BrowseAll ecosystems
Everything in the atlas
80 of 2341
Domain: 2
Signals
Content: 2026
More: SAP Community
Group by: Capability
Domain Integration & MessagingDomain Security & ComplianceSource SAP CommunityPublished 2026Clear all
EntryBySignalsLast activity
Automate BTP Custom Domain certificates using Let's EncryptAutomate BTP Custom Domain certificates using Let's EncryptCertificate lifecycle management as an application: a CAP backend, a Fiori elements UI, the Custom Domain service, Cloud Foundry routes and the Job Scheduler, so requests, renewals and cleanup stop being manual. Part two of the author's BTP Toolbox.Ben, published 2026-03-19
Event Mesh + AMQP: The Retry Trap Nobody Warns You AboutEvent Mesh + AMQP: The Retry Trap Nobody Warns You AboutWorks through two patterns for retrying failed messages from Event Mesh's AMQP sender adapter on Cloud Integration, whose native retry has no configurable delay or backoff: bridging into a JMS queue for full exponential-backoff control, or looping messages through a dedicated retry queue with a TTL and a Dead Message Queue. Compares both against a Groovy sleep() workaround that blocks the adapter's connection and the runtime's worker thread, and shows that Advanced Event Mesh's own adapter ships configurable retry interval, backoff and broker-side redelivery without either workaround.MateuszPiotrowski, published 2026-03-09
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
Triggering Background Jobs from RAP Actions – A Practical GuideTriggering Background Jobs from RAP Actions – A Practical GuideWalks through a RAP business object whose Saver Class calls a function module IN BACKGROUND TASK from the save phase, and that function module in turn uses JOB_OPEN, SUBMIT ... VIA JOB and JOB_CLOSE to schedule a classic background job that finishes the long-running work, so the triggering UI transaction stays lightweight. The mechanism shown — an asynchronous function-module call plus a submitted executable report — is Standard ABAP background processing rather than ABAP Cloud's released scheduling APIs.Arshiya2, published 2026-04-15
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Expose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsExpose S/4HANA Cloud OData API as an MCP Server via CAP Node.jsA step-by-step walkthrough that wraps SAP S/4HANA Cloud's Outbound Delivery OData v2 API in a CAP Node.js service and exposes it through @cap-js/mcp, so an MCP client can list the generated tools, query the delivery entities and call a custom createDelivery action over JSON-RPC. The remote S/4HANA connection is configured two ways in package.json: direct Basic Authentication credentials for local hybrid testing, and a named BTP destination for the app once deployed to Cloud Foundry.Jacky_Liu1, published 2026-07-29
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-5]The consequence of decoupling: with the back end live on its own Cloud Foundry route, the front end needs a BTP destination to reach it rather than a relative path. Short, and it is the join the architecture creates.sanjucs, published 2026-05-18
Implementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsImplementing Dynamic Subaccount-Based Routing in SAP CAP with SAP BTP DestinationsWhy environment variables are the wrong place for backend endpoints in a CAP application, and what replaces them: cockpit destinations resolved at runtime, with the subaccount or instance identified as the request is handled. The argument is about redeployment — an endpoint kept in the environment means a deploy every time it moves — and the shape it produces is one codebase serving several landscapes without a build per landscape.Dnyaneshwar Salve, published 2026-03-18
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
UI for the BTP Application Vulnerability ReportUI for the BTP Application Vulnerability ReportAn open-source SAPUI5 front end for SAP's Application Vulnerability Report API, backed by a CAP Node.js service that projects the external findings as an OData V4 entity and forwards each query with api.run(req.query). The CAP service reaches that API through a Destination service instance configured with OAuth2ClientCredentials authentication from a service key, so the address and credentials stay out of the application code.published 2026-02-10
