orkungedik/SAP-basis-dataset huggingface dataset:
## 6.1.3.5.9 Managing Security Settings
Use the SAP BTP command line interface (btp CLI) to display and update the security settings for the subaccount.
The security settings comprise configuration settings, such as information about signing keys, URLs for cross origin resource sharing or iframing, and about bindings.
For more information, see Configure Trusted Domains for Multi-Environment Subaccounts [page 2393] and Configure Token Policy for SAP Authorization and Trust Management Service [page 2394].
| Task                                         | Run the command ...          | Command help                   |
|----------------------------------------------|------------------------------|--------------------------------|
| Show the security settings of a subaccount   | btp list security/settings   | btp list secur- ity/settings   |
| Update the security settings of a subaccount | btp update security/settings | btp update se- curity/settings |
Parent topic: Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Signing Keys for Access Tokens [page 2447]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
## 6.1.3.5.10  Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service
Use the SAP BTP command line interface (btp CLI) to manage API credentials, which enable you to access the REST APIs of the SAP Authorization and Trust Management service.
If you want to access the REST APIs of SAP Authorization and Trust Management service in multi-environment subaccounts, global accounts, or directories, you must provide the required API credentials. One main use case is for customers who want to provision users including their authorizations, for example into a global account or a directory. They need credentials (with a client ID) for provisioning of users, especially when using SAP Cloud Identity Services - Identity Provisioning.
The API credentials are only passed on when they are created. They can't be retrieved later. If lost, new credentials must be generated.
See Application Security Descriptor Configuration Syntax [page 576] for the credential types and SAP Business Accelerator Hub for the APIs of the SAP Authorization and Trust Management service.
| Task                                        | Run the command ...                | Command help                            |
|---------------------------------------------|------------------------------------|-----------------------------------------|
| Create API credentials                      | btp create security/api-credential | btp create se- curity/api-cre- dentials |
| Show all API credentials                    | btp list security/api-credential   | btp list secur- ity/api-creden- tial    |
| Show details about specific API credentials | btp get security/api-credential    | btp get secur- ity/api-creden- tial     |
| Delete API credentials                      | btp delete security/api-credential | btp delete se- curity/ api.credential   |
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Signing Keys for Access Tokens [page 2447]
Managing Security Settings [page 2448]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
## 6.1.4  Account Administration Using APIs
SAP BTP provides REST APIs that enable you to perform administrative tasks on the global account, directory, and subaccount level, such as creating or updating subaccounts, monitoring usage information, managing access, and managing service resources.
## Related Information
Account Administration Using APIs of the SAP Cloud Management Service [page 2457]
Monitoring Usage Information Using APIs of the SAP Usage Data Management Service [page 2488] Accessing Administration Using APIs of the SAP Authorization and Trust Management Service [page 2495] Managing Service Resources Using the APIs of the SAP Service Manager [page 2499]
## 6.1.4.1.2 Using the Events Service APIs
The Events service provides REST APIs that collect information about events relating to account administrative operations in the microservices of the SAP Cloud Management service for SAP BTP, such as Accounts, Entitlements, Provisioning, and the SAP SaaS Provisioning service, within central and local regions.
You can filter the events by various query parameters, such as a specific time frame, event type, or the type of entity associated with the event.
You can also use the APIs to get all available event types.
Here are some examples of scenarios that can be implemented or built by reacting to account administrative events:
- A global account admin can implement an automatic tagging system for newly created subaccounts by polling for subaccount creation events, Subaccount\_Creation , from the Accounts service and then adding custom property to each one of the subaccounts according to predefined criteria.
- Set up automatic notifications when a global account admin assigns quota to subaccounts. This scenario uses the SubaccountEntitlements\_Update event from the Entitlements service.
- Send automatic alerts when a directory is deleted. This scenario uses the event AccountDirectory\_Deletion from the Accounts service.
- Use the subscription events information, SubaccountAppSubscription\_Creation , from the SAP SaaS Provisioning service, to send emails notifying when applications are subscribed to from a subaccount.
Permissions: A service instance of the SAP Cloud Management service is required. The scopes required to get the events are available for all of the plans for the SAP Cloud Management service. See SAP Cloud Management Service - Service Plans [page 2464].
