BrowseAll ecosystems
Everything in the atlas
302 of 2341
Type
Domain: 2
Origin
Signals: Last 6 months
Content
More
Group by: Capability
EntryBySignalsLast activity
@cap-js/audit-logging@cap-js/audit-loggingIntegration with the SAP Audit Log service, so operations on personal data are recorded in the form an auditor expects without the application writing the entries.sap official, cap
CAP integration with the SAP Audit Log service
com.sap.cds:cds-feature-auditlog-ngcom.sap.cds:cds-feature-auditlog-ngA CAP Java plugin that sends audit log events to the SAP Audit Log service in the format the Audit Log Event Catalog expects.sap official, cap
CAP Java plugin sending audit log events to SAP Audit Log service
s4hana-hana-audit-policiess4hana-hana-audit-policiesSQL templates for the SAP HANA audit policies of the database tenant an SAP S/4HANA system uses, in four sets from the mandatory default policies to scenario examples.sap official, btp
SQL templates for HANA audit policies of an S/4HANA tenant
SAP-samples/btp-secure-developmentSAP-samples/btp-secure-developmentA hands-on OWASP Top 10 workshop that exploits and then fixes security flaws in a CAP Node.js application, covering broken access control, SQL injection and audit logging for sensitive data.sap official, cap
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
TechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
teched2025-XP260teched2025-XP260An SAP TechEd 2025 workshop on embedding security into CAP applications on SAP BTP, worked through three of the OWASP Top 10 risks: broken access control, SQL injection and logging failures.sap official, cap
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authThe client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.independent, btp
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
@marianfoo/sap-mcp-auth@marianfoo/sap-mcp-authA shared browser-login and session module for SAP MCP servers: it drives a Playwright browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.independent, btp
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
@sap/approuter@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp
SAP's Node.js application router in front of business applications
@sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap
CAP Node.js runtime
@sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, cap
Token validation and security context for XSUAA and IAS
@saptools/cf-xsuaa@saptools/cf-xsuaaA command line and Node.js API that reads the XSUAA binding of a Cloud Foundry app and prints an OAuth2 client_credentials token for it, cached until it expires.independent, btp
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
abap-pwnedpasswordsabap-pwnedpasswordsChecks from ABAP whether a password appears in the Have I Been Pwned breached-password list, wrapping the Pwned Passwords API V3 in one call that answers with a boolean.independent, abap
Checks passwords against Have I Been Pwned from ABAP
abapNTLMabapNTLMAn HTTP NTLM client for ABAP, with the RC4, MD4 and DES algorithms the protocol needs implemented in ABAP, which its maintainer says seems to work only some of the time.independent, abap
HTTP NTLM client for ABAP
cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, cap
Azure AD and Azure AD B2C authentication strategy for CAP
Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.
cap-ams-a2acap-ams-a2aFour app-to-app configurations between CAP Java and CAP Node.js under AMS and IAS, each recording which destination setup makes user propagation and token validation hold.independent, cap
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
cap-azure-ad-b2ccap-azure-ad-b2cAuthenticating a CAP service against Azure AD B2C — an identity provider outside the SAP platform.independent, cap
Authenticating a CAP service against Azure AD B2C
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
TechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
@sap/ams@sap/amsDecides what a signed-in user may do in a Node.js application that authenticates through SAP Cloud Identity Services, from policies written in DCL.sap official, cap
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
@sap/ams-dev@sap/ams-devCompiles the DCL authorization policies of SAP's Authorization Management Service to DCN, so an AMS-secured application runs and is tested on a laptop.sap official, cap
Compiler from AMS DCL policies to DCN for local runs and tests
Its own account of itself is local running and tests: the DCN it writes serves as input for running an application using AMS on the DCL bundle locally. It carries the SAP Developer License Agreement rather than an open-source licence, and the repository named in its package metadata is an internal SAP host, so the npm page is the only thing to read.
@sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap
CAP Node.js runtime
bookshop-amsbookshop-amsCAP bookshop wired to the Authorization Management Service.independent, cap
CAP bookshop wired to the Authorization Management Service
Neither the package manifest nor the repository tree declares a licence.
btp-user-management-microservicebtp-user-management-microserviceA CAP microservice, backed by the XSUAA APIs, that manages business applications' users and their authorizations on SAP BTP, with a Fiori Elements UI for testing the role assignments.sap official, cap
CAP microservice on XSUAA managing users and authorizations
cap-ams-a2acap-ams-a2aFour app-to-app configurations between CAP Java and CAP Node.js under AMS and IAS, each recording which destination setup makes user propagation and token validation hold.independent, cap
App-to-app setups between CAP Java and CAP Node.js under AMS and IAS
Neither the package manifest nor the repository tree declares a licence.