Use REST services in GraphUse REST services in GraphSAP Graph turns a REST service into a business data graph by pairing a data destination with a metadata destination that supplies its OpenAPI document, since plain REST has no $metadata endpoint of the kind OData exposes. It walks through creating both destinations on SAP BTP, including the OAuth2ClientCredentials authentication needed when the OpenAPI file is hosted through an API artifact, and shows how Graph flattens each REST operation's path and method into an unbound OData action or function, such as turning a DELETE on /users/pets into a POST to users_pets__delete.florian_moritz, published 2026-01-20
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
A method to create an Adobe form attachment for a work item using the class concept.A method to create an Adobe form attachment for a work item using the class concept.Walks through an ABAP workflow class, ZCL_WF_PDF, whose methods call an Adobe form through a Form-Builder-generated function module, convert the returned PDF between hexadecimal string and binary with SCMS_XSTRING_TO_BINARY and SCMS_BINARY_TO_XSTRING, and attach it to a work item via SAP_WAPI_ATTACHMENT_ADD and SAP_WAPI_WRITE_CONTAINER, with the class, background-task and SWDD workflow steps shown in full. It explains document output's ABAP route, rendering a PDF through the Form Builder and getting it back into the program, and a route into attachments's ABAP side distinct from Generic Object Services: a file attached to an SAP Business Workflow work item instead.Mithun_Sharma1, published 2026-08-21
Custom Form with Custom Data Source in SAP Public Cloud (Grow with SAP)Custom Form with Custom Data Source in SAP Public Cloud (Grow with SAP)Builds a custom Adobe-based output form for SAP S/4HANA Cloud Public Edition when SAP ships no standard data source: a RAP business object exposes header and item CDS views through a service definition, one view marked as the form's data provider, and the layout is designed offline in Adobe LiveCycle Designer against the exported XML schema before upload and rendering back in the tenant. It draws the line against SAP Forms Service by Adobe on BTP, which the post sets aside in favour of building the form inside the S/4HANA Cloud system itself.Gourab_Dey, published 2026-01-15
On‑the‑Fly Excel Download in a RAP Fiori App — No Database Table, No Persistence, Pure CDS + ABAPOn‑the‑Fly Excel Download in a RAP Fiori App — No Database Table, No Persistence, Pure CDS + ABAPBuilds a CDS custom entity backed by an ABAP class that implements IF_RAP_QUERY_PROVIDER and assembles an XLSX workbook at request time — hand-built from Open XML parts with cl_abap_zip for multiple sheets, or in one line via cl_salv_table=>to_xml for one — then streams it to the browser through the @Semantics.largeObject annotation. The same annotation makes Fiori annotations render the field as a download link with no backing database table, trading the usual persisted-blob approach to document output for a file rebuilt fresh on every click.hemanthmj, published 2026-06-18
Print Preview from RAP Action with v4 OData and Multiple SelectionPrint Preview from RAP Action with v4 OData and Multiple SelectionA RAP action's implementation calls SAP Interactive Forms by Adobe through cl_fp for each of several selected keys, merges the resulting PDFs into one file, and returns it as base64 from the action result. A Fiori elements list report invokes the action for the current selection through a controller extension's editFlow.invokeAction, grouped as a single ChangeSet so every selected document is generated and merged in one round trip before the merged file is offered back to the user.Gxalmet, published 2026-01-10
Clean Core by Design: Event Enablement Cockpit as a Core Integration Enabler in SAP S/4HANAClean Core by Design: Event Enablement Cockpit as a Core Integration Enabler in SAP S/4HANAWalks through wiring an on-premise SAP S/4HANA system into Event Mesh as an event producer, using the Enterprise Event Enablement framework: creating the service instance and its service key, then an RFC destination and OAuth 2.0 client configuration in SPRO so a channel can publish native S/4 business events over AMQP or MQTT. Covers the channel's reconnect and quality-of-service parameters and activating the Event Discovery Service, and notes that SAP ECC needs a third-party add-on for the same events since S/4's native Business Events are not available there.HammadSharif1, published 2026-06-01
Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23