For more information about permissions, see Getting an Access Token for SAP Cloud Management Service APIs [page 2459].
Base URI: https://events-service.&lt;app domain&gt;.&lt;landscape domain&gt;
## Methods
| HTTP Method   | Action          | URI                                                                              |
|---------------|-----------------|----------------------------------------------------------------------------------|
| GET           | Get events      | events-service.<app domain>.<landscape domain>/cloud- management/v1/events       |
| GET           | Get event types | events-service.<app domain>.<landscape domain>/cloud- management/v1/events/types |
## Related Information
Getting an Access Token for SAP Cloud Management Service APIs [page 2459]
## 6.1.4.1.3 Error Response Format
Describes the response format for the errors from the SAP Cloud Management service for SAP BTP.
Standard HTTP codes are used to indicate successful execution or if errors occur. The response includes additional information about the error, including an application error code and human readable error description. This example represents a common error response resulting from a failed API request.
```
HTTP/1.1 400 Bad Request { "error": { "code": 11000,
```
```
"message": "Request payload is invalid", "target": "/accounts/v1/subaccounts/125e2778-e457-4c24-9db8-e3e10a3a0ed5", "details": [ { "code": 11001, "message": "description: length must be between 0 and 255" } ] } }
```
| Parameter     | Description                                                                                                                                                                     | Type   |
|---------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| error.code    | A unique application error code. Commonvalues are listed below.                                                                                                                 | Number |
| error.message | A description of the error.                                                                                                                                                     | String |
| error.target  | The resource URL of the request.                                                                                                                                                | String |
| error.details | An array of additional error codes and descriptions with further details about the error and its root cause. If this field exists, the array will contain at least one element. | Array  |
An application error code is not necessarily coupled with a specific HTTP status code.
## Error Codes
Provides a list of error codes and the details of the errors.
| Error Code   | Description                               |
|--------------|-------------------------------------------|
| 10XXX        | Server errors                             |
| 11XXX        | General request errors                    |
| 12XXX        | General operations failures               |
| 2XXXX        | Accounts service errors                   |
| 3XXXX        | Entitlements service errors               |
| 40XXX        | Tenants operations failures               |
| 41XXX        | Environment instances operations failures |
| 42XXX        | Provisioning service errors               |
| 5XXXX        | Service Management service proxy errors   |
| 6XXXX        | Order Processing service errors           |
| 7XXXX        | CLI backend errors                        |
| 8XXXX        | Asynchronous jobs failures                |
| 9XXXX        | SaaS Provisioning service errors          |
| 10XXXX       | Events service errors                     |
## 6.1.4.1.4 Asynchronous Jobs
Describes the asynchronous calls that are supported by some functionality from the SAP Cloud Management service for SAP BTP.
When the API responds with the status code 202 , the request can be processed as an asynchronous job.
The status of the request can be fetched using the path provided in the Location header. The response of the API provided in the Location header is normally:
```
{ "status": "<IN_PROGRESS/COMPLETED/FAILED>", "description": "<meaningful description in case one needed>" }
```
##  Note
The response includes the status (always) and description (optional) fields.
For example, you can trigger a brand new job.
## 6.1.4.1.5 Rate Limiting
Describes how all API requests to the SAP Cloud Management service for SAP BTP adhere to rate limiting rules.
Every API endpoint defines its own custom rate limit rule for the number of requests per time window and per identified caller.
Authenticated requests are associated either with the authenticated username, tenant ID or with the OAuth client ID. Unauthenticated requests are associated with the originating IP address, and not the user making requests.
When the rate limit is exceeded, the client receives the HTTP 429 Too Many Requests response status code.
## Response Example
For example, if you try to perform more than five GET requests to the /accounts/v1/globalAccounts endpoint in the accounts-service in less than a three second time window, you will receive the following error:
```
HTTP/1.1 429 Too Many Requests { "error": { "code": 11006, "message": "Request rate limit exceeded.", "target": "/accounts/v1/globalAccounts", "details": [ { "code": 11007, "message": "Maximum request rate limit is <X> requests in <Y> seconds"
```
```
}
```
```
] } }
```
##  Note
- The error code for the rate limit exceeded error is always 11006 and the details contains the list of exceeded rate limit rules with the 11007 error code.
