BrowseAll ecosystems
Everything in the atlas
756 of 2341
Domain
Signals
Content
More: 2
Group by: Capability
EntryBySignalsLast activity
Adapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionAdapting SAP Joule for Purchase Order Creation from an Existing Purchase RequisitionA custom Joule Agent and Joule Skill, built in Joule Studio, classic edition to extend SAP Joule past its built-in Purchase Order display and change features: a buyer's single sentence naming a Purchase Requisition number becomes a created Purchase Order, with the skill wrapping the Purchase Requisition and Purchase Order OData V4 APIs as Action Packages reached through two destinations. The author anchors the agent's success condition to a PurchaseOrderNumber in the skill's output rather than an HTTP status code, and reports that the Purchase Requisition item structure does not map one-to-one onto the Purchase Order creation payload.jonathanvi59, published 2026-08-19
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Build Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudBuild Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudA CAP Node.js service action calls an Ollama-hosted model through LangChain's ChatOllama, with the API key read from a .env file instead of any destination or credential binding — the hand-rolled-key route SAP's own SDK call exists to avoid. The same handler then builds a LangChain agent with createAgent and one mock tool, so a question about restaurants triggers a tool call and any other question does not, independent of the @cap-js/agents plugin's A2A-served harness.rajeevgoswami1, published 2026-08-29
Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Part 2 of a three-part series builds a separate, non-CAP Node/TypeScript agent that calls the Part 1 CAP service's MCP tools and reasons through SAP AI Core via @sap-ai-sdk/orchestration, using LangGraph's createAgent ReAct loop for provider-agnostic model calls across GPT, Claude and Gemini deployments. It explains why the tool's Zod schema and model-facing description are the agent's actual contract, the gotcha between a foundation-models deployment and an orchestration-scenario one, and how edge-case testing replaced date inference with a server-computed daysOverdue field after the agent wrongly called a delayed order 'on schedule'.rodfior, published 2026-08-20
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Building Durable AI Agents - Announcing the cds-langgraph-persistence PluginBuilding Durable AI Agents - Announcing the cds-langgraph-persistence PluginThe announcement, and the argument behind it. Treating an agent as a software architecture rather than a model with tools makes a list of production requirements — identity, authn and authz, multitenancy, persistence, event-driven flows, scalability, observability, CI/CD — and the author's point is that CAP already answers most of them for BTP, which is what makes LangGraph inside CAP Node.js worth doing. The post then narrows to one of those requirements, durability, and the checkpointer that supplies it. Written from a year of building agents next to real business systems rather than as a framework tour.merbinjanselm, published 2026-07-15
Building Durable AI Agents - Announcing the cds-langgraph-persistence Plugin
@mi8y/cds-langgraph-persistence has been through 3 major lines since this was published: 0.5 (2026-07), 0.6 (2026-07), 0.7 (2026-09). Affects Runnable code.
Custom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalCustom Joule Agent for SAP Ariba SLP - Building an AI Agent for Supplier Registration ApprovalBuilds a Joule Studio agent that reviews SAP Ariba SLP supplier registration tasks: four custom skills bind to Ariba's API (pending tasks, task detail, questionnaire answers, post a decision), each needing a precisely configured BTP destination and action, and the agent's own Expertise, Instructions and Additional Context sections carry the domain knowledge, the step order, and the scoring rubrics that decide approve, deny or deny-with-resubmit. The author contrasts this with an earlier hand-wired flow on SAP Build Process Automation, where every connection, variable and error path had to be designed and wired manually.Giancarlo-Martinez, published 2026-04-07
Event Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshEvent Driven SAP CAP on Kyma with Agentic AI and UI Auto RefreshA prototype, described as one: a plain CAP application made to react to external events on Kyma, with an agent in the loop and the UI refreshing itself rather than being reloaded. Short — it reports what was built and why, not how to rebuild it.Shahid, published 2025-12-01
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
Governance at Scale: Why a Clean Core Is What Makes Agent Governance EnforceableGovernance at Scale: Why a Clean Core Is What Makes Agent Governance EnforceableClosing a six-part clean-core series, the post argues that SAP's two agentic-AI governance mechanisms only work against a documented tool surface: MCP Gateway in SAP Integration Suite auto-translates API specifications into MCP tool schemas augmented with natural-language semantics, carrying forward existing authentication, authorization and rate limiting into the agentic layer, while AI Agent Hub, built on SAP LeanIX, discovers and runs verification assessments on agents, LLMs and MCP servers before the resulting badge is read by Joule Studio or SAP Integration Suite to decide what is trusted. Its argument holds the mechanisms up against an undocumented internal interface, where the auto-generated schema and the verification badge have nothing real underneath them, and against a consolidated CAP service exposing only released APIs, where both do.DEEPA_DORAIRAJ, published 2026-09-21
How Redwood Software and SAP are shaping the next era of automation with Joule StudioHow Redwood Software and SAP are shaping the next era of automation with Joule StudioRedwood's Field CTO describes a tech preview where an SAP Basis administrator tells SAP Joule in natural language to pause background jobs and dependent Integration Suite iFlows for unplanned system maintenance; Joule acts as a control tower, triggering a pre-approved RunMyJobs workflow and asking for approval before the restart proceeds. The integration is built by publishing RunMyJobs operations to the SAP Business Accelerator Hub, securing access through SAP BTP with API keys and role-based permissions, and combining those actions into a skill inside Joule Studio's low-code design canvas.gmblom, published 2025-11-02
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)SAP Agentic AI in Practice: Building the SAP Exception Log Triage Agent (Part 3 of 6)Part 3 of a six-part series builds a router agent that classifies incoming SM21 system log errors and SM37 job failures, delegates each to a specialized sub-agent built with LangGraph's create_react_agent, and correlates findings across both logs into a single severity score and escalation list. State moves through a typed dict shared between the router and its sub-agents, with tools that query SAP HANA tables directly; a reactive on-demand mode sits alongside a scheduled monitoring loop that compares error counts to a baseline and escalates automatically past a threshold. The router-plus-sub-agent split carries forward to Part 6, where the same router coordinates the assessment agents built in the series' other parts.DEEPA_DORAIRAJ, published 2026-04-06
SAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingSAP JOULE & ME : My First JOULE Skill in SAP EHSM-Incident Management Without CodingWalks through building a transactional Joule Skill in Joule Studio, classic edition without writing code: activating an EHS Incident OData service in SAP S/4HANA, wrapping it as an Action Project with chosen input and output fields, then creating, saving and deploying the skill from those fields. Tested against a live system, the deployed skill lets a user create an EHS incident and list reported incidents through Joule's conversational interface or a configured button.Pardhasaradhi_Reddy_Chelikam, published 2026-01-05
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableSAP Joule: Invoice Agent for Faster Supplier Invoice Release in SAP S/4HANA Accounts PayableWalks through building an Invoice Release Agent in SAP Joule: a custom OData service surfaces supplier invoices whose S/4HANA Flexible Workflow approval is overdue, the agent ranks them by invoice value, aging, payment tenor or a combined score, and a Joule Skill calls the standard SAP AP Invoice OData API to release them, re-prioritizing the remainder after each action. It sets out the detect-prioritize-act loop and the four ranking criteria in enough detail to rebuild the pattern, and leaves authorization, auditability and segregation-of-duty controls to the reader's own design.idc, published 2026-08-11
SAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenSAP's API Policy on AI Agents: What It Prohibits, Allows, and Leaves OpenReading SAP's API Policy v.4.2026a and its FAQ against the reference architectures, the piece narrows the widely repeated claim that SAP bans AI to what Section 2.2.2 actually restricts: an agent planning and chaining API calls outside an SAP-endorsed route, closed off further by Section 3's block on bypassing API Controls through custom code. It compares the endorsed and allowed paths — the MCP Gateway on SAP Integration Suite reaching S/4HANA and ECC through RFC-based back ends under a 15-tool, 200,000-token limit, SAP-provided MCP servers through Joule Studio, the A2A protocol, customer-operated MCP servers allowed under FAQ Question 56, and the ADT MCP Server, whose 18 tools work only on development artifacts and are documented as not intended for productive use. It leaves open whether Section 2.2.2 covers ABAP code that calls a model from inside the system, since enforcement is defined at the API-traffic level rather than by a list of tools.published 2026-08-31
September 15th: What's New on developers.sap.comSeptember 15th: What's New on developers.sap.comThomas Jung walks through a week of changes aimed at agentic consumption of developers.sap.com itself: the hosted MCP server gains a published .well-known/mcp.json manifest, curated tools (search_tutorials, get_tutorial_step with a Markdown format option, search_channels), and a listing in the ORD catalog beside its OData, REST and GraphQL APIs. It also documents the site's existing A2A endpoint for the first time and ships a way to turn a tutorial into an installable, cryptographically signed AI Skill with a generated verification script, both concrete instances of agent tooling; separately, five broken GraphQL example queries were fixed and the full SDL is now served, and new sitemap.md, llms.txt fixes and ORD entries round out the site's own metadata publishing.published 2026-09-15
What's new in SAP Cloud Application Programming Model – September 2026What's new in SAP Cloud Application Programming Model – September 2026The September 2026 release turns CAP services into A2A-callable agents through the new @cap-js/agents plugin, which generates MCP tools from a service's entities and actions, adds an @agent.hitl approval gate and can read an AGENTS.md/SKILL.md pair for custom behaviour. The @cap-js/mcp plugin for Node.js and com.sap.cds:cds-adapter-mcp for Java reach general availability, serving describe, query and call tools over existing CAP authentication and authorisation. It also names capire/skills, SAP's curated skill library that teaches coding agents current CAP practice.published 2026-09-24
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Cloud Integration with Document AICloud Integration with Document AIWalks through connecting Cloud Integration to SAP Document AI: an iFlow posts a prescription PDF to Document AI's job API, polls the job endpoint until it completes, and a groovy script reads back the result, keeping only the fields above a stated 60% confidence threshold. The scenario is a hospital extracting a new patient's past illnesses, allergies and blood group from uploaded prescriptions, matched against a custom extraction schema.PriyankaChak, published 2025-08-10
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
Integrate CAP application as outbound channel for SAP Document AIIntegrate CAP application as outbound channel for SAP Document AIDocument AI will call you back when extraction finishes, and the callback is where this goes wrong: the CAP application has to accept an unauthenticated POST from outside without dropping CSRF protection for everything else. The answer is a middleware hooked into the CAP bootstrap, and the post spends its length on the token lifecycle rather than on the extraction.sdeissenboeck, published 2026-04-22
Integrate Document Information Extraction into UI5 applicationIntegrate Document Information Extraction into UI5 applicationUploading an invoice from a UI5 application and getting the extracted fields back on screen, with a destination pointing at the Document Information Extraction API and a Refresh button polling until the job finishes. The polling is the honest part: extraction is asynchronous, and the post does not pretend otherwise. From 2022, so the service has since been renamed and the API moved, but the shape — upload, poll, map the result — is the shape it still is.published 2022-05-31
Integrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepIntegrating SAP Document Information Extraction (Document AI) with SAP CAP – Step by StepThe forward direction, in full: a PDF or scan arriving at a CAP service, sent to Document Information Extraction, and the fields coming back into the model. Long, and step-by-step in the literal sense — the service binding and the request shapes are all written out.furkan5, published 2025-10-09
SAP AI Services - DOX - Gen AI with SAP CAP Plugin - Part 3SAP AI Services - DOX - Gen AI with SAP CAP Plugin - Part 3Building on Reusable components for CAP with cds-plugin by Daniel Schlachter, this part walks through a custom CAP plugin — a cds-plugin.js plus a lib_cap_dox.js helper — that authenticates against SAP's Document Information Extraction (DOX) service and calls its schema and job-status APIs to fill an entity from extracted document fields. It covers reading the service key from Cloud Foundry (cf service-key) for the OAuth token endpoint, and dynamically mapping DOX's header and line-item output onto CAP entity properties.sabarna17, published 2024-06-11