SAP-samples/ams-samples-javaSAP-samples/ams-samples-javaSample Java applications, on Javalin, Spring Boot and CAP Java, showing policy-based authorization through the Authorization Management Service on SAP BTP, with DCL policies checked against JWT tokens.sap official, btp
Java apps showing policy-based authorization with AMS on SAP BTP
SAP-samples/ams-samples-nodeSAP-samples/ams-samples-nodeSample Node.js applications, a CAP bookshop and an Express shopping app, showing policy-based authorization through the Authorization Management Service on SAP BTP with policies written in DCL.sap official, btp
Node.js apps showing policy-based authorization with AMS on SAP BTP
SAP-samples/btp-secure-developmentSAP-samples/btp-secure-developmentA hands-on OWASP Top 10 workshop that exploits and then fixes security flaws in a CAP Node.js application, covering broken access control, SQL injection and audit logging for sensitive data.sap official, cap
OWASP Top 10 workshop exploiting and fixing flaws in a CAP Node.js app
SAP-samples/e-mobility-driver-appSAP-samples/e-mobility-driver-appA CAP-based progressive web app that lets electric-vehicle drivers manage charging badges, start and stop charging sessions, and find stations, proxying three SAP E-Mobility OData APIs.sap official, cap
CAP-based PWA for EV drivers proxying SAP E-Mobility OData APIs
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
teched2025-XP260teched2025-XP260An SAP TechEd 2025 workshop on embedding security into CAP applications on SAP BTP, worked through three of the OWASP Top 10 risks: broken access control, SQL injection and logging failures.sap official, cap
TechEd 2025 workshop on OWASP Top 10 risks in CAP applications
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
BTP - Authorization ObjectBTP - Authorization ObjectWalks through building a classic ABAP authorization object for the ABAP environment — an authorization field, the object itself created in ABAP Development Tools rather than the classic SU21 transaction, and its activities (01 create, 02 change, 03 display, and others) — then wires it into a CDS role's access control with the pfcg_auth aspect on the WHERE condition, which is authorization's ABAP form: CDS access control limiting what a view entity returns to the conditions in a CDS role. The check inherits down to a consumption view and even the Data Preview, and the piece notes the WITH PRIVILEGED ACCESS addition developers use in the SQL console to bypass it while testing.Björn S., published 2026-08-07
BTP - Restriction TypeBTP - Restriction TypeWalks through creating a Restriction Type and Restriction Field for an ABAP RAP authorization object, so the values an IAM app would otherwise fix as static entries can instead be maintained per Business Role in the Fiori Launchpad. Read and Write access on the restriction still follow the activities defined on the authorization object itself (03 for read, 01/02/06 for write), and the piece shows the effect end to end: a Fiori app narrowed to only the business partners assigned on the role. This is the ABAP door's authorization mechanism made dynamic — an access decision moved from the IAM app's fixed values onto the role, without touching the underlying CDS access control.Björn S., published 2026-08-11
Building and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleBuilding and Consuming an MCP Server in SAP Integration Suite - Connecting it to Claude and JouleA hands-on walkthrough of building a native MCP server artifact on SAP Integration Suite's Integration Cell runtime: an API artifact built from an OpenAPI 3.0 specification (the author converted the SAP Business Accelerator Hub's Swagger 2.0 OData spec) through API Management policies, with the MCP artifact's own Authorization policy set to the api.invoke scope for Developer Hub credentials or a custom role such as ESBMessaging.send for BTP OAuth credentials. The same server is then wired to Claude as a custom connector over an OAuth redirect, and to a Joule Studio agent through BTP destinations carrying the sap.mcp.tools.enabled property, with three worked agents (CPI monitoring, a SuccessFactors testing flow, IDoc reprocessing) run from both.Padmanathan_Vijayan, published 2026-09-11
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Developing authorizations for business users in SAP Business AI Platform, ABAP environmentDeveloping authorizations for business users in SAP Business AI Platform, ABAP environmentA Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the authorization edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The ABAP CDS edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.published 2026-10-12
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
No-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentNo-Code MCP Servers with SAP Integration Suite: From REST API to AI AgentWalks through turning a deployed API artifact into a no-code MCP server in SAP Integration Suite's MCP Gateway: the API artifact's OpenAPI spec must be version 3.0.0-3.0.3, since Swagger 2.0 is rejected, and its backend is reached through a BTP Destination using OAuth2ClientCredentials so the agent calling the server never sees the backend secret. The API artifact's own Authorization policy sets an OAuth scope and Trust Upstream MCP Authorization, and the gotcha list traces a 403 on a valid token to that policy rather than to authentication, before the finished MCP server is published through Developer Hub and connected to Claude Code.eddiedu, published 2026-09-15