- No HTTP headers are returned to show your current rate limit status (for example, the number of requests remaining in the current rate limit window).
## 6.1.4.2 Monitoring Usage Information Using APIs of the SAP Usage Data Management Service
Provides information about using the Resource Consumption APIs of the SAP Usage Data Management service for SAP BTP for gathering, storing, and making usage information available for all services and applications in all regions in a cloud deployment. This information is for the purpose of central analysis, reporting, and license auditing.
The service accumulates the information and provides reports in SAP BTP cockpit via APIs for resource planning and cross-billing purposes.
##  Note
The SAP Usage Data Management service is not sold to SAP BTP customers as a service; however, customers can see their usage data in the cockpit, for example, in the Usage Analytics pages.
## Accessing the API
For more information about the APIs, including their specifications and endpoints, go to Resource Consumption for the list of all SAP Usage Data Management service APIs in the SAP Business Accelerator Hub.
##  Remember
To call the core platform API methods, you must obtain an access token. See Configuration for Using the Resource Consumption APIs in the SAP Business Accelerator Hub [page 2489].
Base URI: https://uas-reporting.cfapps.&lt;landscape domain&gt;/reports/v1
Your global account admin has entitled the service plan for the SAP Usage Data Management service in your subaccount. See SAP Usage Data Management Service - Service Plans [page 2492].
## Methods
| HTTP Method   | Action                                                                                                                                       | URI                     |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|
| GET           | Get the cloud credit data history for a global account.                                                                                      | /cloudCreditDetails     |
| GET           | Get monthly usage reporting data for a directory and a specified time period.                                                                | /monthlyDirectoryUsage  |
| GET           | Get monthly usage-reporting data for a global account and a specified time period.                                                           | /monthlyUsage           |
| GET           | Get usage-reporting data for a subac- count.                                                                                                 | /subaccountUsage        |
| GET           | Get monthly cost reporting data for all subaccounts for the Cloud Platform Enterprise Agreement (CPEA) con- sumption-based commercial model. | /monthlySubaccountsCost |
## Related Information
Configuration for Using the Resource Consumption APIs in the SAP Business Accelerator Hub [page 2489] SAP Usage Data Management Service - Service Plans [page 2492]
## 6.1.4.2.2 Rate Limiting Rules
API requests to the SAP Usage Data Management service for SAP BTP are subject to rate limits.
Rate limits restrict the number of requests made by a caller within a defined time period. For authenticated requests, callers are identified by the authenticated user name, the tenant ID or the OAuth client ID. For non-authenticated requests, callers are identified by the originating IP address.
When you exceed the rate limit, you receive the HTTP response status code 429 Too Many Requests .
The rate limits are:
- The rate limit per authentication token or IP is 120 requests per second.
- The maximum payload body size per request is 80 MB.
##  Example
For example, if you try to perform more than 120 GET requests to the /reports/v1/monthlyUsage endpoint in less than 1 second, you receive the following error:
```
<html> <head><title>429 Too Many Requests</title></head> <body> <center><h1>429 Too Many Requests</h1></center> <hr><center>openresty</center> </body> </html>
```
## 6.1.4.3.1 Get Access to the APIs
To enable programmatic access to the SAP Authorization and Trust Management service (XSUAA) in your global account, directory, or multi-environment subaccount, you need API credentials.
## Context
To get access to the APIs of the SAP Authorization and Trust Management service, use the SAP BTP commandline interface (btp CLI) to create API credentials. You can get API credentials that apply for the global account, directory, or subaccount.
For more information, see security/api-credential.
## Procedure
1. Log on to the SAP BTP CLI, targeting the relevant global account, directory, or subaccount.
2. Enter the following command:
btp create security/api-credential --name my-credential
You get API credentials, which enable you to access the REST APIs of the SAP Authorization and Trust Management service on Business Accelerator Hub .
The btp CLI shows the API credential as follows:
<!-- image -->
With the client ID and client secret, or certificate, you can request an access token for the APIs in the targeted global account, directory, or subaccount.