Using BTP Document Extraction Service into actual App developmentUsing BTP Document Extraction Service into actual App developmentWalks through calling SAP Document AI's REST API directly: getting a client-credentials bearer token from the service key's UAA, then POSTing to /document/jobs with a file and an options body naming the document type and the header fields and line items to extract (paymentTerms, documentDate, taxId, description for an invoice), and polling the returned job id until the status resolves. Covers the trial-account booster and its own UI for uploading a document and testing extraction before moving to Postman and a small Python script that lists jobs over the same bearer token.Ace_D, published 2024-07-31
What a Second Document AI Workshop Taught Me About GovernanceWhat a Second Document AI Workshop Taught Me About GovernanceFrom questions raised at a second SAP Document AI workshop: the retention period for extracted data is a setting in the service's administration rather than a fixed property, with the source file deleted after processing and the decommissioning period for the extracted data configured to the customer's own policy. It also draws a boundary readers kept merging: Document AI extracts across languages but does not translate, so turning a document into a reviewer's own language is a separate step, pointing on BTP at SAP Translation Hub.Nicolas_BacaStorni, published 2026-08-25
Why Our First Document AI Exercise Was a Résumé, Not an InvoiceWhy Our First Document AI Exercise Was a Résumé, Not an InvoiceWorking through a SAP Document AI workshop, the author explains why its exercises teach extraction on a résumé before an invoice: a résumé has no stable layout to map fields against, so it forces the point that the tool extracts from a written description of a schema rather than from position-matched templates. Describing the schema is shown to carry real judgment — what a missing end date should become, what a vague field name like "number" costs the model, who in a company should decide these things — and the piece argues that preparing for a project is chiefly a business task of writing down knowledge that otherwise stays in people's heads.Mariano_BacaStorni, published 2026-09-03
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3The concepts before the code: what the GPT model and its API actually offer, and what the finished chat application looks like — personalities included. Written in the weeks when the ground was moving under it, and the post carries its own change log to prove it: GPT-3.5 added on 1 March, GPT-4 on 15 March, and an admission that a series planned as two posts became three.published 2023-02-22
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 1/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3The backend: CAP with TypeScript, the entities holding chats and personalities, and the service that talks to the API. This is where the streamed completion and the repositories behind the handler come from, which is the part of the sample still worth lifting even though the model access has since been superseded by AI Core.published 2023-02-24
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 2/3
cap-ui5-gpt-chat: no published releases, repository quiet for 41 months. Affects Runnable code.
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3The SAPUI5 frontend of the sample, and mostly an argument for writing UI5 in TypeScript: ES imports in place of sap.ui.define, a class with real private members in place of the underscore convention, and the service types generated from the CDS model copied into the UI package, so one IChats interface types the OData object the controller reads. The second half is structure — a formatter class and a singleton LayoutManager called from the XML view through core:require, a confirmation helper taking a callback, a dialog class resolving a promise, a generic createEntity<T> on a service class — all of it to keep every controller under 100 lines. What it says about arranging a UI5 app holds whatever model sits behind the chat; the tooling around it is of its date, and the post calls UI5's TypeScript support experimental.published 2023-02-27
A ChatGPT-like chat app built with modern SAP technologies (CAP, SAPUI5) – Part 3/3
cds2types. Affects Runnable code.
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIAgentic AI on BTP: a Multi‑Agent App with Pydantic AISplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP servers each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-tooling pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI Core GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integration side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.published 2026-05-03
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIAn Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAIA dormant internal app at SAP Japan revived with AI, built to solve a problem the team actually had — colleagues who could not talk to each other. Build Apps on the front, CAP on Kyma behind it, OpenAI in the middle.javieryw, published 2024-01-31
An Innovative Language Exchange App developed with SAP Build Apps, CAP, Kyma, and OpenAI
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Automate your Job Postings Using Generative AI (ChatGPT) & SAP Build Process Automation AppsAutomate your Job Postings Using Generative AI (ChatGPT) & SAP Build Process Automation AppsA process that drafts its own text: ChatGPT writing job postings, SAP Build Process Automation carrying them through approval, and CAP in between. Presented as a generic pattern the author expects to be adapted rather than copied.shivamshukla12, published 2023-08-10
Autonomous Diagnostics on Kyma Unplugged: Goose + LiteLLM + KRO + SAP AI Core in ProductionAutonomous Diagnostics on Kyma Unplugged: Goose + LiteLLM + KRO + SAP AI Core in ProductionAn in-cluster autonomous diagnostic pipeline on Kyma Unplugged (open-source Kyma, noted to also run on SAP BTP, Kyma runtime): a Goose agent with kubectl access calls SAP AI Core through a LiteLLM proxy, and most of the post is about the quirks of that route — drop_params silently swallowing unrecognised parameters and beta headers, streaming that has to be off when tools are attached, and prompt caching that sits on the Orchestration V2 API rather than the foundation-model path the LiteLLM provider hits. A second Node.js proxy reaches that API, and the author reports caching unconfirmed at production scale, which leaves the roughly $0.004 per static run a target rather than a measured figure. Spend metrics reach SAP Cloud Logging over OTLP through Kyma's Telemetry MetricPipeline while the health analysis itself lands in Kubernetes custom resources read in Busola, and the stack is declared as KRO Resource Group Definitions applied with one Terraform command.quovadis, published 2026-07-09
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackBanking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI StackThe risk it is chasing is a graph problem stated in banking terms: a borrower who looks safe alone and is the linchpin of a group ten times the size. Multi-agent, mixed AI stack, on BTP and CAP.Shahid, published 2026-06-24
Banking Sentinel: A Multi-Agent Credit-Risk Copilot on SAP BTP, Built on a Mixed AI Stack
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A recipe, Runnable code.
Beyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBeyond Basic AI Error Handling in SAP CPI - A Rules-First Architecture with HANA Cloud LearningBuilds a rules-first error-diagnosis pipeline on Cloud Integration in SAP Integration Suite: a Groovy classifier resolves known failures — auth, timeout, malformed payload — deterministically, and only genuinely novel errors reach an LLM through the AI Adapter, after a sanitizer script replaces every payload leaf value with a typed placeholder before it leaves the tenant. SAP HANA Cloud, reached over JDBC, holds a fingerprinted dedup cache and an accumulating table of past diagnoses. It also documents the AI Adapter configuration — Advanced mode, a Bearer-prefixed Secure Parameter, and a connection/processing URL split — needed to reach a non-SAP OpenAI-compatible endpoint, found by the author to be undocumented.Krishna_Karthik, published 2026-06-11
Build Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudBuild Your AI Agent prototype for free using SAP CAP, LangChain and Ollama cloudA CAP Node.js service action calls an Ollama-hosted model through LangChain's ChatOllama, with the API key read from a .env file instead of any destination or credential binding — the hand-rolled-key route SAP's own SDK call exists to avoid. The same handler then builds a LangChain agent with createAgent and one mock tool, so a question about restaurants triggers a tool call and any other question does not, independent of the @cap-js/agents plugin's A2A-served harness.rajeevgoswami1, published 2026-08-29
Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Building a Pro-Code Agent on SAP BTP — Part 2: The Agent (LangGraph + GenAI Hub)Part 2 of a three-part series builds a separate, non-CAP Node/TypeScript agent that calls the Part 1 CAP service's MCP tools and reasons through SAP AI Core via @sap-ai-sdk/orchestration, using LangGraph's createAgent ReAct loop for provider-agnostic model calls across GPT, Claude and Gemini deployments. It explains why the tool's Zod schema and model-facing description are the agent's actual contract, the gotcha between a foundation-models deployment and an orchestration-scenario one, and how edge-case testing replaced date inference with a server-computed daysOverdue field after the agent wrongly called a delayed order 'on schedule'.rodfior, published 2026-08-20
Building an LLM Agent in CAP Java with Spring AIBuilding an LLM Agent in CAP Java with Spring AIThe Java counterpart to the author's own Node.js post, and written as one: connecting to AI Core with the SAP AI SDK, then calling an agent and a tool through Spring AI. Opens with a section on libraries and workflows — which framework does what, and what is left to you — before any code.published 2026-06-08
Building an LLM Agent in CAP Java with Spring AI
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Building an LLM Agent using CAPBuilding an LLM Agent using CAPThe argument is that CAP is already most of what an agent framework wants — services, handlers, a typed model — so the agent is built inside it rather than beside it. AI Core through sap-ai-sdk, then Langchain for the agent and its tools. Long, with a TLDR at the top for people who want the shape without the walk.published 2026-05-27
Building an LLM Agent using CAP
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects Runnable code.
Calling Claude from ABAP: How I Wired SAP AI Core into a Real Business ScenarioCalling Claude from ABAP: How I Wired SAP AI Core into a Real Business ScenarioA proof of concept wiring SAP AI Core's Claude deployment directly into ABAP with no CAP layer between them: two SM59 HTTP destinations, a hand-written OAuth 2.0 client-credentials exchange, and a regex to unwrap Claude's system/messages response envelope. Most of the effort goes into a system prompt that constrains the model to return one fixed JSON schema of filter fields, which ABAP deserialises with /UI2/CL_JSON and exposes through a RAP custom action so a Fiori search field can drive an OData V4 filter.PranayGaroo, published 2026-06-04
cds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPcds-toon-ai-protocol-adapter: a pragmatic way to cut AI token costs using SAP CAPNames a cost most CAP-plus-LLM writing ignores: every JSON payload streamed to a model is billed by its verbosity, in latency as well as money. The plugin brings TOON — Token-Oriented Object Notation — to a CAP service so the wire format changes without the service code doing so, in a REST variant and an OData one, with token counts reported on both sides.published 2026-01-25
Connecting SAP Integration Suite with SAP Document AI and SAP Business AIConnecting SAP Integration Suite with SAP Document AI and SAP Business AIWalks through a Cloud Integration flow in SAP Integration Suite that pulls PDF purchase orders from a Gmail mailbox, extracts header and line-item fields through SAP Document AI's job-submission and polling API, and validates the result with SAP AI Core's generative AI hub using GPT-5-mini as a quality check rather than the source of the extracted values. Groovy steps combine the Document AI confidence score and the model's score into one figure that routes low-scoring purchase orders to manual review, with no S/4HANA posting performed.subhojitSaha, published 2026-08-24
Creating a meal generator application with SAP Build, Cloud Application Programming and openAICreating a meal generator application with SAP Build, Cloud Application Programming and openAIIngredients in, meal suggestions out, assembled from BTP services plus OpenAI and Google APIs. A small application built for the pleasure of it, and useful here as the plainest example of CAP holding the middle of a generative flow.former_member793421, published 2023-07-17
Elevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginElevating Data Privacy in SAP CAP based GenAI Applications with CAP LLM PluginThe question underneath the enthusiasm: what leaves your landscape when a prompt goes to a model. The plugin's answer is to anonymise the sensitive fields through HANA before the prompt is sent, and this is the post that explains why that is the design rather than an option.AkashAmarendra, published 2024-02-02
Empowering Your Data Analytics with GPT-3 and SAP CAP IntegrationEmpowering Your Data Analytics with GPT-3 and SAP CAP IntegrationFree text in, SQL out, answer back in a sentence — the model writes the query, CAP runs it, and the model turns the rows into prose. Written in the GPT-3 window, so the model access has dated, but the three-step shape has not, and it is a different bet from retrieval: nothing is embedded, the schema is the context.Former Member, published 2023-03-10
Enhancing Business Processes with SAP BTP AI in SAP Integration SuiteEnhancing Business Processes with SAP BTP AI in SAP Integration SuiteWalks through a post-exit iflow in SAP Integration Suite that calls an LLM through SAP AI Core's Generative AI Hub to turn a customer's free-text return comment into one of a fixed set of SAP rejection-reason codes, so an inbound ORDERS05 IDoc carries a decision (E1EDP01-ABGRU) the ERP can act on without pausing for manual review. The worked example is a Commerce Cloud returns flow into S/4HANA; the piece argues the same bounded-classification pattern fits other narrative fields — delivery-exception remarks, expense-claim justifications — where the cost of an LLM call is repaid by removing a human review step, and points to a colleague's post on the Generative AI Hub orchestration workflow for the guardrailing (prompt templating, data masking) it only names.arunmaarirajha_kv, published 2025-12-15
Enhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginEnhancing Enterprise Applications: AI-powered User Experience with SAP CAP AI PluginStarts from the blank form nobody wants to fill in, and asks what an enterprise application should do about it. The AI is in service of that rather than the subject of it.published 2026-04-29
GenAI Mail Insights - Leveraging the generative AI hub in SAP AI Core to improve customer supportGenAI Mail Insights - Leveraging the generative AI hub in SAP AI Core to improve customer supportA sample application rather than an explainer, and the author says so in the opening — enough talking, here is something that runs. Incoming support mail summarised and categorised through the generative AI hub in AI Core.martinfrick, published 2023-11-15
HANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingHANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingTwo ways to produce the same embedding, run side by side: HANA Cloud's own VECTOR_EMBEDDING function against Azure OpenAI through the CAP LLM plugin. The CDS side is short — an element of type cds.Vector maps to REAL_VECTOR on deploy — so what remains is the comparison, which is the thing you cannot get from either product's documentation alone.lalitmohan, published 2025-04-09
How to Reduce Prompt Token Costs Using Toon = Save MoneyHow to Reduce Prompt Token Costs Using Toon = Save MoneyToken spend treated as a running cost rather than a detail, and TOON as the lever. Companion reading to the CAP adapter for the same format that is indexed here.Yogananda, published 2025-11-12
How to Reduce Prompt Token Costs Using Toon = Save Money
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
How to use Cloud SDK for AI in an existing CAP NodeJS Project in CommonJSHow to use Cloud SDK for AI in an existing CAP NodeJS Project in CommonJSA dependency that is ESM-only inside a project that is CommonJS, and the author's judgement that converting the project was too risky. What follows is the esbuild workaround, which is the honest answer when the ecosystem has moved and your codebase has not.Jacky_Liu1, published 2025-08-01
Improving Exception Handling using Generative AI in SAP Cloud Integration (SAP CI/CPI)Improving Exception Handling using Generative AI in SAP Cloud Integration (SAP CI/CPI)Wires an Exception Subprocess in Cloud Integration to send a failed iFlow's caught exception text to Google Gemini's generateContent endpoint over the HTTP adapter, then parses the response in Groovy for a user-friendly error message, the likely causes, the steps to try and an HTTP status code to return to the sender. A Content Modifier holds the API key and the prompt as externalised properties, which the post says is what lets another model be put in their place, and a closing Groovy script writes the extracted fields to custom headers and log attachments and rebuilds them as an XML error response. The exception-subprocess wiring is given step by step and so is the Gemini call with its request format, which is why the piece sits on integration flows and on LLM integration.AdarshRao, published 2025-07-20
Integrating a Custom AI Model into SAP CAP Using AI LaunchpadIntegrating a Custom AI Model into SAP CAP Using AI LaunchpadYour own model rather than a hosted one: deployed to AI Core, made callable through AI Launchpad, then reached from CAP. The case a lot of companies ask about and few posts cover.egeAksoyek, published 2026-03-20
Integrating a Custom AI Model into SAP CAP Using AI Launchpad
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects Runnable code.