RAP - Feature Control (Part 2)RAP - Feature Control (Part 2)Implements a reusable AUTHORITY-CHECK wrapper class and wires it into a RAP behaviour implementation's Feature Control, both the static global check on Create and the instance-based, partner-scoped checks on Update and Delete, so that an authorization decision greys out an action in the Fiori UI rather than only rejecting it after the save. Part two of the author's Sales App series, it also flags a newer, more strictly typed Feature Control flag SAP introduced since the first article, since using the older type produces a warning and can leave a flag silently without effect.Björn S., published 2026-08-14
Running AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverRunning AI agents against SAP ECC 6.0: lessons from building an in-system MCP serverNicolasHernandez recounts building and running, over two years, an MCP server written in plain ABAP behind a single ICF node, for SAP ECC 6.0 and S/4HANA on-premise customers that the ADT MCP Server and SAP Joule for Developers, ABAP AI capabilities do not reach. Authorization runs as the calling user rather than a technical RFC user, a choice forced by a customer security team after an earlier version used a technical RFC user, and a later security review found a display-authority check applied uniformly across every write endpoint. The failure modes that cost the most time sat in RFC connectivity itself: RFC_READ_TABLE's empty-table exception collapsed into a false success, a where-used filter was applied only after the row limit, and BAPI calls treated an empty string and an absent parameter as different, silently wrong inputs.NicolasHernandez, published 2026-08-28
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
abapPM/ABAP-StrustabapPM/ABAP-StrustA class-based wrapper around ABAP Trust Management (STRUST) for adding, updating, removing and listing certificates from a program, with installer and updater programs for the certificates a domain needs.independent, abap
Class-based wrapper around STRUST certificate management
zstrustzstrustA tool that updates the root certificate authorities in an SAP NetWeaver server from Mozilla's certificate store, checking first that each certificate is valid and not already on the system.independent, abap
Updater for root CAs in SAP NetWeaver from Mozilla's certificate store
Not where the system must not trust whatever the source trusts: the README states that you must trust the source, currently Mozilla, because the system can then reach every website holding a certificate generated by a root CA that source supplies. It installs those root CAs automatically, and the maintainer marks the tool use at own risk.
@cap-js/change-tracking@cap-js/change-trackingOut-of-the-box change history for annotated entities.sap official, cap
Change history for annotated CAP entities
abap-platform-reuse-servicesabap-platform-reuse-servicesA sample sales-order RAP business object that draws its key from a number range, records field changes in a change document, and fills a PDF through SAP Forms Service by Adobe.sap official, abap
RAP sales order using number ranges, change documents and Adobe forms
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
How to Implement SAP Change DocumentHow to Implement SAP Change DocumentBuilds SAP's Change Document framework on two custom tables, ZZCUSTOMER and ZZCUSTOMER_BANK: creating the Change Document Object in transaction SCDO, then wrapping each INSERT, MODIFY and DELETE on the Z-tables together with a call to the generated WRITE method inside one ABAP class, so both commit in the same Logical Unit of Work. Because the generated method cannot read old values back from the database itself, the class reads them before the update and holds them in memory; a Managed RAP application skips this step by specifying the Change Document Object directly in its Behaviour Definition instead. This is the ABAP side of change tracking: a change document object logs who changed a field, and when, into CDHDR and CDPOS.Subhasree1, published 2026-07-09
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
@cap-js/data-privacy@cap-js/data-privacyIntegration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.sap official, cap
CAP integration with SAP Data Privacy Integration
@sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap
CAP Node.js runtime
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
abapPGPabapPGPAn OpenPGP implementation in ABAP, scoped to signing and marked work in progress, whose own README warns that it will most certainly contain severe bugs and points to established PGP software.independent, abap
OpenPGP implementation in ABAP, scoped to signing
Not for anything important, which is the maintainer's own instruction: the README's Warning section calls it stupid to write your own encryption or PGP library, says abapPGP will most certainly contain severe bugs, and points instead at established PGP software such as [OpenPGP](http://openpgp.org/). Signing is the only scope it states.