Event Mesh + AMQP: The Retry Trap Nobody Warns You AboutEvent Mesh + AMQP: The Retry Trap Nobody Warns You AboutWorks through two patterns for retrying failed messages from Event Mesh's AMQP sender adapter on Cloud Integration, whose native retry has no configurable delay or backoff: bridging into a JMS queue for full exponential-backoff control, or looping messages through a dedicated retry queue with a TTL and a Dead Message Queue. Compares both against a Groovy sleep() workaround that blocks the adapter's connection and the runtime's worker thread, and shows that Advanced Event Mesh's own adapter ships configurable retry interval, backoff and broker-side redelivery without either workaround.MateuszPiotrowski, published 2026-03-09
Migrating from ASANWEE to ASAAEMEE: From SAP Event Mesh to SAP Advanced Event MeshMigrating from ASANWEE to ASAAEMEE: From SAP Event Mesh to SAP Advanced Event MeshA migration walkthrough for switching an SAP ERP or S/4HANA on-premise system from classic SAP Event Mesh to SAP Advanced Event Mesh: new RFC destinations to the broker's REST, handshake and token endpoints, trusting its certificate, activating the AEM business configuration set, and re-pointing the NetWeaver Add-On for Event Enablement's outbound object and dynamic topic mapping at the new instance. It assumes the Event Add-On for ERP (ASAAEMEE) is already installed and covers only the technical cut-over, not setting up event publishing from scratch.Benedikt_Sprung, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration SuitePublish events from CAP Node.js applications to Event Mesh of Integration SuiteThe smallest complete example: cds init, a service with one function, cds.connect.to('messaging') and an emit to a topic. Deliberately scoped — the Event Mesh setup is skipped and the subaccount is assumed to be the same one — so what remains is the handful of lines on the CAP side and the binding that makes them reach the broker.KevinWang_ST_Consultancy, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration Suite
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Receive Events from Event Mesh of Integration Suite to CAP Node.js ApplicationsReceive Events from Event Mesh of Integration Suite to CAP Node.js ApplicationsWalks a CAP Node.js application through consuming events from SAP Integration Suite, Event Mesh: adding the messaging and xsuaa services with cds add, writing messaging.on handlers for named topics, and building and deploying the service as an MTA to Cloud Foundry. Documents a mismatch between Cloud Foundry's automatic queue provisioning and Event Mesh's management API, worked around by pointing the service key's management URI at a mock endpoint that always returns 201.KevinWang_ST_Consultancy, published 2026-02-13
SAP Codejam on Event Driven Build ProcessSAP Codejam on Event Driven Build ProcessA hands-on CodeJam walkthrough of an event-driven flow: a Business Partner creation event from a simulated S/4HANA Cloud system is published to SAP Advanced Event Mesh, where the author configures topics, queues and subscriptions and forwards it through a REST Delivery Point to SAP Build Process Automation, which runs a business process with a human approval step and an asynchronous callback to a third-party system. The event producer stays unaware of its consumers, with SAP Build acting purely as an orchestrator reacting to events.Sharathmg, published 2026-02-03
Batch File Pickup and Dynamic ZIP Creation in SAP Integration SuiteBatch File Pickup and Dynamic ZIP Creation in SAP Integration SuiteWalks through configuring a Cloud Integration flow that polls an SFTP server for batches of ten files, using a Content Modifier to preserve each file's name and body before appending them into one temporary file. A Router and Poll Enrich step detect when the batch is complete, a General Splitter breaks the combined payload back into individual messages, and a Gather step reassembles them into a dynamically named ZIP archive that keeps the original filenames, before the archive is sent on to a target SFTP server.sahilminhas, published 2026-05-07
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)A step-by-step build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter accepts JSON, a content modifier stores the currencies and amount as exchange properties, and a Request-Reply step calls an external rate API before a Groovy script renders the result as an HTML table. A Global Exception Subprocess centralizes error handling for the whole flow, turning the MPL ID, error type and message into HTML and mailing it as a notification to a support address.RajeshwerRao_G_1, published 2026-04-01