## Related Information
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
btp CLI Command Reference
## 6.1.4.4 Managing Service Resources Using the APIs of the SAP Service Manager
Use the APIs of the SAP Service Manager to work with environments, service brokers, service instances, service bindings, service plans, and service offerings.
SAP Service Manager is the central registry for service brokers and platforms in SAP BTP.
The service allows you to consume platform capabilities in any connected runtime environment, track the creation and managing of service instances, and share services and service instances between different environments.
For the list of the available APIs, see Working with SAP Service Manager APIs.
## 6.2 Administration and Operations in the Cloud Foundry Environment
Learn about the different account administration and application operation tasks which you can perform in the Cloud Foundry environment.
- Account Administration Using the SAP BTP Command Line Interface (btp CLI) [page 2401]
- Account Administration in the Cockpit [page 2205]
- Account Administration Using APIs of the SAP Cloud Management Service [page 2457]
- About Roles in the Cloud Foundry Environment [page 2510]
- Org Administration Using the Cockpit [page 2512]
- Org Management Using the SAP BTP Command Line Interface (btp CLI) [page 2502]
- Org Administration Using the Cloud Foundry CLI [page 2532]
- Application Operations in the Cloud Foundry Environment [page 2578]
- Log on with a Browser to the Cloud Foundry CLI and Service Dashboards [page 2333]
- Accessing Administration Using APIs of the SAP Authorization and Trust Management Service [page 2495]
- Audit Logging in the Cloud Foundry Environment [page 2595]
## Related Information
Cloud Foundry Environment [page 57]
Getting Started in the Cloud Foundry Environment [page 150] Development in the Cloud Foundry Environment [page 237]
## 6.2.2  About User Management in the Cloud Foundry Environment
The Cloud Foundry environment has its own store for user data within SAP BTP. Understanding the relationship between SAP BTP and the Cloud Foundry environment is useful.
All users of Cloud Foundry and SAP BTP are stored in identity providers. Both require a local copy of the users so that you can assign authorizations to those users. When a user tries to log on, the user is forwarded to the identity provider to authenticate. When you add a user as a member to an org or space, there's no check whether or not this user actually exists in the identity provider you specified.
Org members can only be added by an Org Manager . If you only have the Space Manager role, you can only add space members that are known to the org. To do that, you must first ask your Org Manager to add the users as org members with no roles.
##  Note
All org members implicitly have the Org User role.
If you're the Org Manager , you already have the authorizations to add users to the org. When you add a new user as a space member, that user is added automatically as part of the org as well.
## Cloud Foundry and Shadow Users
Whenever you add a user at the org or space level with the SAP BTP cockpit, SAP BTP also creates the user at the subaccount level, also known as a shadow user. When you use the SAP BTP cockpit to add a user, SAP BTP assigns at least one Cloud Foundry role to the user, namely Org User if you don't add any other role. SAP BTP checks for Cloud Foundry users with a role and creates corresponding shadow users at the subaccount level if no such user exists. Creating users with the Cloud Foundry CLI or Cloud Foundry APIs doesn't add any Cloud Foundry roles by default. Once you add a role to the user, the system ensures that there's a corresponding user at the subaccount level.
##  Remember
When you delete a user at the Cloud Foundry level, SAP BTP doesn't delete the corresponding shadow user at the subaccount level.
When you delete a user at the subaccount level, delete the user at the Cloud Foundry org and space levels, too. Otherwise, the system automatically creates the corresponding user at the subaccount level if the user has a Cloud Foundry role.
For more information about shadow users, see Working with Users [page 2342].
## User Provisioning
For user management of Cloud Foundry organizations, use the provisioning connectors of SAP Cloud Identity Services - Identity Provisioning. For more information, see SAP BTP Integration Scenario.
## Related Information
User and Member Management [page 121]
About Roles in the Cloud Foundry Environment [page 2510]
Add Org Members [page 2516]
Add Organization Members Using the Cloud Foundry Command Line Interface [page 2571]
Add Space Members [page 2523]
Add Space Members Using the Cloud Foundry Command Line Interface [page 2573]
## 6.2.4  Org Administration Using the Cockpit
In the Cloud Foundry environment, manage orgs, spaces and space quota plans using the SAP BTP cockpit.