analytics-cloud-scim-api-samplesanalytics-cloud-scim-api-samplesAround 45 Postman collections that call the SAP Analytics Cloud SCIM API to create, update and transport users and teams.sap official, btp
Postman collections for the SAP Analytics Cloud SCIM API
sap-concur-user-provisioning-service-apissap-concur-user-provisioning-service-apisA Postman collection whose requests demonstrate the SAP Concur User Provisioning Service APIs for creating users in bulk and assigning their approvers.sap official, btp
Postman collection for the SAP Concur User Provisioning Service APIs
SAP-samples/concur-joule-ips-jobsSAP-samples/concur-joule-ips-jobsPre-configured Identity Provisioning jobs that source users from SAP Concur and write the SAP Global ID back, the prerequisite for enabling Joule and Task Center.sap official, btp
Identity Provisioning jobs syncing SAP Concur users for Joule
teched2025-XP261teched2025-XP261An SAP TechEd on Tour hands-on session that integrates Cloud Identity Services with Microsoft Entra to provision users across cloud and on-premises SAP systems.sap official, btp
Hands-on integrating Cloud Identity Services with Microsoft Entra
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
@sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, cap
CAP Node.js runtime
CAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry: Engineering SAP CAP Applications from Business Intent with Guardrailed AICAP Foundry is a prototype that generates a CAP Node.js project with SAP Fiori elements from a written business requirement, discovering the actual data shape from a chosen source — SQLite, a configured SAP HANA HDI container, offline EDMX, live OData through the SAP Destination service, or approved SAP BTP ABAP objects — instead of inventing one. The generated application can carry a Fiori draft lifecycle with optimistic concurrency via ETags and annotation-driven Fiori elements list and object screens, localized independently of the underlying service contract. Attachments can be added with upload, download and delete, gated on a malware-scan status, and the generated project still has to compile, build and pass its generated tests before the run is accepted.Shahid, published 2026-08-20
@cap-js-community/common@cap-js-community/commonSix independent features for CAP services in one package: replication cache, migration check, rate limiting, a Redis client broker, a local HTML5 repository and a CDM builder.community org, cap
Six CAP features in one package, from replication cache to rate limits
It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13
abap-skillsabap-skillsSeventeen agent skills for ABAP development in one repository: RAP, CDS view entities, ABAP SQL and AMDP, unit testing, authorisation, eventing, abapGit, ABAP Cloud and the clean core levels.independent, abap
Seventeen agent skills for ABAP development
ARC-DRAWARC-DRAWAn MCP server that draws BTP solution diagrams onto a live draw.io canvas, with 111 SAP BTP icons as native shapes and SAP's diagram guidelines handed to the client as drawing rules.independent, btp
MCP server drawing BTP solution diagrams on a draw.io canvas
Any run nobody is watching: the drawing tools work only while the draw.io canvas at `http://localhost:3000/` is open and connected, so there is no diagram to produce on a build agent or a server. Nothing checks the result either, because the maintainer keeps a diagram linter on the [roadmap](https://github.com/etosin/arc-draw#-roadmap) rather than in the release. The maintainer marks the status early at v0.x, installs it from source, and records testing with Claude Code alone.
drawio-btp-diagram-skillsdrawio-btp-diagram-skillsTwo Claude Code skills that take a BTP architecture described in words through a Mermaid sketch to draw.io XML, with a structural and a visual review after the drawing.independent, btp
Claude Code skills for BTP architecture diagrams in draw.io
The README tells you to fork before cloning, because Claude rewrites `references/` and `SKILL.md` in place as you use it, so a clone shared between people changes under all of them. Installing means `git` and `ln` on macOS or Linux and a symlink into `~/.claude/skills`. Fine positioning stays manual: the coordinates Claude writes can be rough apart from the centre coordinates of elements joined by a straight arrow and the containment relationships.
drawio-skill-sapdrawio-skill-sapA GitHub Copilot agent skill that writes BTP solution diagrams as uncompressed draw.io XML against the SAP BTP Solution Diagram Design Guideline, with SAP's own shape library bundled.independent, btp
GitHub Copilot skill writing BTP solution diagrams as draw.io XML
SAP BTP Solution Diagram GuidelinesSAP BTP Solution Diagram GuidelinesSAP's visual language for BTP solution diagrams, in line with the SAP Fiori Horizon principles and colour palette, with editable templates for draw.io and PowerPoint.sap official, btp
SAP's visual language and templates for BTP solution diagrams
sap-architecturesap-architectureA Claude Code plugin and portable agent skill that turns a plain-English description into a BTP diagram in SAP Architecture Center style, checked by a validator before it is handed over.independent, btp
Claude Code plugin and skill drawing validated BTP diagrams
A diagram of anything other than an SAP, BTP or on-premise landscape: the skill is tuned to the Horizon style and its 71 templates. It drafts rather than finishes, and its README budgets 15 to 30 minutes of edits in draw.io per diagram. Without Python the validator does not run.