Centralized Error Handling in SAP Cloud IntegrationCentralized Error Handling in SAP Cloud IntegrationBusiness integration flows in Cloud Integration route their runtime errors to a shared Central Error Logger flow through an Exception Subprocess and a ProcessDirect adapter, instead of each flow handling failures on its own. The logger normalises the incoming error data — flow name, message ID, correlation ID, timestamps — and formats it into an HTML email sent through a Mail Receiver Adapter. The author validated the same logger flow, unchanged, against a second, more complex business flow with routers and multiple email notifications.vishaladhikari, published 2026-03-27
Cloud Integration- Activating Enterprise Messaging Capabilities for JMS Queue - CFCloud Integration- Activating Enterprise Messaging Capabilities for JMS Queue - CFTraces a JMS iFlow deployment failure on Cloud Integration (Cloud Foundry) — ERROR_MISSING_SERVICE_KEY — to the Message Queues (Enterprise Messaging) capability being switched off on the tenant rather than a missing service key, since an edition upgrade does not turn it on by itself. Resolves it by enabling Message Queues under Manage Capabilities, which restarts the tenant, then redeploying the affected iFlows.Pavan_Koppula1, published 2026-07-21
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
End to End Currency Conversion Integration using SAP Integration Suite (SAP CPI)End to End Currency Conversion Integration using SAP Integration Suite (SAP CPI)A hands-on build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter takes JSON input, a Request-Reply step calls an external exchange-rate API, and a Groovy script converts the amount and formats it as an HTML table before a Mail Adapter delivers the result. Most of the walkthrough is the Exception Subprocess added after hitting HTTP 500 and 429 errors in testing, which captures the error message, response code and message-processing-log ID and turns them into a readable response instead of a raw stack trace.shahabaz, published 2026-04-09
End-to-End Mail Adapter Setup in SAP CPI Using Gmail (Step-by-Step Guide)End-to-End Mail Adapter Setup in SAP CPI Using Gmail (Step-by-Step Guide)Walks through configuring Cloud Integration's Mail Receiver Adapter against a personal Gmail account: enabling 2-Step Verification and an app password in Gmail, storing it as CPI security material user credentials, and testing the SMTP connection (smtp.gmail.com, port 587, STARTTLS) before wiring the adapter into an integration flow. A content modifier builds the message body, and a Postman call triggers the flow to send mail through the configured Gmail account.srivallivasamsetti, published 2026-03-09
Intelligent Error Handling in SAP CPI Using AI AdapterIntelligent Error Handling in SAP CPI Using AI AdapterAdds an AI Receiver Adapter to an Exception Subprocess in Cloud Integration, so a failed iFlow sends its captured exception text to an LLM over a chat-completions endpoint and gets back an error summary, cause and resolution for the sender. The walkthrough is concrete about the flow's own mechanics — Security Material for the API key, the adapter's address and request body, a Content Modifier to extract and return the response — which is why it explains Integration flows rather than only the AI feature riding on top of them.Jayesh8909, published 2026-05-21
Managing JMS Queues Programmatically with the new SAP Cloud Integration JMS OData APIManaging JMS Queues Programmatically with the new SAP Cloud Integration JMS OData APIThe new JMS OData API on Cloud Integration exposes MessagingQueues and MessagingMessages entities, letting a client list, inspect, retry and move JMS messages without opening the monitoring UI, from Cloud Integration 7.52.x on Cloud Foundry and 8.41 on the Edge Integration Cell runtime. It works through OAuth 2.0 client-credentials authentication against a Process Integration Runtime service instance, a fixed row cap with time-window slicing used in place of offset paging because queues change between requests, and a consistent OData error envelope for the codes the surface returns.MarcoKoch, published 2026-06-01
Message Mapping in SAP Integration Suite - Custom Scripts and Conditional MappingMessage Mapping in SAP Integration Suite - Custom Scripts and Conditional MappingWalks through two ways to extend a message mapping step in SAP Integration Suite's Cloud Integration: a custom Groovy function added in the Mapping Expression editor's Scripts section, and a graphical equals/if node pair built from the standard function library, each suited to logic the other cannot express cleanly. Shows the Simulate tool's Generate button building a test payload from the source structure, then editing individual field values to exercise both the true and false branch of a condition before deployment.jirifridrich, published 2026-04-03
