BrowseAll ecosystems
Everything in the atlas
99 of 2341
Domain: 2
Signals
Content: The reasoning
More
Group by: Capability
EntryBySignalsLast activity
Effective Axios Error Logging for Robust SAP IntegrationsEffective Axios Error Logging for Robust SAP IntegrationsTwo logged failures printed side by side, and the point is made by looking at them: one tells you what went wrong and one does not. Axios buries the useful part of an HTTP error, and this is what to unwrap before logging it from a CAP service.Sahil2508, published 2025-08-31
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
SAP GraphQL in CAPm (node.js)SAP GraphQL in CAPm (node.js)Adding the GraphQL protocol adapter to a CAP project when it was new — an entity, some data, the feature switched on, and a check that it answers. Short, and it is the earliest account here of CAP speaking something other than OData.enric101, published 2021-11-29
CAP, CDS, CDL, CSN and jq - finding associationsCAP, CDS, CDL, CSN and jq - finding associationsHow associations are actually represented once CDL is compiled into CSN, worked out by parsing the machine-readable form with jq. Useful less as a recipe than as a way in: anything that wants to reason about a CDS model without the compiler has to read CSN, and this is what that looks like from the outside.published 2024-04-16
#BTP #SAPCAP: Quirky Nuggets (N03-N04)#BTP #SAPCAP: Quirky Nuggets (N03-N04)Two unrelated findings in one post, which is the format of the series: the OData operators tried against a CAP service — with a schema of deliberately awkward types to try them on — and undeploying database artifacts, which is the half people hit in anger. Numbered N03 and N04 of a run that continues either side.Ajit_K_Panda, published 2023-06-05
#BTP #SAPCAP: Quirky Nuggets (N03-N04)
Deployment changed in @sap/cds-dk 8.9.0, 2025-03-31. Affects A recipe, Runnable code.
Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4Adding Immutable Blockchain Proofs to SAP With CAP - Cardano and OData V4The write-up behind ODATANO, by its author: how a public blockchain gets reachable from CAP as an ordinary OData V4 service rather than through a bespoke client. The premise it starts from is worth the read on its own — SAP systems are trusted but mutable, which is what an immutable anchor is for — and Cardano is chosen for peer-reviewed research and formal methods rather than for popularity. Written as an experiment with feedback invited, not as a recommendation.maxalexweber, published 2026-05-15
AI-assisted full stack development using model context protocol serversAI-assisted full stack development using model context protocol serversMCP servers in Visual Studio Code used to configure, query and change a full-stack application built with CAP, CDS and OData: the agent access to your code concern, a coding assistant reading and changing the project it works in. The abstract names no server, so neither @cap-js/mcp-server nor any other is attached, and it does not say which changes are made. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Sergio Guerrero, written here from SAP's abstract; the recording is not yet published.
Calling bound / unbound CAP actions from Fiori elements application.Calling bound / unbound CAP actions from Fiori elements application.invokeAction from the Fiori elements Edit flow API, with the difference between bound and unbound actions spelled out first because the call shape differs. Under three thousand characters and it answers exactly one question.vidhyasagarmule, published 2024-09-07
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Create a Business Service using CDS, Node.js, SQLite and a OData serviceCreate a Business Service using CDS, Node.js, SQLite and a OData serviceThe stack at its smallest — CDS, Node, SQLite, an OData service — worked through at length. Nothing cloud in it, which is the point: it is the shape of a CAP service before any of the platform arrives.raybanton, published 2021-07-12
Create a Business Service using CDS, Node.js, SQLite and a OData service
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Custom Functions in OData V4 – SAP Cloud Application Programming ModelCustom Functions in OData V4 – SAP Cloud Application Programming ModelFunctions rather than actions, and the distinction is where it starts: a function must return data and must never change any, so it is the read-only half of custom operations. Then how to declare and implement one on a CAP service.Roopa_N, published 2021-04-28
Custom Functions in OData V4 – SAP Cloud Application Programming Model
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe.