In addition to global accounts and subaccounts, the Cloud Foundry environment includes another hierarchical level represented by orgs and spaces.
When you enable Cloud Foundry in a subaccount, you create a Cloud Foundry org in which you can then create multiple spaces. Each subaccount can contain only one Cloud Foundry org. There is no limit to how many spaces you can have within one org.
In the Cloud Foundry environment, you deploy applications and consume services at space level. Similar to subaccounts, spaces enable you to once again structure and sub-divide quota if you want to. You can do this by managing space quota plans.
- Managing Orgs [page 2513]
- Managing Spaces [page 2519]
- Managing Space Quotas [page 2526]
## 6.2.4.1 Navigate to Orgs and Spaces
To administer your Cloud Foundry environment, navigate to orgs, and spaces in the SAP BTP cockpit.
## Prerequisites
- Sign up for an enterprise or a trial account and receive your logon data. For more information, see Get a Free Trial [page 147] or Sign up for a Customer Account [page 148].
- Create the org or space to which you want to navigate. For more information, see Create Orgs [page 2514] and Create Spaces [page 2520].
## Procedure
| Entity You'd Like to Navigate to   | Navigation Path                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Org                                | Navigate to the subaccount that contains the Cloud Foundry org. If you've already enabled the Cloud Foundry environment in your subaccount, you see the name of your organization, the number of its spaces and members, and its API endpoint on the Overview page of your subaccount. If you haven't enabled Cloud Foundry yet, choose Enable Cloud Foundry to create a Cloud Foundry org.  Note Note that your subaccount and your org have a 1:1 relationship. They have the same name and therefore also the same navigation level in the cockpit. |
| Space                              | Navigate to the subaccount that contains the space you'd like to navigate to. 1. On the subaccount Overview page, you have table with all your spaces. Choose the space you want to navigate to. 2. In the navigation area, choose Cloud Foundry Spaces .                                                                                                                                                                                                                                                                                               |
## Related Information
Navigate in the Cockpit [page 2207]
## 6.2.4.2 Managing Orgs
In the SAP BTP cockpit, learn how to create a Cloud Foundry org, manage its members, and later delete it, if needed.
- Create Orgs [page 2514]
- Delete Orgs [page 2514]
- Managing Org Members [page 2515]
##  Note
If you work with the Cloud Foundry CLI (cf CLI), be aware that you are responsible for all actions performed using the CLI. Also, you won't always be able to mirror the same data in the SAP BTP cockpit.
## 6.2.4.2.1 Create Orgs
To enable Cloud Foundry in your subaccount, you must create an org in order to use it.
## Procedure
1. Navigate to your subaccount Overview page in the SAP BTP cockpit.
2. Choose Enable Cloud Foundry .
After you choose Enable Cloud Foundry , follow the steps provided by the wizard to complete the creation of your org.
3. Choose a plan from the drop-down list and enter a name for your org.
##  Note
Once you've created the org, you can't change its name afterwards in the SAP BTP cockpit. However, you can rename the org using the Cloud Foundry CLI (cf CLI), and the new org name will be reflected in the cockpit.
As an optional step, you can customize the instance name of your environment. Otherwise, the wizard uses the automatically generated instance name.
If you decide to enter an environment instance name of your choice, make sure that it's CLI-friendly. A CLI-friendly name is a string of up to 32 characters: alphanumeric (A-Z, a-z, 0-9), periods, underscores, and hyphens. Having a CLI-friendly name allows you to use it in btp CLI commands.
4. Choose Create .
## Related Information
Navigate to Orgs and Spaces [page 2512] Create a Subaccount [page 2249]
## 6.2.4.2.2 Delete Orgs
You can delete a Cloud Foundry org from a subaccount using the SAP BTP cockpit. Once the org is deleted, you can create a new one.
## Prerequisites
You are a global account administrator, as well as a member of the subaccount containing the org you want to delete.
##  Note
You can delete an org using only the cockpit or the btp CLI. You cannot use the Cloud Foundry CLI to perform this task.