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP - CI - Building Open-Source Custom Adapter EventSmartKafka from Zero with SAP ADK - Part IISAP BTP - CI - Building Open-Source Custom Adapter EventSmartKafka from Zero with SAP ADK - Part IIPart II of a series on EventSmartKafka, an open-source Kafka adapter for Cloud Integration in SAP Integration Suite built with the SAP Adapter Development Kit, walks through the runtime behind a custom adapter: how metadata.xml's fields map onto Java Endpoint properties, how the Component class creates the Endpoint, and how the Consumer's doStart() and doPoll() poll Apache Kafka, convert Avro payloads and dispatch the record into the iFlow pipeline. Its central point is that the Kafka offset must be committed only after the pipeline has processed the message successfully, with a worked table of which failure scenarios (missing Confluent magic byte, invalid schema ID, payload over the configured limit) withhold the commit versus let it through, to avoid poison-pill loops and silent message loss. The adapter is published as a community demo and not SAP-certified or production-validated; Part III covers building the SAP ADK project itself.rhviana, published 2026-06-03
SAP BTP - CI - EventSmartKafka - Custom Kafka Adapter - Part V FINALSAP BTP - CI - EventSmartKafka - Custom Kafka Adapter - Part V FINALEventSmartKafka is an open-source Kafka Consumer/Sender adapter for SAP Cloud Integration in SAP Integration Suite, built with the SAP Adapter Development Kit; it reaches Apache Kafka over SASL, SASL_SSL and mutual TLS, with on-premise brokers reached through Cloud Connector. This final release adds Avro-to-JSON/XML conversion, schema registry integration, message recovery by timestamp and Kafka producer support. The author reports the consumer validated past 6.5 million processed messages with zero failures and the producer run continuously for more than 20 hours, with deployment lifecycle testing — deleting, upgrading and redeploying the adapter — showing no runtime interruption.rhviana, published 2026-07-28
SAP BTP - CI - EventSmartKafka - Custom Kafka Adapter From .ESA v1.1.0 - Validated Runtime - Part IVSAP BTP - CI - EventSmartKafka - Custom Kafka Adapter From .ESA v1.1.0 - Validated Runtime - Part IVPart IV of a series on EventSmartKafka, an open-source Kafka Consumer adapter for SAP Cloud Integration in SAP Integration Suite, built with the SAP Adapter Development Kit. The v1.1.0 release adds mutual TLS client-certificate authentication against the broker, fixes an OSGi classloader bug where a redeployed bundle's static registry lost track of a still-open relay socket from the previous classloader (fixed with a JVM-wide System-property registry instead), replaces infinite retry loops on fatal configuration errors with a fail-fast stop, corrects two offset-handling bugs in timestamp-based message recovery, adds a parallel-consumer option, and drops a planned OAuth2 strategy because no tier of the tested broker services (Confluent Cloud, Redpanda Cloud, Aiven) exposed it for testing on a free plan. The author reports the release validated across 3,000,000 messages over four simultaneous listeners (PLAINTEXT, SASL, SASL_SSL, mTLS) on an SAP BTP Trial tenant with zero failures, closing the adapter's Consumer side before a planned Producer adapter.rhviana, published 2026-06-29
SAP BTP - CI - How I Built an Open-Source Enterprise Custom Kafka Adapter from Scratch - Part ISAP BTP - CI - How I Built an Open-Source Enterprise Custom Kafka Adapter from Scratch - Part IPart I of a series on EventSmartKafka, an open-source Apache Kafka adapter the author built with the SAP Adapter Development Kit to extend SAP Cloud Integration in SAP Integration Suite past the standard adapter's offset management, security options and Avro handling. It covers the architecture: granular offset control via seek(), a security UI that switches between SASL, mutual TLS and OAuth profiles, native Avro-to-JSON/XML conversion against a Schema Registry, configurable resilience policies, and on-premise reach through Cloud Connector. The adapter already runs against a live Confluent Cloud Kafka topic in a real tenant; the source code follows from Part II onward.rhviana, published 2026-05-29
