BrowseAll ecosystems
Everything in the atlas
57 of 2341
Domain: 2
Signals
Content: 2
More
Group by: Capability
Domain Security & ComplianceDomain Integration & MessagingOffers A recipeOffers A referenceClear all
EntryBySignalsLast activity
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsReal-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSocketsThe other half of the author's own industrial-data post: mass ingestion is only useful if the screen keeps up, so background jobs push progress to the UI over WebSockets instead of the user reloading. Written from a mission-critical case rather than a demo.rgadirov, published 2026-03-12
Real-Time Architecture in SAP CAP: Mastering Asynchronous Jobs, Gateways with WebSockets
Async processing changed in @sap/cds 10.0, 2026-07-02. Affects A recipe.
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorConnect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud ConnectorAn end-to-end route from a CAP Node.js application on Cloud Foundry to a PostgreSQL database that is never made publicly reachable, over BTP Connectivity and the Cloud Connector using a TCP destination and SOCKS5. The part worth having is that it covers the deployer as well as the server: the generated PostgreSQL deployer has to reach the same private database to deploy the CDS model, and a guide that only connects the runtime leaves you with a schema you cannot install.Kalaikovan, published 2026-08-07
Connect SAP CAP (Node.js) to On-Premise/Private PostgreSQL using SAP Cloud Connector
Database connectors changed in @sap/cds 10.1.0, 2026-09-07. Affects A recipe.
Consume Remote Services in a Full-Stack CAP ApplicationConsume Remote Services in a Full-Stack CAP ApplicationExtending the Developer's Guide application with a remote S/4HANA service — connectivity, importing the Business Partner API, and running against it. SAP publishes this as four separate paths: mock server or real S/4HANA Cloud, times Cloud Foundry or Kyma. One entry covers all four, because the difference between them is which backend and which runtime, not what you learn.SAP
Consume SOAP Web Services in SAP Cloud Application Programming ModelConsume SOAP Web Services in SAP Cloud Application Programming ModelCalling a SOAP service from CAP — the case the remote-service story does not cover, since CAP's own import path speaks OData and OpenAPI.SAP
Establishing connectivity between a local CAP runtime and on-premise systemsEstablishing connectivity between a local CAP runtime and on-premise systemsReaching S/4HANA, an on-premise HANA or any HTTP service from a CAP process running on your laptop — the case where the connectivity proxy the platform provides is not there and the tunnel has to be arranged.vLeonkev, published 2025-10-15
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Extend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelExtend SAP SuccessFactors on SAP BTP with the SAP Cloud Application Programming ModelTwelve tutorials, about two hours, building a side-by-side extension of SuccessFactors on BTP. The spine is remote services: importing the SuccessFactors OData service definitions into a CAP model, then treating them as entities the extension reads and writes through, rather than as an API called from a handler. Indexed as one entry because the parts only make sense in order.SAP
Extending SAP Sales and Service Cloud V2 Using CAPExtending SAP Sales and Service Cloud V2 Using CAPAn extension target that does not run on BTP at all — Sales and Service Cloud V2 sits directly on hyperscalers — so the separation between core and extension is enforced rather than encouraged. That constraint is what makes the post worth reading.Quablab, published 2025-07-09
How to Access On-premise OData from the Business Application Studio - CAPM DevelopmentHow to Access On-premise OData from the Business Application Studio - CAPM DevelopmentA destination-naming constraint found the hard way and then corrected in public: the post carries its own update saying that with a CAPM app, a standard destination works through the studio's proxy as long as the name matches [a-z0-9-]. The update credits a comment on the post, so the correction and its source are both in the record.laszlo_kajan2, published 2020-06-02
How to Access On-premise OData from the Business Application Studio - CAPM Development
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
Part 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsPart 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsThe substantial part of a side-by-side extensibility series: CAP Node.js, Cloud SDK and Fiori elements against S/4HANA Cloud. Eighteen thousand characters, and the one to read if you only read one.former_member748, published 2020-12-01
Part 1: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
Part 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsPart 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elementsThe second part, continuing the same extension. Opens with a recap of the stack rather than of the steps, which makes it readable on its own.former_member748, published 2020-12-20
Part 2: How to build an extension application for SAP S/4HANA Cloud using CAP, SAP Cloud SDK and SAP Fiori elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP CAP Remote Services & SAP Fiori ElementsSAP CAP Remote Services & SAP Fiori ElementsWhat happens to a generated UI when the data is not local: a CAP service projecting a remote one, with Fiori elements on top. The author explored it to find out where the abstraction holds, which is the useful register for this.Former Member, published 2021-05-20
SAP CAP Remote Services & SAP Fiori Elements
Fiori annotations changed in @sap/cds-dk 9.6.0, 2025-12-17. Affects A recipe, Runnable code.
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceSAP Cloud Application Programming Model: Deep Insert (4) Consume Remote ServiceFourth in a long series on deep insert, and the one where the target stops being local. Twenty thousand characters, project files linked, and the earlier parts on UUIDs and multi-level structures are prerequisites the author names.CarlosRoggan, published 2019-07-24
SAP Cloud Application Programming Model: Deep Insert (4) Consume Remote Service
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe, Runnable code.