## Procedure
1. Navigate to the subaccount containing the org.
2. Choose Disable Cloud Foundry and confirm the operation.
## Results
The org is deleted. All data in the org including spaces, applications, service instances, and member information is lost. Y ou can now choose Enable Cloud Foundry to create a new org in the subaccount.
## Related Information
Navigate to Orgs and Spaces [page 2512]
## 6.2.4.3 Managing Org Members
Learn how to add, edit, and delete org members in the SAP BTP cockpit.
- Add Org Members [page 2516]
- Edit Org Members [page 2517]
- Delete Org Members [page 2518]
## 6.2.4.3.1 Add Org Members
In the SAP BTP cockpit, add users as org members and assign roles to grant the users access to information, such as user and quota information in a Cloud Foundry org.
## Prerequisites
- You have the Org Manager role for the org in question.
##  Note
When you enable Cloud Foundry and the org is created, the Org Manager role is assigned automatically to you.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. Navigate to your subaccount in the cockpit. Make sure that Cloud Foundry is enabled. For more information, see Navigate to Orgs and Spaces [page 2512].
2. In the navigation area, choose Cloud Foundry Org Members . The screen displays all members currently assigned to the org in a list.
3. Choose Add Members .
4. Enter one or more e-mail addresses.
Use commas ( , ), spaces ( ), semicolons ( ; ), or line breaks to separate members.
5. Enter the Origin for the identity provider, which hosts the members you just added.
The default identity provider is sap.ids . For more information, see Default Identity Provider [page 2335].
If the new members are platform users from a custom identity provider, enter the origin.
Select the corresponding origin of the Identity Authentication tenant.
##  Note
The option to select an origin appears only if you have two or more identity providers.
For more information about finding the origin, see Establish Trust and Federation of Custom Identity Providers for Platform Users [page 2316].
6. Select the org roles you want to assign.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
7. Choose Add .
## Next Steps
- To change the roles of a member, see Edit Org Members [page 2517].
- To remove all the roles of a member, see Delete Org Members [page 2518]. This action removes the member from the organization and any spaces in the org.
- If the users need to view or manage applications in spaces, add the users to the relevant spaces, too. For more information, see Add Space Members [page 2523].
## Related Information
Add Organization Members Using the Cloud Foundry Command Line Interface [page 2571]
## 6.2.4.3.2 Edit Org Members
Remove existing roles or assign new roles to an org member in the SAP BTP cockpit.
## Prerequisites
- You have the Org Manager role for the org in question.
<!-- image -->
##  Note
When you enable Cloud Foundry and the org is created, the Org Manager role is assigned automatically to you.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. In the navigation area in the cockpit, choose Cloud Foundry Org Members . The screen displays all members currently assigned to the org in a list.
2. Find the org member in the list and choose  (Edit) .
3. Select or unselect the roles you want to assign or remove.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
4. Choose Save .
The changes you make to the roles of a member take effect immediately.
## Related Information
Add Org Members Using the Cockpit [page 2516] Delete Org Members Using the Cockpit [page 2518]
## 6.2.4.3.3 Delete Org Members
Delete all roles of an org member in the SAP BTP cockpit. As a consequence, the member is removed from the org and any spaces in that org.
## Prerequisites
- You have the Org Manager role for the org in question.
##  Note
When you enable Cloud Foundry and the org is created, the Org Manager role is assigned automatically to you.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. In the navigation area in the cockpit, choose Cloud Foundry Org Members . The screen displays all members currently assigned to the org in a list.
2. Find the org member in the list. To remove all the roles of that member, choose  (Delete) .
This action removes the member from the organization and any spaces in the org.
## Related Information
Managing Org Members [page 2515]
## 6.2.4.4 Managing Spaces
Learn what a Cloud Foundry space is, what type of information you will find on the Spaces page in the SAP BTP cockpit, and what you can do with or within a space.
## What Is a Space?
A space is a shared location on the platform in which you can deploy and maintain applications, and connect them to services. You can create multiple spaces within one org. There is no limit to how many spaces you can have in a single org.
By default, a space inherits the org quota. If you don't want your space to consume the entire org quota, you can use space quota instead. For more information, see Managing Space Quotas [page 2526].