Lets Talk to the Database - CAP & SQLite Powered by Google Gemini-2.5-ProLets Talk to the Database - CAP & SQLite Powered by Google Gemini-2.5-ProNatural language against a CAP service on SQLite, with a non-SAP model doing the translation. Written as a learning exercise rather than a pattern, and the choice of Gemini over anything in the AI hub is the interesting part of it.ShivamShuklaSAP, published 2025-04-16
Michael Jackson: AI Cognitive Pipeline on SAP BTP, SAP CAP, ElevenLabs, Claude, HANA DB, SolaceMichael Jackson: AI Cognitive Pipeline on SAP BTP, SAP CAP, ElevenLabs, Claude, HANA DB, SolaceA pipeline that listens to a song, identifies the historical events it references, retrieves knowledge about each and builds an emotional arc across the whole track. Not an enterprise use case, and useful precisely for that: the plumbing — CAP, HANA, Solace, Claude, ElevenLabs — is doing something the vendor demos never ask of it.Shahid, published 2026-05-18
Natural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesNatural Language Queries for SAP CAP via MCP: The LLM Translates, CDS ExecutesThe division of labour is the argument, and it is in the subtitle: the model turns English into a CDS query and CDS runs it, so nothing generates SQL and nothing hallucinates a join. Schema annotations do the resolving. Long, with the package, the repository and the MCP registry entry all linked.Shahid, published 2026-06-25
Out-of-the-Box Document Grounding in SAP AI Core: RAG with SAP Help PortalOut-of-the-Box Document Grounding in SAP AI Core: RAG with SAP Help PortalWalks through SAP AI Core's document grounding: a default 'help.sap.com' data repository that is already grounded, queried either directly through /retrieval/search after labelling a resource group for grounding, or through the orchestration service's grounding_module_config paired with llm_module_config and templating_module_config to inject the retrieved chunks into a prompt. Shows the orchestration service as a unified interface for swapping LLM providers by changing a configuration parameter rather than application code.Joni, published 2025-04-15
Prompt-Driven Development: Building Full-Stack SAP CAP Apps from User StoriesPrompt-Driven Development: Building Full-Stack SAP CAP Apps from User StoriesA user story in, a scaffolded full-stack CAP application out, through SAP Build Code and Joule. The question it is actually asking is how much of the foundational code is worth generating, and it answers by generating all of it.AnuradhaDhingan, published 2025-12-11
RAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPRAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPThe end-to-end version: a CAP service exposing the vector engine and the AI hub behind a couple of endpoints, answering where a CodeJam is on a given date. It has aged in a way the author has marked in the page itself — the section on the CAP LLM plugin now carries "(Outdated)" in its own heading — so read the embedding preparation and the retrieval shape, and check the plugin part against the package.KevinR, published 2024-05-21
SAP Integration Suite: Intelligent Integration with AI AdapterSAP Integration Suite: Intelligent Integration with AI AdapterThe AI Adapter adds generative AI as a receiver step inside a Cloud Integration flow, connecting through either AICore-GenAIHub — a single API onto SAP AI Core's Generative AI Hub and its foundation models — or Custom-OpenAI-Rest, a plain REST call out to a provider such as OpenAI. SAP Integration Suite starts the call from the iFlow and feeds the model's response into the next step, which is the mechanics behind the sentiment-analysis, summarisation and routing use cases the piece lists without walking through any one of them.meena_choudhary, published 2026-01-28
Streaming LLM Output with CAP and WebSocketsStreaming LLM Output with CAP and WebSocketsTokens arriving from the AI SDK's orchestration module, forwarded to the browser as they come rather than after the model finishes. Covers all four pieces — enabling WebSocket support in CAP, a service with actions and events, the streaming itself, and a frontend on the native WebSocket API — which is what makes it the clearest case for why a CAP service would want a socket at all.RobinP, published 2025-11-18
Streaming LLM Output with CAP and WebSockets
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A recipe, Runnable code.
UI5 AI Features library is now an npm PackageUI5 AI Features library is now an npm PackageThe release note for a demo turning into a dependency, and it is explicit about why that matters: the earlier version worked, but using it meant cloning the repo and copying both halves, which stops working the moment one of them changes. The post walks through what shipping the CAP plugin and the be.wl.ai control library in one npm version buys — a client and server contract that cannot drift — then lists the eleven controls by group, shows the two-line configuration that activates each half, and notes that this version is actually deployed on BTP behind both a standalone approuter and Work Zone. It closes on the demo repository, written with no library source in it as the test that the package stands alone.published 2026-08-31
UI5 AI Features library is now an npm Package
cds 8, line ended. Affects Runnable code.