Dynamic OData from "any" API through SAP BTP KymaDynamic OData from "any" API through SAP BTP KymaPutting an OData face on a third-party API by way of Kyma, so the SAP side of a landscape can consume something that was never built for it. The word dynamic is doing work in the title — the shape is not modelled in advance.Gunter, published 2021-09-09
Exposing Calculation View with Dynamic Client via OData APIExposing Calculation View with Dynamic Client via OData APIGetting a HANA Cloud calculation view — built in Business Application Studio and deployed to an HDI container, which is the recommended way to build native HANA artifacts — out through an OData API. The gap it fills is the one between HANA-native development and a service a client can call, which CAP does not cover for artifacts it did not generate.published 2023-10-04
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
How to add OData v2 adapter proxy to your CAP projectHow to add OData v2 adapter proxy to your CAP projectThe problem is stated in one line — a UI5 application that only speaks OData v2 in front of a CAP service that speaks v4 — and the answer is a proxy in the middle rather than a rewrite of either end. Written while v4 support in the UI5 stack was still patchy, which is the whole reason the adapter exists.published 2020-06-30
How to add OData v2 adapter proxy to your CAP project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects Runnable code.
Is it time to switch to OData v4?Is it time to switch to OData v4?A recommendation with its caveat attached: use v4 on new projects, and be aware it is less mature than v2 in terms of what the SAP stack around it supports. Written after using it on a real extension project, which is what makes the caveat credible.MikeDoyle, published 2021-02-05
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsMessaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client ApplicationsGetting a message out of a CAP service and onto a Fiori elements object page in a draft scenario — errors, warnings and information, each of which the UI treats differently. Co-written with one of the people on the OData side, and it spends its length on the message container rather than on the handler that fills it.arley-triana-morin, published 2022-08-11
Messaging System for Transferring Error, Warning, and Information Messages from OData V4 Services to HTTP Client Applications
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
OData entity as a governed query surface for agents, not a toolOData entity as a governed query surface for agents, not a toolAn OData entity, generated from the annotations a service already carries, as the surface an agent queries over SAP data: filterable, selectable and sortable fields, authorisation injected on the server side, and a bound query cost, instead of the entity as a tool. SAP's abstract sets this against the MCP gateway in SAP Integration Suite, where exposing an API is the easy part and getting an agent to pick the right one is not, which is the tool governance concern read through OData. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Aleksandr Ivanov and Evgenii Shirokikh, written here from SAP's abstract; the recording is not yet published.
Resolving date serialization issues when using an external OData v2 service with CAPResolving date serialization issues when using an external OData v2 service with CAPDates coming out of an external OData v2 service in a shape CAP does not expect, and what to do about it. A narrow bug report with a fix, and the kind of thing that costs an afternoon if nobody has written it down.pieterjanssens, published 2020-07-09
SAP BTP SDK for iOS & CAP with OData V4 supportSAP BTP SDK for iOS & CAP with OData V4 supportThe iOS SDK gaining OData V4, which until then made connecting a native app to a CAP service awkward — CAP defaults to v4 and the SDK did not speak it. Short, and it marks the date that stopped being a problem.KRiedelsheimer, published 2021-04-21
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKSAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDKThe same thing again through SAP Cloud SDK, published as a deliberate comparison with the part before it — the author says outright that it does what the previous post did, differently. Reading both is how you see what the SDK is actually doing for you.CarlosRoggan, published 2019-07-26
SAP Cloud Application Programming Model: Deep Insert (5) Consume Remote Service with SAP Cloud SDK
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
SAP Fiori elements and the age of AI: Build apps that are future readySAP Fiori elements and the age of AI: Build apps that are future readyBuilding SAP Fiori elements apps so they work with AI and fit SAP's next products: the abstract names AI-assisted development, OData and annotation design, and intent- and action-ready semantics that keep an app secure, discoverable and upgrade safe. Annotation design is the Fiori annotations concern and the OData service under it the other; the atlas holds no entry for SAP Fiori elements itself, and the abstract names no tool, annotation or version. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Katja Zoch and Sebastian Steinhauer, written here from SAP's abstract; the recording is not yet published.
SAP HANA XSA pt. 2 – Smart variants, OData v4 -> v2SAP HANA XSA pt. 2 – Smart variants, OData v4 -> v2Smart tables and smart variants against an OData v4 service, with the v4-to-v2 conversion that the smart controls needed at the time. The second part of an XSA series, written from Tokyo in a summer the author mentions.Gunter, published 2020-08-27
The Complete Guide to Calling Actions in UI5 with Custom CodeThe Complete Guide to Calling Actions in UI5 with Custom CodeWritten because the documentation is thin and the samples sparse, and openly as a note to the author's future self — hand-coding an action call has become a rare task for anyone mostly working in Fiori elements, which is exactly why it is hard to look up when it comes round. Comes with a CAP sample project, so the service half is there too.published 2025-07-21
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectThe End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single ProjectOne CAP service exposing OData V2, OData V4 and REST at the same time, which is unusual enough to be worth the read on its own. Part of an end-to-end series, deployed on Cloud Foundry against HANA Cloud, so the protocol question sits inside a whole application rather than a snippet.KRiedelsheimer, published 2021-05-06
The End2End Journey: Advocates Service – CAP Service, OData V2/4 & REST in One single Project
OData changed in @cap-js-community/odata-v2-adapter 1.10.0, 2023-04-05. Affects A recipe, Runnable code.