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発SFSFとHANA Cloudを使用するCAPのアプリケーション開発In Japanese. A hands-on taking data between SuccessFactors and HANA Cloud through a CAP application — the connection setup, the data and service models, then read and write logic, and a Cloud Foundry deploy. Long enough to carry its own table of contents.rasai, published 2022-12-14
SFSFとHANA Cloudを使用するCAPのアプリケーション開発
Database connectors has changed twice since this was published, most recently in @sap/cds 10.1.0, 2026-09-07. Affects A recipe, Runnable code.
Use the SAP Cloud SDK in the SAP Cloud Application Programming ModelUse the SAP Cloud SDK in the SAP Cloud Application Programming ModelReaching for the Cloud SDK from inside a CAP service, for the calls CAP's own remote services do not make.SAP
[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant Scenario[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant ScenarioThe instalment of the Deep Dive series where the framework arrives. The earlier posts consumed Event Mesh over its REST API, so this one is explicitly a comparison: the same thing through CAP's messaging abstraction, with the three flavours — local, file-based and a real broker — named before the broker one is built.AyushKumar and vipul.khullar, published 2022-06-06
[Blog Post] SAP Event Mesh – CAP based implementation of SAP Event Mesh in a Single-Tenant Scenario
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
Complete Guide: Setting Up CAP Plugin for Advanced Event Mesh with OAuth AuthenticationComplete Guide: Setting Up CAP Plugin for Advanced Event Mesh with OAuth AuthenticationWritten because the plugin's own documentation stops short of the prerequisites and the author had to assemble them from three other sources and a help chapter. It joins them: the OIDC application in Identity Authentication, the OAuth profile in Broker Manager, the token checked before anything is wired, and only then the plugin. The author says plainly it came out of trial and error and was going to be a README.rpagni, published 2025-11-10
Designing Event-Driven ApplicationsDesigning Event-Driven ApplicationsSAP's guidance for building applications on event-driven architecture with BTP services. It sets out a two-part strategy: SAP Cloud Application Event Hub for events between SAP cloud applications and BTP, and the SAP Integration Suite family for dedicated event brokers in hybrid landscapes. Its sub-pages then cover EDA patterns, design considerations and AWS and Azure IoT integration. The framing is integration between systems; the in-process outbox and queueing inside one CAP service are not its subject.published 2025-10-10
Event Driven Architecture with Event Mesh - Part-1Event Driven Architecture with Event Mesh - Part-1Continues the author's own CDS entity-relationship example rather than starting a fresh one, which is the point of it — the same model gains events. Concepts first, then a message client and queue on BTP, then a Postman check that the queue works before any CAP code is written, and finally the emit from a CAP REST service.Avinash_Vaidya, published 2022-12-04
Event Driven Architecture with Event Mesh - Part-1
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
Event Driven Architecture with Event Mesh – Part-2Event Driven Architecture with Event Mesh – Part-2Part 1 published a message and stopped there; this closes the loop by giving it somewhere to go. A REST API built in Integration Suite is registered as a webhook on the Event Mesh queue, and the chain is run end to end — CAP to Event Mesh to Integration Suite to Twilio — so the consumer side and the webhook configuration are what this adds.Avinash_Vaidya, published 2023-01-30
Event Driven Architecture with Event Mesh – Part-2
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe, Runnable code.
Implementing Event-Driven Architecture in CAP Java using SAP Event MeshImplementing Event-Driven Architecture in CAP Java using SAP Event MeshPublish and consume from the Java stack, which most of the Event Mesh writing on the community does not cover. The MTA declaration and the credentials come first, then the emit and the handler, then the two sections that make it worth keeping: error handling with retries, and securing the events with OAuth.Soumya-Pirlamarla, published 2025-11-26
Implementing Event-Driven Architecture in CAP Java using SAP Event Mesh
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Publish events from CAP Node.js applications to Event Mesh of Integration SuitePublish events from CAP Node.js applications to Event Mesh of Integration SuiteThe smallest complete example: cds init, a service with one function, cds.connect.to('messaging') and an emit to a topic. Deliberately scoped — the Event Mesh setup is skipped and the subaccount is assumed to be the same one — so what remains is the handful of lines on the CAP side and the binding that makes them reach the broker.KevinWang_ST_Consultancy, published 2026-02-13
Publish events from CAP Node.js applications to Event Mesh of Integration Suite
Event Mesh changed in @sap/cds 10.0.3, 2026-07-02. Affects A recipe.
Triggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) AppsTriggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) AppsThe two routes out of a CAP application into a process, side by side: a destination with OAuth2ClientCredentials, the same destination with principal propagation, and Event Mesh with a CloudEvents payload. Written before @cap-js/process existed, so it is the record of what the plugin now does for you — useful when the plugin does not fit, and useful for reading what it is actually doing underneath.ATheobaldt, published 2024-12-09
Triggering SAP Build Process Automation Processes from SAP Cloud Application Programming (CAP) Apps
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe, Runnable code.
Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 2/2Using Apache Kafka for messaging in the SAP Cloud Application Programming Model (CAP) – Part 2/2The practical half: concrete use cases for cds-kafka, running locally and on BTP. It opens by placing the plugin among SAP's own event-driven offerings rather than beside them, which is the part that decides whether you reach for this or for Event Mesh — a comparison a plugin's own README rarely makes about itself.published 2025-01-13
Application to Application IntegrationApplication to Application IntegrationSAP's reference architecture for application-to-application integration, where messages carrying transactional data such as sales orders pass between business applications in near real time and each one triggers the next process step. When the sender's and receiver's APIs do not match, Cloud Integration in SAP Integration Suite sits between them to determine receivers, filter, map structures and convert protocols, which is the ground of integration flows; SAP Connectivity service, Cloud Connector and SAP Destination service reach on-premise receivers, and the edge integration cell runtime keeps processing inside a customer-managed landscape where compliance requires it. Direct exchange without middleware is allowed when the two APIs already align, asynchronous communication is the default the page states, and it is drawn at the level of the pattern, following SAP's Integration Solution Advisory Methodology, without designing any one flow.published 2024-08-01
Build an integration scenario from scratch with AI assistance at every stepBuild an integration scenario from scratch with AI assistance at every stepBuilds an integration scenario in SAP Integration Suite from nothing and takes it through design, deployment, optimisation, monitoring and resolution with AI assistance at each step, which is the Integration flows concern worked end to end. The abstract names the phases and the kinds of help, development, analysis, troubleshooting and continuous improvement, and no feature or tool that gives them. A TechEd 2026 hands-on session (Tuesday 27 October, Berlin), presented by Craig Stasila, Finny Babu, Prashant Gautam and Shilpa Vij, written here from SAP's abstract; the recording is not yet published.
Business to Business IntegrationBusiness to Business IntegrationSAP's reference architecture for business-to-business integration, the exchange of business documents with customers, suppliers and other trading partners over agreed standards such as EDIFACT, ANSI X.12 and IDoc and protocols such as AS2. Its design-time steps are Cloud Integration in SAP Integration Suite, the predefined content of SAP Business Accelerator Hub, and Integration Advisor, which defines message implementation and mapping guidelines and generates runtime artifacts from them; Trading Partner Management then turns partner profiles into agreements pushed to the Partner Directory, and generic integration flows on Cloud Integration read those agreements at runtime to exchange messages with each partner. The alternatives it names are API-based exchange where an industry has standardised its APIs, and SAP Business Network with the managed gateway for spend management in place of connecting partners one by one.published 2024-08-01
Connect Business Processes with SAP Master Data IntegrationConnect Business Processes with SAP Master Data IntegrationSAP's reference architecture for keeping master data such as materials, business partners and cost centres consistent across applications with SAP Master Data Integration, a central hub that stores every change in an event log and distributes it to the solutions that consume it. Cloud Integration in SAP Integration Suite carries what the hub does not reach, SAP solutions it does not yet support and third-party or on-premise systems, through an SAP Master Data Integration adapter, which is where the design meets integration flows; newer SAP S/4HANA releases connect to the hub without it. Consolidation, data quality and central governance are outside the architecture and left to SAP Master Data Governance, and SAP Master Data Integration itself has no entry in the atlas yet.published 2024-08-01
Edge Integration Cell on HyperscalersEdge Integration Cell on HyperscalersSAP's architecture for Edge Integration Cell, the runtime of SAP Integration Suite that executes integration flows in a Kubernetes cluster the customer runs, while design, monitoring and governance stay on SAP BTP and the runtime reaches BTP over outbound-only channels. The main page gives the reasons SAP names for it: data residency, security policies that forbid inbound access, and latency to a distant BTP region. Three sub-pages draw the same setup on AWS, Azure and Google Cloud, each with a private network across three availability zones, a managed Kubernetes cluster, managed PostgreSQL and Redis, sizing left to an SAP Note, and each says it outlines a small production deployment to be treated as a starting point.published 2025-04-18
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
Use mocking to embrace auth in your domain model from the outsetUse mocking to embrace auth in your domain model from the outsetMock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.SAP
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpHow to Restrict CRUD Operations in SAP CAPM Using @Capabilities, @readonly and Test APIs with .httpEntities are exposed with full CRUD by default, and this is how to take operations away again — @Capabilities for Insert, Update and Delete individually, @readonly for the blunt version. Tested with .http files rather than a UI, which keeps the check on the service.DeepaRagho, published 2026-05-22
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
New and improved: Change Tracking pluginNew and improved: Change Tracking pluginThe 2.0 announcement, and unusually candid about why there is a 2.0 at all: the plugin already existed and was, in the author's words, plagued by many issues. What it records is every insert, update and delete with the user and the timestamp, aimed at root-cause analysis and at detecting changes nobody authorised. Generally available as of this post, having been hinted at as beta in the April release notes.published 2026-06-12
New and improved: Change Tracking plugin
cds 2, line ended. Affects A recipe, Runnable code.
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Configure an MCP Server Created from an HTTP EndpointConfigure an MCP Server Created from an HTTP EndpointDocuments configuring API Management’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23