UI5 MCP Server Got Extended for UI Integration Cards GenerationUI5 MCP Server Got Extended for UI Integration Cards GenerationVersion 0.2.1 of the UI5 MCP Server adds three tools for UI Integration Cards: get_integration_cards_guidelines feeds an agent current best practices and API versions, create_integration_card scaffolds a new card project, and run_manifest_validation checks the generated manifest against the schema. The post frames these as closing the same gaps as the server's existing tools — an LLM's outdated or wrong card API knowledge — this time for scaffolding and validating a card rather than a full app.daniel_vladinov, published 2026-01-22
What an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayWhat an AI infra engineer sees when opening SAP's AI stack (1/3): the model gatewayA first look at SAP AI Core's Generative AI Hub from someone who builds gateways outside SAP for a living: the orchestration service harmonizes provider calls onto one API (a model name string switches providers, and SAP Note 3437766 carries the current model list, token rates and deprecation dates), runs a fixed, non-reorderable module pipeline — templating, masking through SAP Data Privacy Integration, grounding, content filtering, then the model call — and retries down an ordered fallback list whose entries can each carry their own model and rules. It places @sap-ai-sdk/orchestration among the official JavaScript, Java and Python SDKs, and notes SAP's own LiteLLM provider as a way to put a different gateway in front of it.amishkush, published 2026-09-30
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Decision Logic Modernization in SAP Integrations: Using SAP-RPT-1 for Intelligent Routing DecisionsDecision Logic Modernization in SAP Integrations: Using SAP-RPT-1 for Intelligent Routing DecisionsWalks through embedding SAP-RPT-1 — SAP's foundation model for classification and regression over tabular ERP data, hosted on SAP AI Core — into a Cloud Integration flow that picks the optimal 3PL logistics partner for an outbound delivery. The iflow sends historical deliveries from SAP HANA Cloud plus the new delivery as context rows to the model's in-context learning, with no training step, and routes on the returned prediction and confidence score, the mechanism predictive models's core coverage describes for SAP-RPT-1. The author is explicit that SAP-RPT-1 differs from general-purpose language models trained on text, which keeps this apart from an LLM-integration scenario.arunmaarirajha_kv, published 2026-02-16
SAP-RPT-1.5 Is Now Generally Available: More Accurate Predictions, Better Explainability, What's NewSAP-RPT-1.5 Is Now Generally Available: More Accurate Predictions, Better Explainability, What's NewAnnounces general availability of SAP-RPT-1.5, the next release of SAP's foundation model for predictive models over tabular enterprise data: in-context classification and regression with no training step, now with stronger accuracy on high-cardinality columns, a maximum API batch of 512 rows (up from 128), and an "explain by example" mode that surfaces the historical rows that most influenced a prediction rather than ranking feature importance alone. Two variants ship, a default model and a -large model recommended past 100 columns or where accuracy is the priority, and the post previews a coming "tabular orchestration" workflow, targeted for general availability in August 2026, that is meant to select the relevant context rows from millions of historical records automatically.RanjeetKr, published 2026-08-14
A Use Case for HANA Cloud Knowledge Graph: AI‑Driven Tender AnalysisA Use Case for HANA Cloud Knowledge Graph: AI‑Driven Tender AnalysisMatching unstructured text against internal data, using both HANA engines at once — the Knowledge Graph for the relationships and the Vector Engine for similarity — with CAP holding the application and its data. Notes that the Knowledge Graph Engine is off by default and has to be enabled when the instance is created, which is the kind of thing that stops a weekend.giacomo_dantonio, published 2026-03-19
Building a Generative AI-powered Inventory Assistant with SAP CAP, RAG, and Vector DatabaseBuilding a Generative AI-powered Inventory Assistant with SAP CAP, RAG, and Vector DatabaseAn existing CAP stock application turned into a question-answering one, and the part worth reading is the schema: three tables, not one — the products, an archive of the text that was embedded, and a separate lookup table holding the vectors. Retrieval finds candidate products by similarity and then reads the real rows, so the answer is grounded in records rather than in the embedded text.furkan5, published 2025-11-07
HANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingHANA Cloud’s VECTOR EMBEDDING in CAP and Comparison with OpenAI EmbeddingTwo ways to produce the same embedding, run side by side: HANA Cloud's own VECTOR_EMBEDDING function against Azure OpenAI through the CAP LLM plugin. The CDS side is short — an element of type cds.Vector maps to REAL_VECTOR on deploy — so what remains is the comparison, which is the thing you cannot get from either product's documentation alone.lalitmohan, published 2025-04-09
Michael Jackson: AI Cognitive Pipeline on SAP BTP, SAP CAP, ElevenLabs, Claude, HANA DB, SolaceMichael Jackson: AI Cognitive Pipeline on SAP BTP, SAP CAP, ElevenLabs, Claude, HANA DB, SolaceA pipeline that listens to a song, identifies the historical events it references, retrieves knowledge about each and builds an emotional arc across the whole track. Not an enterprise use case, and useful precisely for that: the plumbing — CAP, HANA, Solace, Claude, ElevenLabs — is doing something the vendor demos never ask of it.Shahid, published 2026-05-18
Multi-modal RAG Proof of Concept: facilitating tech supportMulti-modal RAG Proof of Concept: facilitating tech supportA report on a customer proof of concept rather than an implementation guide — there is no code in it. The reason it is here is the architecture paragraph: CAP holds the backend and the use-case logic, the LLM plugins and the SAP Cloud SDK for AI sit inside it, and gpt-4o is one of two nodes in a small langgraph. It opens with a disclaimer that SAP's own Grounding service is due to gain multi-modal features, which dates the whole thing on purpose.maxlienhardt, published 2025-06-03
Out-of-the-Box Document Grounding in SAP AI Core: RAG with SAP Help PortalOut-of-the-Box Document Grounding in SAP AI Core: RAG with SAP Help PortalWalks through SAP AI Core's document grounding: a default 'help.sap.com' data repository that is already grounded, queried either directly through /retrieval/search after labelling a resource group for grounding, or through the orchestration service's grounding_module_config paired with llm_module_config and templating_module_config to inject the retrieved chunks into a prompt. Shows the orchestration service as a unified interface for swapping LLM providers by changing a configuration parameter rather than application code.Joni, published 2025-04-15
RAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPRAG with SAP HANA Cloud Vector Engine, GenAI Hub & CAPThe end-to-end version: a CAP service exposing the vector engine and the AI hub behind a couple of endpoints, answering where a CodeJam is on a given date. It has aged in a way the author has marked in the page itself — the section on the CAP LLM plugin now carries "(Outdated)" in its own heading — so read the embedding preparation and the retrieval shape, and check the plugin part against the package.KevinR, published 2024-05-21
