a marker of how much of that changed inside three years.published 2018-10-10
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Securing SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesSecuring SAP CAP Applications: XSUAA, Roles, and Authorization Best PracticesWalks through securing a CAP service end to end: declaring scopes and role templates in xs-security.json for the SAP Authorization and Trust Management service (XSUAA), restricting CDS service definitions with @restrict per role, and dropping into handler code where a rule needs custom logic, with a @sap/cds Node.js example that tests roles through req.user.is and a Java one that tests scopes through hasScope. It closes in the BTP cockpit, where a role collection is assigned to users so that their JWT carries the scopes those checks read.Soumya-Pirlamarla, published 2025-07-14
Set up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesSet up the SAP Cloud Connector: Integrating On‑Premise Systems with Cloud ServicesA step-by-step walkthrough of installing Cloud Connector, adding a subaccount, managing identity and trust certificates in STRUST, and mapping cloud-to-on-premise paths for an SAP HANA backend. It ends by creating a Destinations entry in SAP BTP with proxy type OnPremise and basic authentication, then testing it from SAP Business Application Studio.Thijn_Grilis, published 2025-06-12
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
Use mocking to embrace auth in your domain model from the outsetUse mocking to embrace auth in your domain model from the outsetMock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.SAP
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Using Postman for API Testing with XSUAAUsing Postman for API Testing with XSUAAA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.mariusobert, published 2020-03-02
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
What's new in SAP Cloud Application Programming Model – January 2026What's new in SAP Cloud Application Programming Model – January 2026December and January together: the new @assert feature, revised documentation, CDS editor work, and Kyma deployment additions.published 2026-02-09
What's new in SAP Cloud Application Programming Model – November 2025What's new in SAP Cloud Application Programming Model – November 2025The November edition, led by the Status Transition Flows feature presented at reCAP 2025.published 2025-12-08
What's new in SAP Cloud Application Programming Model – September 2025What's new in SAP Cloud Application Programming Model – September 2025The monthly release communication for CAP itself, and this edition carries the MCP servers and the Application Frontend Service integration. Kept because a dated list of what shipped when is the only record of that; three editions are indexed here rather than the whole run.published 2025-10-14
What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Multitenant SaaS Application using CAPMultitenant SaaS Application using CAPSAP's reference architecture for a multitenant SaaS application on BTP built with CAP: one deployment serving many tenants with logically separated data, the subscription and onboarding flow, and the BTP services the design leans on. Written for partners and line-of-business teams building on BTP, and it is SAP's own side of the shape multitenancy takes on BTP.published 2025-01-31
SAP Document AISAP Document AISAP's reference architecture for SAP Document AI, first as SAP composes the service on BTP for document extraction: OCR, pretrained models, customer-defined schemas and LLM calls through SAP AI Core and its Prompt Registry in one pipeline, with tenant-isolated persistence in SAP HANA Cloud, PostgreSQL and an object store. Its scenario pages then lay out a solution in three layers: intake through Outlook and SharePoint inbound channels, the workspace UI, the Joule Work mobile app or the upload API; classification and extraction with a confidence score per field, automatic confirmation above a threshold and review of the rest in the workspace; and posting through outbound channels, directly to a REST API, through an SAP Integration Suite flow, or through a CAP service that maps the fields and calls SAP S/4HANA over OData. Enrichment beyond the service's own master data lookup is left to a CAP application or an Integration Suite flow triggered from an outbound channel, and direct API posting leaves error handling, retries and monitoring to the application.published 2026-06-03
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Recent changes
- Audit loggingcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door.
- Authenticationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the sentence counted services, which goes stale as entries arrive. The rest of the paragraph is unchanged.
- Authenticationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the text counted packages, and a package that signs a program in through SAP Identity Authentication, marianfoo-sap-mcp-auth, changes the shape of the answer.
- Authenticationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the note counted packages.
- Authenticationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): marcellourbani-abap-cloud-platform, marcellourbani-decodesapsso2 and sap-cloud-connector arrived after the block was last looked at and the note never named their kinds.
- Authenticationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present.
- Authorizationcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door.
- Certificate managementcore coverage revised
Reassessed against the graph (check:capabilities): the note counted providers.
- Certificate managementcoverage by ecosystem revised
Reassessed against the graph (check:capabilities): the note was an absence claim about providers; the new SAP provider btp-custom-domain is sap-official, so core-only still holds.
- Change trackingcore coverage revised
Reassessed against the graph (check:capabilities): cdsmbt01, an independent cds-plugin on the CAP door, provides this capability.