Use Aspects, Association and Convert OData V4 to V2 using ProxyUse Aspects, Association and Convert OData V4 to V2 using ProxyTwo halves that turn out to belong together: aspects and associations in the model, and then the v4-to-v2 proxy in front of it. The model decides what the proxy has to carry, which is why the author put them in one post.rahul_rajagopal, published 2023-08-28
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceAdding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js ServiceThe problem stated from the other side of the wire: a CAP and HANA backend consumed by frontend developers with no SAP background, who said in the first meeting that they could not work from what the service offered. A browsable API page is the answer, and this is the post the Swagger UI plugin indexed here exists to serve.published 2020-01-23
Adding a Swagger UI to Your SAP Cloud Application Programming Model / Node.js Service
cds-swagger-ui-express has been through 11 major lines since this was published, most recently 0.9 (2024-07), 0.10 (2024-10), 0.11 (2026-02). Affects Runnable code.
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelInvoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming ModelThe other direction: consuming an API described by an OpenAPI document from CAP, rather than publishing one. Worth pairing with the plugin entries here, which all serve the outbound half.wittro, published 2022-08-30
Invoke OpenAPI-documented APIs remotely with SAP Cloud Application Programming Model
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects Runnable code.
OpenAPIs in the SAP ecosystemOpenAPIs in the SAP ecosystemWhere OpenAPI actually turns up across SAP's own services, from somebody who spends their time in that ecosystem. Orientation rather than implementation.ajmaradiaga, published 2022-10-10
Swagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsSwagger UI | SAP BTP Extension Generators | Hands-on Video TutorialsA blog post wrapped around a video playlist from the SAP HANA Academy — Swagger UI for CDS, added to the BTP extension generator series. The written half is an ingredients list and a table of contents; the substance is in the recordings.dvankempen, published 2021-07-09
Add MCP capabilities to a CAP serviceAdd MCP capabilities to a CAP serviceA fifteen-minute walkthrough of turning a plain CAP service into an MCP server: annotate the service with @mcp, install @cap-js/mcp, and it is served alongside OData at /mcp/<path>. The part worth reading it for is what happens next — cds watch writes the endpoint into the local agent's own configuration file, so OpenCode or Claude Code can call the service without anyone editing JSON by hand. It is built on the tiny-sample facet, so there is nothing to prepare, and it shows the protocol traffic rather than only the result. Written while the adapter was in beta, and it says so.published 2026-08-13
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
CAP Node.js Expert Session #6 - The MCP AdapterCAP Node.js Expert Session #6 - The MCP AdapterDaniel Schlachter and DJ Adams add @cap-js/mcp to a bookshop service, inspect its describe, query and action tools, and query the catalogue through an AI agent. The session distinguishes this runtime adapter from the development-time MCP server and demonstrates automatic registration of the running service with a local agent. The recording describes the adapter as beta in July 2026, with read-only queries and writes through unbound actions.
Examine the details of the Model Context Protocol on startupExamine the details of the Model Context Protocol on startupWhat the MCP adapter actually does when a CAP server boots, watched rather than described — the companion to the tutorial that switches it on.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
MCP Server — SAP Integration SuiteMCP Server — SAP Integration SuiteSAP's own page for the MCP Server artifact in SAP Integration Suite, and where the gateway that runs it is described: MCP clients and API clients reach the same backends through two gateways that share security, traffic management and multi-protocol connectivity. Sets out the three primitives a server may expose — tools derived from API operations with an input and output schema, resources addressed by URI for context rather than action, and prompts as reusable interaction patterns. Says availability depends on the Integration Suite service plan, and points at the three creation paths as separate pages.