Semantic search in CAP (Node.js): vector embeddings and cosine similaritySemantic search in CAP (Node.js): vector embeddings and cosine similarityFinding the best semantic match for a prompt inside an entity, using local vector embeddings and cosine similarity — and the finding the author leads with is that it works without a vector database at all. Reported as experiments rather than as a pattern, which is the honest register for it: the interesting claim is how little infrastructure the simple case needs.published 2025-12-09
Using HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPUsing HANA Cloud’s "VECTOR_EMBEDDING" Function in CAPEmbeddings generated inside the database rather than fetched from AI Core or an external model — a Q4 2024 HANA Cloud function, used from CAP. The shift it describes is where the embedding step lives, which changes what has to be deployed and what has to be called.published 2025-03-02
ABAP + MCP: Let AI Do Real Development in Your SAP SystemABAP + MCP: Let AI Do Real Development in Your SAP Systemabap-adt-mcp is an open-source MCP server that gives an AI agent full ABAP development capability over ADT: it searches, reads, edits, activates and unit-tests objects, and runs ATC checks, on a connected S/4HANA Cloud or on-premise system, acting as the signed-in developer. It runs on abap-adt-api, the same REST client Eclipse's own ADT tooling uses, and sits beside SAP's own ADT MCP Server, shipped with ADT for VS Code and Eclipse under a different server key, and marianfoo's abap-docs, a read-only server over the ABAP Keyword Documentation and Clean ABAP. Each destination carries a policy — read-only, allowed packages, denied tables and tools — the server checks before every call, and an optional audit file logs each tool call with its outcome and policy gate.Willian_Saez, published 2026-09-03
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
MCP Servers are the New Z-TablesMCP Servers are the New Z-TablesA single CAP service exposed as three overlapping MCP servers tools, queried by the same prompt nineteen times, returned the same tool every time — evidence, the author argues, that tool selection rests on the resemblance between a prompt and a tool's description rather than on any binding a where-used list could enumerate before retiring it. It contrasts that setup with @cap-js/mcp, which exposes a whole service as three generic tools instead of one per operation, and quotes the adapter's own beta documentation admitting no rate limiting, audit logging, input validation or approval workflow, and no use as a gateway to SAP Application APIs. From there it names four small Tool governance practices it has adopted: an owner recorded in the tool's own metadata, logging every invocation, deprecating inside the description, and exposing fewer tools.published 2026-08-21
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
How to implement SAP BTP Audit log service in a CAP ApplicationHow to implement SAP BTP Audit log service in a CAP ApplicationThe setup half: binding the BTP Audit Log service to a CAP application and getting the annotated path working, which is the step before anything custom becomes a question.KrishnaSharma7, published 2025-01-01
How to implement SAP BTP Audit log service in a CAP Application
@cap-js/audit-logging has been through 2 major lines since this was published: 0.9 (2025-06), 1 (2025-07). Affects A recipe.
Implementing Custom Audit Logging in SAP CAP ApplicationsImplementing Custom Audit Logging in SAP CAP ApplicationsWhere the annotations stop. CAP logs personal-data operations automatically once a model is annotated; this is about the events that are not that — an unauthorised access attempt, a business action somebody wants a trail for — and what writing those yourself involves.gopalanand, published 2025-10-09
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Introducing the Cloud Application Programming Model (CAP)Introducing the Cloud Application Programming Model (CAP)SAP's own general-availability announcement for CAP, laid out as a Golden Path: a data model and service defined in CDS gets a generated service provider that serves metadata publishing and CRUD requests, fills in primary keys and audit data, and writes trace and audit logs without application code. The same CDS model carries annotations that translate to OData vocabularies and generate a Fiori elements app skeleton, which is how Fiori annotations work in CAP.Daniel7, published 2018-06-05
Microsoft Sentinel for SAP goes agentlessMicrosoft Sentinel for SAP goes agentlessExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud Connector setup together with SAP Integration Suite: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's Destinations maintenance view, with a user authorised to call them (RFC connectivity). It also covers calling the audit log API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.published 2024-12-17
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2ABuilding a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2AThe third instalment of a three-part series deploys an already-built CAP service and LangGraph agent to SAP BTP, Cloud Foundry Runtime, wraps the agent in an A2A protocol server, and registers it with SAP Joule through a capability YAML and the @sap/joule-studio-cli, confirming the chain works end to end inside a real Joule assistant. It covers CAP's default JWT/XSUAA authentication in production, what a test deployment needs to get past it, and the cf push, mbt build and environment wiring that run both apps as separate Cloud Foundry containers. A closing section names what stays unfinished by design — a long-lived AI Core service key, no authentication on the BTP destination, no principal propagation — as the gap between this MVP and a production posture.rodfior, published 2026-08-20
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
CAPM Basics - Part 2CAPM Basics - Part 2Walks through deploying a CAP application to SAP BTP, Cloud Foundry Runtime: provisioning a SAP HANA Cloud instance and HDI container, then running cds add hana and cds add xsuaa --for production, cds build --production, and an MTA build and deploy. Tests the deployed service in Postman with an OAuth 2.0 client credentials token from the XSUAA binding (SAP Authorization and Trust Management service), explicitly leaving out any role templates or scopes.archisman92, published 2025-02-28
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Identity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesIdentity and Access Management in SAP: Navigating SSO Across Web and On-Prem LandscapesSAP Cloud Identity Services is the central identity interface for single sign-on across an SAP landscape: browser-based applications authenticate through SAML 2.0 or OpenID Connect, while applications reached over RFC rather than HTTP use Secure Login Client and Secure Login Service instead, since those web protocols do not apply there. That RFC path issues short-lived X.509 certificates from SCI-authenticated identities, carrying the same multi-factor authentication into on-premise access, with Kerberos tokens or local client certificates as alternatives.OxanaJ, published 2025-07-25
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉Proof Key for Code Exchange against Identity Authentication, revisited by the author after an earlier post on the same subject — the flow that lets a mobile or single-page client authenticate without a secret it cannot keep. Sample repository under SAP-samples.martinfrick, published 2023-09-21
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25