BrowseAll ecosystems
Everything in the atlas
9 of 2341
Domain: 2
Signals: Last 6 months
Content: Runnable code
More
Group by: Capability
Domain Security & ComplianceDomain Developer ExperienceLiveness Last 6 monthsOffers Runnable codeClear all
EntryBySignalsLast activity
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Creating an ARC-1 BTP Diagram with Codex and a draw.io SkillCreating an ARC-1 BTP Diagram with Codex and a draw.io SkillThe sap-architecture skill from marianfoo/btp-drawio-skill draws architecture diagrams as editable draw.io files in SAP Architecture Center style by copying the closest of 71 bundled SAP reference templates, or a built-in fallback layout, then validating, scoring and rendering the result for the model to inspect; it takes ideas from Wouter Lemaire's btp-solution-diagram-generator and from claude-drawio-btp-diagram. Codex ran it on an L2 diagram of ARC-1 on BTP Cloud Foundry, reached from VS Code over MCP and passing through XSUAA, Destination, Connectivity and Cloud Connector to an on-premise ABAP system, and the first pass validated and scored 100 while labelling the flows HTTPS and OData/REST instead of MCP and ADT REST. The post draws its boundary from that run: the checks read the file's visual structure and cannot tell whether the architecture is right, and a diagram with no close template still needs manual draw.io work.published 2026-07-09
ABAP Development Automation with ARC-1 and GitHub WorkflowsABAP Development Automation with ARC-1 and GitHub WorkflowsA sample repository puts an ABAP package into GitHub with abapGit and connects GitHub Actions to ARC-1 on BTP through an API key with no write tools, so abaplint on the diff, ABAP Unit and ATC through SAPDiagnose, label-triggered Copilot and Claude reviews, and ST22 dump triage all run as checks on a pull request. The review case is PR #14, where a SAPRead of the activated method let Claude state that a direct SELECT from MARA was new in the PR and not yet active in SAP, which a diff-only review cannot know. The test gate reads activated objects, so a team that pushes before activation needs a sandbox or a pull-and-activate step, and pulling a merged change back into SAP is named as the next step, not built.published 2026-05-12
Before You Upgrade S/4HANA: Static UI5 Checks with MCPBefore You Upgrade S/4HANA: Static UI5 Checks with MCPA UI5 version upgrade checked against one app by pairing two MCP servers: the ui5_version_diff tool added to mcp-sap-docs, which reads a bundle from ui5-lib-diff downloaded once at setup and filters it by version range, change type, library or query text, and @ui5/mcp-server, whose get_project_info, get_version_info, run_ui5_linter and run_manifest_validation say what the app uses and what fails. Run with a ui5-versions-upgrade.md skill on the legacy app from From SEGW and Legacy UI5 to RAP with ARC-1, from SAPUI5 1.84.59 to 1.147.2, the diff range held 985 deprecations and 961 What's New entries, and the linting and manifest validation narrowed that to findings in this app, among them jQuery.sap.require, synchronous bootstrap, the sap_belize theme, sap.m.MessagePage and an old manifest _version. The checks read the source in a local checkout and never the deployed app, so the report is a first pass: a changelog entry is not proof that a workaround can be deleted, and the app still has to be run and tested.published 2026-05-20
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]The first of six, and it does the thing the later parts depend on: build the Incident Management application against SQLite on a laptop, with no cloud database in sight. The series is called decoupled because the front end and the back end are deployed separately, and this part is entirely the back end.sanjucs, published 2026-05-06
Fullstack CAP Application with HANA Cloud (Decoupled Architecture) [Part-1]
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
ABAP Development Automation with ARC-1 and GitHub WorkflowsABAP Development Automation with ARC-1 and GitHub WorkflowsA sample repository puts an ABAP package into GitHub with abapGit and connects GitHub Actions to ARC-1 on BTP through an API key with no write tools, so abaplint on the diff, ABAP Unit and ATC through SAPDiagnose, label-triggered Copilot and Claude reviews, and ST22 dump triage all run as checks on a pull request. The review case is PR #14, where a SAPRead of the activated method let Claude state that a direct SELECT from MARA was new in the PR and not yet active in SAP, which a diff-only review cannot know. The test gate reads activated objects, so a team that pushes before activation needs a sandbox or a pull-and-activate step, and pulling a merged change back into SAP is named as the next step, not built.published 2026-05-12
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22