MCP Server for SAP Incentive ManagementMCP Server for SAP Incentive ManagementA proof of concept putting SAP Incentive Management behind MCP so an agent can reach it, spanning the server, the backing APIs and SAP Advanced Workflow. The post opens with an unusually explicit disclaimer — personal capacity, no organisation's architecture or policies represented, and any real implementation needing customer and SAP review first — which is itself the useful part of reading it: it is a shape to think with, not a design to deploy.published 2026-07-16
Model Context Protocol (MCP)Model Context Protocol (MCP)Frames the Model Context Protocol as the answer to an M-times-N integration problem: one shared protocol turns M agents and N tools into M plus N connections, and one server can be called by any compliant agent. On SAP BTP its implementation section lists an SAP MCP Hub as a no-code way to expose enterprise tools, SAP Integration Suite's MCP Gateway as what it calls the governed path for exposing SAP and non-SAP APIs as MCP-compliant tools, custom SDK-based servers, SAP's MCP servers for development, and an MCP adapter for CDS as a CAP plugin marked coming soon. That is the ground MCP servers covers; for security it points at a separate page.
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
UI5 Has Entered the Chat: Building Interactive MCP Apps for SAPUI5 Has Entered the Chat: Building Interactive MCP Apps for SAPMCP Apps let an MCP tool point at a ui:// resource that a compatible host renders in a sandboxed iframe, and the post walks through the five samples of UI5con_2026_MCPApps, built with Mike Zaschka for UI5con, from a plain HTML time tool through UI5 Web Components and UI Integration Cards to UI5 lint findings from @ui5/mcp-server and an ARC-1 transport review. In the samples the model selects the tool and does not generate the interface, the prebuilt kind of generative UI, and the subject is the server side of MCP servers: register the resource, link it from the tool's _meta.ui.resourceUri, return text content as a fallback beside structuredContent, call callServerTool() only for tools of the server that owns the app, and send a message to the host when another server such as ARC-1 has to act. It stops at the host, whose support differs by client and whose iframe sandbox is not a complete security model, and Joule support for MCP Apps could not be verified at the time of writing.published 2026-07-13
A Practical Real-Time CTI Widget for SAP Sales Cloud V2A Practical Real-Time CTI Widget for SAP Sales Cloud V2A small CAP backend, a WebSocket channel and a UI5 widget in an iframe — enough to get telephony events into Sales Cloud without any custom backend inside the CRM. The smallness is the design.gizemsoylutr, published 2025-11-28
CAP WebSocketsCAP WebSocketsThe early one, from 2021, before an adapter existed to make it ordinary. Read for what the problem looked like when it had to be solved by hand.vvdries, published 2021-01-26
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Proof Key for Code Exchange against Identity Authentication, revisited by the author after an earlier post on the same subject — the flow that lets a mobile or single-page client authenticate without a secret it cannot keep. Sample repository under SAP-samples.martinfrick, published 2023-09-21
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicesRoad map: SAP Business AI Platform security and SAP Cloud Identity ServicesThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity Services and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use mocking to embrace auth in your domain model from the outsetUse mocking to embrace auth in your domain model from the outsetMock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.SAP
What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
Authorization Management Service in SAP Cloud Identity ServiceAuthorization Management Service in SAP Cloud Identity ServiceStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.kevin_li, published 2024-10-17
Building trusted applications on SAP Business AI Platform by designBuilding trusted applications on SAP Business AI Platform by designBuilding cloud applications on SAP Business AI Platform with security and compliance built in: the identity, connectivity, governance and security services SAP groups under the platform, secure-by-design development, and authorisation and access controls for AI agents. The edges are to Authorization and to Tool governance, the concern of what an agent may call with which authorisations; the abstract names the service categories and no service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Christian Cohrs and Regine Schimmer, written here from SAP's abstract; the recording is not yet published.
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHow to Control the Visibility of CRUD and Custom Actions in Fiori Elements Based on AuthorizationHiding Create, Edit and custom action buttons according to what the user may actually do — the join between the authorisation model and the annotations, which is where the two usually fail to agree and the UI offers something the service will refuse.published 2025-05-14
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Qualtrics integration with domain based authorization in CAP project on HANA cloudQualtrics integration with domain based authorization in CAP project on HANA cloudSurveys pulled from Qualtrics into a CAP application in real time, with the twist in the title: authorisation decided by the user's domain rather than by a role collection. A pattern that comes up whenever the audience is wider than the tenant.former_member69893, published 2022-09-30
Qualtrics integration with domain based authorization in CAP project on HANA cloud
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects Runnable code.
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Using Postman for API Testing with XSUAAUsing Postman for API Testing with XSUAAA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.mariusobert, published 2020-03-02
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Future-ready access governance from SAP: Strategy and innovationFuture-ready access governance from SAP: Strategy and innovationStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioning, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.