SAP/architecture-centerSAP/architecture-centerThe repository the SAP Architecture Center site is built from: SAP's reference architectures, each drawn as editable draw.io diagrams, with Mermaid for flows.sap official, btp
Source repository of SAP's reference architectures
Creating an ARC-1 BTP Diagram with Codex and a draw.io SkillCreating an ARC-1 BTP Diagram with Codex and a draw.io SkillThe sap-architecture skill from marianfoo/btp-drawio-skill draws architecture diagrams as editable draw.io files in SAP Architecture Center style by copying the closest of 71 bundled SAP reference templates, or a built-in fallback layout, then validating, scoring and rendering the result for the model to inspect; it takes ideas from Wouter Lemaire's btp-solution-diagram-generator and from claude-drawio-btp-diagram. Codex ran it on an L2 diagram of ARC-1 on BTP Cloud Foundry, reached from VS Code over MCP and passing through XSUAA, Destination, Connectivity and Cloud Connector to an on-premise ABAP system, and the first pass validated and scored 100 while labelling the flows HTTPS and OData/REST instead of MCP and ADT REST. The post draws its boundary from that run: the checks read the file's visual structure and cannot tell whether the architecture is right, and a diagram with no close template still needs manual draw.io work.published 2026-07-09
ABAP remote filesystemABAP remote filesystemA Visual Studio Code extension that opens an ABAP system over ADT as an editable filesystem and exposes system tools to GitHub Copilot and external MCP clients.independent, abap
VS Code extension editing ABAP systems over ADT as a filesystem
HR_DMEHR_DMEA read-only SAP GUI report that lists every infotype, payroll cluster and assignment table holding data for one SAP HCM person or organisational object.independent, abap
Read-only SAP GUI report listing where HCM object data is stored
sapguisapguiThirty classic transactions, SE80 and SE16N among them, rebuilt as abap2UI5 apps and installed with abapGit into a standard ABAP system.independent, abap
Thirty classic transactions rebuilt as abap2UI5 apps
Not on ABAP Cloud: the system tables and the classic Workbench APIs the screens use are not released for the ABAP Cloud language version, and there is no 7.02 version below the 7.50 floor either. Not where the full original function is needed, since only the listed transactions exist and about 300 buttons and fields are shown disabled. The authorization checks are rebuilt rather than the originals, which is why the README asks that the screens be tried with a restricted user on a sandbox before the ICF service is opened to more people.
se16nse16nAn abap2UI5 app that browses and filters the content of a table in the browser, on ABAP Cloud systems that have no SE16N as well as on premise.independent, abap
Table content browser in abap2UI5, for ABAP Cloud and on premise
Not as it stands on a system past development: it reads the contents of any table the user names without an authorisation check of its own, so access is bounded only by whatever restrictions exist on the underlying handler or service. The README asks for your own checks first, naming `AUTHORITY-CHECK` on `S_TABU_DIS`/`S_TABU_NAM`, and for a restriction on who may run the app. There is no 7.02 downport either, because the selection-screen dependency has no `702` branch.
Simple Data ExplorerSimple Data ExplorerA multi-window SAP GUI explorer for tables, views and CDS SQL views, with filters that re-read as they change, foreign-key navigation, a join builder and pivot tables.independent, abap
Multi-window SAP GUI explorer for tables, views and CDS SQL views
sql-consolesql-consoleA browser-based SQL console built on abap2UI5, in an Open SQL and a native ADBC variant, that shows a query's result as a filterable table without Eclipse or SAP GUI.independent, abap
Browser-based SQL console built on abap2UI5
It runs whatever SQL a user types without an authorisation check of its own, and the native path additionally uses ADBC, which bypasses ABAP authorisations and client separation; the README asks anyone running it beyond a development system to add authorisation checks and restrict who may start the app. The native console needs Standard ABAP, so on ABAP Cloud only the Open SQL console is available.