SAP BTP - CI - Immutable Event Routing per Domain with Metadata-Driven Consumer OrchestrationSAP BTP - CI - Immutable Event Routing per Domain with Metadata-Driven Consumer OrchestrationDescribes a metadata-driven "Smart Router" pattern for Cloud Integration in SAP Integration Suite: one Kafka Sender Adapter per domain reads a wildcard topic, and a single immutable router iFlow resolves single, multiple or both consumers at runtime from Value Mapping entries and a Groovy script, instead of one adapter and iFlow per consumer added. It compares three candidate architectures — a two-layer router/dispatcher split, the recommended single-layer router, and a rejected global cross-domain router — and covers AVRO payload handling through Base64 and an externalized schema parameter, and consolidating the routing logic into one cached Groovy class to limit JVM class-loading overhead. The piece continues the author's earlier immutable Kafka topic routing post and names SAP Event Mesh as one of several broker-agnostic alternatives to the Kafka adapter used here.rhviana, published 2026-05-25
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
SAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsSAP Datasphere Integration Patterns: Lessons Learned from Two Years of ImplementationsTwo years of production SAP Datasphere integrations across SAP and non-SAP sources, settling on Replication Flows over remote access for high-volume Finance analytics because remote queries added latency at query time, then tuning the copy with Datasphere-side partitioning, source-side CDS view optimisation and Cloud Connector sizing. For file-based and Kafka sources, SAP Integration Suite iFlows did work a direct connection could not — flattening nested JSON, PGP decryption and orchestrating the SAP Ariba extraction built on SAP's own BTP Procurement Data Extractor content.saikrishna_kalivarapu2, published 2026-08-17
SAP Integration Suite: Intelligent Integration with AI AdapterSAP Integration Suite: Intelligent Integration with AI AdapterThe AI Adapter adds generative AI as a receiver step inside a Cloud Integration flow, connecting through either AICore-GenAIHub — a single API onto SAP AI Core's Generative AI Hub and its foundation models — or Custom-OpenAI-Rest, a plain REST call out to a provider such as OpenAI. SAP Integration Suite starts the call from the iFlow and feeds the model's response into the next step, which is the mechanics behind the sentiment-analysis, summarisation and routing use cases the piece lists without walking through any one of them.meena_choudhary, published 2026-01-28
Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)Building a Real‑Time Currency Conversion iFlow using SAP Cloud Integration (CPI)A step-by-step build of a currency-conversion integration flow in Cloud Integration: an HTTPS sender adapter accepts JSON, a content modifier stores the currencies and amount as exchange properties, and a Request-Reply step calls an external rate API before a Groovy script renders the result as an HTML table. A Global Exception Subprocess centralizes error handling for the whole flow, turning the MPL ID, error type and message into HTML and mailing it as a notification to a support address.RajeshwerRao_G_1, published 2026-04-01
Connecting SAP Integration Suite with Slack: A Hands‑On Guide with Open ConnectorsConnecting SAP Integration Suite with Slack: A Hands‑On Guide with Open ConnectorsA walkthrough builds an integration flow on SAP Integration Suite that receives JSON over an HTTPS sender, transforms it with Groovy, and posts a formatted message to a Slack channel through the Slack Open Connector. An Exception Subprocess catches token, channel and connector-invocation failures and returns a structured error response, and the author verifies it by forcing a bad channel ID and confirming the error-notification email arrives.jareenabee_dudekula, published 2026-03-20
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Claude ported ABAP functions to new APIClaude ported ABAP functions to new APIA first-person account of using Claude Code, driven through the sapcli command line, to install and repair RFC function modules that let a CI pipeline control abapGit and gCTS remotely, rather than treating git as a way to read ABAP source. Instead of trusting a local checkout, Claude read the abapGit login manager class and queried the target system's own type catalogue through sapcli, then used what it found to update a renamed API method and swap a TABLES parameter's structure for the table type BAPIRET2_T.jakub_filak, published 2026-03-16
Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Connecting SAP S/4HANA On-Prem Directly to Advanced Event Mesh using Cloud Connector - finally!Package Integration 1.4.0 for the Advanced Event Mesh Adapter adds official support for routing through SAP Cloud Connector, so an on-premise SAP S/4HANA system can produce events that SAP Advanced Event Mesh distributes without exposing a public endpoint. The same release changes the adapter's default acknowledgment mode from Automatic Immediate to Automatic On Exchange Complete, altering delivery semantics and error handling. The release notes warn against mixing proxy configurations within one tenant, since that causes unpredictable routing in complex hybrid tenants.sissyhae, published 2026-01-23
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
SAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenSAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenReading SAP's API Policy v.4.2026a and its FAQ against the reference architectures, the piece narrows the widely repeated claim that SAP bans AI to what Section 2.2.2 actually restricts: an agent planning and chaining API calls outside an SAP-endorsed route, closed off further by Section 3's block on bypassing API Controls through custom code. It compares the endorsed and allowed paths — the MCP Gateway on SAP Integration Suite reaching S/4HANA and ECC through RFC-based back ends under a 15-tool, 200,000-token limit, SAP-provided MCP servers through Joule Studio, the A2A protocol, customer-operated MCP servers allowed under FAQ Question 56, and the ADT MCP Server, whose 18 tools work only on development artifacts and are documented as not intended for productive use. It leaves open whether Section 2.2.2 covers ABAP code that calls a model from inside the system, since enforcement is defined at the API-traffic level rather than by a list of tools.published 2026-08-31
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
Implementing B2B Advisory in SAP Integration Suite for Custom XML EDIFACT Scenario Part - 3Implementing B2B Advisory in SAP Integration Suite for Custom XML EDIFACT Scenario Part - 3Builds the inbound side of a custom EDIFACT-to-IDoc scenario on Trading Partner Management: an iFlow picks a file from SFTP and sets headers for adapter type, document standard, namespace, version and sender and receiver IDs, and a second iFlow assembles them into the agreement's plain partner ID and matches it in the Partner Directory. A Groovy script then calls PartnerDirectoryService.getParameter to read a partner's custom activity parameters and general value-mapping data stored under the agreement, so dynamic field mapping comes from the agreement rather than a flow per partner. Third of a series on setting up trading partner agreements in SAP Integration Suite, after the TPM foundation and the agreement itself in parts 1 and 2.amysh95, published 2026-03-10
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleBuilding and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleA hands-on walkthrough of building a native MCP server artifact on SAP Integration Suite's Integration Cell runtime: an API artifact built from an OpenAPI 3.0 specification (the author converted the SAP Business Accelerator Hub's Swagger 2.0 OData spec) through API Management policies, with the MCP artifact's own Authorization policy set to the api.invoke scope for Developer Hub credentials or a custom role such as ESBMessaging.send for BTP OAuth credentials. The same server is then wired to Claude as a custom connector over an OAuth redirect, and to a Joule Studio agent through BTP destinations carrying the sap.mcp.tools.enabled property, with three worked agents (CPI monitoring, a SuccessFactors testing flow, IDoc reprocessing) run from both.Padmanathan_Vijayan, published 2026-09-11
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
How to Implement SAP Change DocumentHow to Implement SAP Change DocumentBuilds SAP's Change Document framework on two custom tables, ZZCUSTOMER and ZZCUSTOMER_BANK: creating the Change Document Object in transaction SCDO, then wrapping each INSERT, MODIFY and DELETE on the Z-tables together with a call to the generated WRITE method inside one ABAP class, so both commit in the same Logical Unit of Work. Because the generated method cannot read old values back from the database itself, the class reads them before the update and holds them in memory; a Managed RAP application skips this step by specifying the Change Document Object directly in its Behaviour Definition instead. This is the ABAP side of change tracking: a change document object logs who changed a field, and when, into CDHDR and CDPOS.Subhasree1, published 2026-07-09
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13