VERTEXVERTEXAn extension for ABAP Development Tools for Eclipse and VS Code that shows Simple Data Explorer, AVE and ACE in the editor over the developer's ADT connection.independent, abap
ADT extension for Eclipse and VS Code showing three SAP GUI tools
ztoadztoadAn Open SQL editor for ABAP that runs a query written in the editor pane on the server and shows the rows in an ALV window, with a pane of saved queries to reuse and share.independent, abap
Open SQL editor for ABAP with ALV output
Agentic Loop with Joule for Developers and ADT MCP ServerAgentic Loop with Joule for Developers and ADT MCP ServerA Devtoberfest 2026 session from SAP's ABAP AI team that generates a RAP issue-tracker application by prompting a coding agent. It covers what SAP Joule for Developers, ABAP AI capabilities now ships as MCP tools and which assistants can reach an ABAP system's virtual filesystem, then does the setup twice: turning on the ADT MCP Server and pasting the Joule side-by-side tenant link in ABAP Development Tools for VS Code, and again in ABAP Development Tools for Eclipse, where the custom agent becomes custom instructions. The demo's subject is the guardrails around the loop — an agent.md of phases and human checkpoints, skill files cloned from a GitHub repository for naming, ATC compliance and UI annotations — run through GitHub Copilot until the generated objects are activated, unit-tested and in a transport.SAP Developers, published 2026-09-28
@ui5/cli@ui5/cliThe UI5 Tooling command line for project setup, the local dev server and the build, which defines a UI5 project's shape and its two extension points, custom middleware and custom tasks.sap official, ui5
UI5 Tooling command line for project setup, dev server and build
@ui5/logger@ui5/loggerUI5 CLI's internal logger, described by its own readme as internal — it appears here because other UI5 tooling depends on it.sap official, ui5
Internal logger of the UI5 CLI
@ui5/middleware-code-coverage@ui5/middleware-code-coverageUI5 CLI server middleware that instruments a project's JavaScript files with Istanbul as the dev server sends them, and generates the coverage report from the records the OpenUI5 QUnit tests send back.sap official, ui5
UI5 CLI middleware for Istanbul code coverage
generator-ui5-library-af-deploygenerator-ui5-library-af-deployA Yeoman generator that writes the SAP BTP Application Frontend deployment configuration, mta.yaml, ui5-deploy.yaml, xs-app.json and xs-security.json, into an existing UI5 library project.independent, ui5
Yeoman generator for Application Frontend config in UI5 libraries
It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.
UI5 ToolsUI5 ToolsA VS Code extension for UI5 developers that serves, proxies, builds and deploys UI5 projects from one workspace-wide configuration, with live reload, a Gateway deployer and a BSP importer.independent, ui5
VS Code extension to serve, proxy, build and deploy UI5 projects
ui5-middleware-approuterui5-middleware-approuterA UI5 CLI middleware that puts @sap/approuter in front of the UI5 dev server, proxying it to Cloud Foundry or XS Advanced destinations during development.community org, ui5
UI5 CLI middleware proxying the dev server through @sap/approuter
ui5-middleware-capui5-middleware-capA UI5 CLI middleware that runs a CDS server inside the UI5 dev server, mounted at a path the UI5 project configures, so one command serves the app and its CAP services.community org, ui5
UI5 CLI middleware running a CDS server inside the UI5 dev server
ui5-middleware-hmrui5-middleware-hmrAn experimental UI5 middleware for hot module replacement, swapping a changed module in during development instead of reloading the whole page.community org, ui5
Experimental UI5 middleware for hot module replacement
ui5-middleware-iasyncui5-middleware-iasyncA UI5 dev-server middleware built on browsersync.io that syncs user interactions across connected browsers over a websocket, replaying an action from one browser in the others for manual testing.community org, ui5
UI5 middleware syncing interactions across browsers over websocket
ui5-middleware-indexui5-middleware-indexA UI5 dev-server middleware that delivers a configured welcome page, index.html by default, for the root path instead of the ui5-server directory listing.community org, ui5
UI5 middleware serving a chosen welcome page at the root path
ui5-middleware-livereloadui5-middleware-livereloadA dev-server middleware that adds live reload to the UI5 dev server, reloading the page when the sources in the app's webapp folder change.community org, ui5
Live reload middleware for the UI5 dev server
ui5-middleware-oneloginui5-middleware-oneloginA UI5 dev-server middleware that logs into a system such as SAP Gateway with headless Playwright on the first request and reuses the session cookie for every later request.community org, ui5
UI5 middleware logging in with Playwright and reusing the session
ui5-middleware-serveframeworkui5-middleware-serveframeworkA UI5 middleware that serves a UI5 framework built on the local machine to the dev server, in place of a framework version resolved another way.community org, ui5
UI5 middleware serving a locally built UI5 framework
ui5-middleware-servestaticui5-middleware-servestaticA UI5 dev-server middleware that serves static resources from a filesystem path or an installed npm package path, built on serve-static, with either path settable through an environment variable.community org, ui5
UI5 middleware serving static resources from a path or npm package
ui5-middleware-simpleproxyui5-middleware-simpleproxyA UI5 dev-server middleware that proxies requests from the local dev server to a backend system, so the app can reach the backend's services during development.community org, ui5
Dev-server middleware proxying requests to a backend system
ui5-middleware-ui5ui5-middleware-ui5A UI5 middleware that lets one UI5 application be included as a dependency of another and served through that application's dev server.community org, ui5
UI5 middleware including one UI5 application in another
ui5-middleware-webjarsui5-middleware-webjarsA UI5 dev-server middleware that loads JAR files from a configured path and serves the static resources bundled inside them, following the WebJars convention of META-INF/resources/.community org, ui5
UI5 middleware serving static resources from JAR files (WebJars)
ui5-middleware-websocketui5-middleware-websocketUI5 middleware utilities that add WebSocket support to Express-based dev servers such as the UI5 server, which has no WebSocket channel of its own.community org, ui5
WebSocket support for Express-based dev servers such as UI5's
ui5-task-cachebusterui5-task-cachebusterA UI5 builder task that cachebusts a standalone UI5 application by moving its build output into a timestamped subfolder and pointing index.html's resource roots at it.community org, ui5
UI5 builder task cachebusting standalone UI5 applications
ui5-task-copyrightui5-task-copyrightA UI5 builder task that appends copyright headers to TypeScript, JavaScript and XML files on every build, so the header is not added to each source file by hand.community org, ui5
UI5 builder task appending copyright headers to source files
ui5-task-flatten-libraryui5-task-flatten-libraryA UI5 builder task that flattens a library's build output, removing the project namespace and resources folder for deployment to SAP NetWeaver, now also offered by the UI5 CLI itself.community org, ui5
UI5 builder task flattening library output for SAP NetWeaver
ui5-task-i18ncheckui5-task-i18ncheckA UI5 builder task that cross-checks every XML view against the app's i18n properties files and logs a warning where a translation is missing; views created in JavaScript are not checked.community org, ui5
UI5 builder task checking XML views for missing i18n texts
ui5-task-minify-xmlui5-task-minify-xmlA UI5 builder task that minifies XML resources such as views and fragments, which a plain UI5 build otherwise ships unminified.community org, ui5
UI5 builder task minifying XML views and fragments
ui5-task-pwa-enablerui5-task-pwa-enablerA UI5 builder task that turns a UI5 application into a progressive web app by generating a web manifest and a service worker under one of five caching strategies.community org, ui5
UI5 builder task turning a UI5 app into a progressive web app
ui5-task-zipperui5-task-zipperA build task for the UI5 tooling that packages the UI5 build result, the webapp, as a zip archive at the end of the build.community org, ui5
Build task packaging the UI5 build result as a zip archive
ui5-tooling-lessui5-tooling-lessA UI5 CLI extension, a build task and a dev-server middleware, that compiles an app's Less files into CSS at build time and live while the UI5 server runs.community org, ui5
UI5 CLI extension compiling Less files into CSS
ui5-tooling-modulesui5-tooling-modulesA set of UI5 tooling extensions that load and convert plain npm packages into UI5 AMD-like modules, so the UI5 module loader can consume them.community org, ui5
UI5 tooling extensions loading npm packages as UI5 modules
ui5-tooling-stringreplaceui5-tooling-stringreplaceA UI5 CLI extension for string replacement during the build, for placeholders or tokens in source files that have to be replaced at build time.community org, ui5
UI5 CLI extension for string replacement during the build
ui5-tooling-transpileui5-tooling-transpileA UI5 CLI extension that transpiles modern JavaScript or TypeScript during the UI5 build, with a transformJSX option that handles JSX and TSX in the same step.community org, ui5
UI5 CLI extension transpiling code during the UI5 build
@ui5/sample-app@ui5/sample-appAn OpenUI5 sample app set up with the UI5 CLI: ESLint, UI5 linter and UI5 Test Runner checks, a standard and a self-contained build, and a UI5 workspace for developing against local UI5 libraries.sap official, ui5
OpenUI5 sample app set up with the UI5 CLI
ui5-appui5-appThe UI5 application in ui5-ecosystem-showcase that carries 18 of the repository's UI5 CLI extensions in one ui5.yaml and package.json, with Karma unit tests and WebdriverIO end-to-end tests.community org, ui5
UI5 app carrying 18 UI5 CLI extensions in one configuration
ui5-bookshop-viewerui5-bookshop-viewerA standalone UI5 app in ui5-ecosystem-showcase that shows the cds-bookshop CAP server consumed inside the UI5 server through ui5-middleware-cap.community org, ui5
UI5 app consuming the cds-bookshop server via ui5-middleware-cap
ui5-libui5-libA sample setup for developing a UI5 library in ui5-ecosystem-showcase, covering the whole cycle in one folder: a dev server, a build, linting, a QUnit testsuite and Karma unit tests.community org, ui5
Sample setup for developing a UI5 library
ui5-moduleui5-moduleA custom UI5 control packaged as an npm package, which other showcases in ui5-ecosystem-showcase consume through ui5-tooling-modules.community org, ui5
Custom UI5 control packaged as an npm package
ui5-monorepo-showcaseui5-monorepo-showcaseA pnpm workspace in which a UI5 app, a control library and a launchpad plugin, all TypeScript, are developed together, linked through the workspace protocol without publishing and started with one command.independent, ui5
pnpm workspace developing a UI5 app, library and plugin together
Neither the package manifest nor the repository tree declares a licence.
ui5-tsappui5-tsappA TypeScript UI5 application in ui5-ecosystem-showcase that consumes the repository's custom UI5 CLI extensions together in one app, importing ordinary npm packages such as Chart.js and Luxon.community org, ui5
TypeScript UI5 app consuming custom UI5 CLI extensions together
ui5-tsapp-webcui5-tsapp-webcA TypeScript UI5 application in ui5-ecosystem-showcase that consumes @ui5/webcomponents and its Fiori and AI packages, with the UI5 CLI extensions that consumption needs.community org, ui5
TypeScript UI5 app consuming @ui5/webcomponents
ui5-tsmoduleui5-tsmoduleA TypeScript UI5 module in ui5-ecosystem-showcase, exported in the shape that lets UI5 apps consume it through ui5-tooling-modules.community org, ui5
TypeScript UI5 module consumed through ui5-tooling-modules
UI Composition with Application Frontend ServiceUI Composition with Application Frontend ServiceWhy shared UI code is hard, and what Application Frontend changes about it. The piece first lays out the three usual answers and what each costs — copying files at development time and repatching every consumer, publishing an npm package and rebuilding every consumer, or hosting the code separately and paying for it in CORS and session handling, or in an extra network hop through a server-side proxy. It then shows a fourth that only this service can do: runtime server-side composition without the hop, configured through routes in the consuming application's xs-app.json, across three cases — a reusable application embedded in a consumer, and two further composition shapes. Read alongside the generator, which scaffolds the mta.yaml, xs-app.json and zipper configuration this model needs.Vadim Tomnikov, published 2026-05-18
UI5 Views, Reimagined: Type-Safe TSX for a Modern Dev ExperienceUI5 Views, Reimagined: Type-Safe TSX for a Modern Dev ExperienceA Devtoberfest 2026 session on @ui5-community/jsx-runtime, the incubation project that lets a UI5 view be written as TSX: XML-like markup that the TypeScript compiler checks against the control's own types and a Babel plugin turns into the constructor calls UI5 already makes. The edge to the runtime rests on the session's own description, which gives the project's documentation site as the session's documentation. The TypeScript support edge holds because that is the session's subject — per-property checking, completion on every attribute, renames that carry through a view, and typed event objects that remove the casts — alongside what stays unchanged: string and expression bindings, controllers, routing and i18n, and XML views living beside TSX ones in the same app. The build edge rests on the setup, where ui5-tooling-transpile is given the JSX transform in ui5.yaml; the walkthrough then builds a bookshop app on a CAP OData service and names what is still missing, UI flexibility and native HTML among it.published 2026-10-09
@sap/cds-dk@sap/cds-dkThe command line client and development toolkit for CAP projects, with the commands cds build, cds deploy, cds watch and cds add among them.sap official, cap
Command line client and development toolkit for CAP
cf-setupcf-setupGitHub Action that sets up the Cloud Foundry CLI in a workflow.sap official, cap
GitHub Action setting up the Cloud Foundry CLI
cap-java-childcap-java-childThe consumer side of a promotion model for CAP Java: a parent pom pinned to a fixed version, Renovate opening the bump as a pull request, the application's own tests as the gate, and auto-merge only on green.independent, cap
Consumer side of a CAP Java parent pom promotion model with Renovate
Neither the package manifest nor the repository tree declares a licence.
cap-java-parent-pom-samplecap-java-parent-pom-sampleA Maven parent pom published to GitHub Packages that pins cds-services-bom, the Spring Boot BOM and a shared CAP Java plugin, so a child application names the parent coordinate and no versions of its own.independent, cap
Maven parent pom pinning cds-services-bom and Spring Boot for CAP Java
Neither the package manifest nor the repository tree declares a licence.
ABAP remote filesystemABAP remote filesystemA Visual Studio Code extension that opens an ABAP system over ADT as an editable filesystem and exposes system tools to GitHub Copilot and external MCP clients.independent, abap
VS Code extension editing ABAP systems over ADT as a filesystem
abap2UI5 Playgroundabap2UI5 PlaygroundABAP in the editor on the left and the abap2UI5 app it builds on the right, both inside one browser tab: the framework is transpiled to JavaScript at build time and the class in the editor is compiled when Run is pressed.community org, abap
In-browser ABAP editor beside the abap2UI5 app it builds
A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.