## Prerequisites
If you want to see any spaces on the Spaces page in the cockpit, you must have either the Org Manager role or any one of the space roles.
The Org Manager role gives you access to all spaces in an org. A space role gives you access to a specific space.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
## What Can You Find on the Spaces Page?
To visit this page in the cockpit:
1. Navigate to a subaccount of your choice.
2. Navigate to the Cloud Foundry Spaces page.
<!-- image -->
You find the following on this page:
- A list of all spaces you have access to.
- Details about each space tile, such as:
- Number of started and stopped applications in a space
- Name of the space quota if a space quota is assigned to the space, or Org Quota if the space is currently using the org quota
To manage these settings, navigate to Cloud Foundry Space Quotas Quota Assignments . For more information, see Assign Space Quotas to Spaces [page 2530] and Edit Space Quotas [page 2531].
- Available resources such as memory and services with their upper consumption limit and current usage statuses
## What Can You Do With or Within a Space?
Here are some of the space-related actions you can do:
- Create Spaces [page 2520]
- Managing Space Members [page 2522]
- Deploy an Application [page 2580]
- Edit Spaces To edit a space, choose  (Edit) on the space tile. This option lets you change the name of the space. Org Managers and Space Managers are allowed to rename spaces.
- Delete Spaces [page 2522]
## Related Information
Org Administration Using the Cockpit [page 2512]
Org Administration Using the Cloud Foundry CLI [page 2532]
## 6.2.4.4.1 Create Spaces
Create spaces in your Cloud Foundry organization using the SAP BTP cockpit. In a space, you can deploy and maintain applications, and connect them to services.
## Prerequisites
You have a Cloud Foundry organization in your subaccount, and you have the Org Manager role in that organization.
See Create Orgs [page 2514] and About Roles in the Cloud Foundry Environment [page 2510].
## Context
There are two ways to create a space in the cockpit. The main one is to do it from the Spaces page in your subaccount. The second one is from the Overview page of your subaccount. You can choose either one of them.
## Procedure
| Create a Space from the Spaces Page                                                                                                                                                                                                                                                                                                              | Create a Space from the Subaccount Overview Page                                                                                                                                                                                                                                                                                                              |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Navigate to the subaccount that contains the Cloud Foundry organization in which you'd like to create a space. 2. Navigate to the Cloud Foundry Spaces page. 3. Choose Create Space from the top right hand-side corner of that page. 4. Enter a space name and choose the space roles you want to assign to yourself. 5. Then, choose Save . | 1. Navigate to the subaccount that contains the Cloud Foundry organization in which you'd like to create a space. 2. On the subaccount Overview page, you have a Spaces table. Choose Create Space from the top right hand-side corner of that table. 3. Enter a space name and choose the space roles you want to assign to yourself. 4. Then, choose Save . |
## Next Steps
As an optional step, you can assign space quotas to spaces. If you don't assign a space quota, the space you've just created will use the consumption limits of the org quota.
For more information, see Assign Space Quotas to Spaces [page 2530].
## Related Information
Create Spaces Using the Cloud Foundry Command Line Interface [page 2572]
## 6.2.4.4.2 Delete Spaces
Delete spaces in your Cloud Foundry org using the SAP BTP cockpit.
## Prerequisites
- You have the Org Manager role in the org from which you want to delete a space. For more information about roles and permissions, see About Roles in the Cloud Foundry Environment [page 2510].
- You've ensured that the data in the space you're going to delete is no longer needed.
##  Caution
Please be aware that you won't be able to access your SAP HANA database system if you delete a space in an organization to which an SAP HANA database system is assigned.
## Procedure
1. Navigate to Cloud Foundry Spaces in your Cloud Foundry subaccount and choose  (Delete) on the tile of the space you want to delete.
2. Confirm your change.
## Related Information
Create Spaces Using the Cockpit [page 2520]
Delete Spaces Using the Cloud Foundry Command Line Interface [page 2577]
## 6.2.4.5 Managing Space Members
Learn how to add, edit, and delete space members in the SAP BTP cockpit.
- Add Space Members [page 2523]
- Edit Space Members [page 2524]
- Delete Space Members [page 2525]
## 6.2.4.5.1 Add Space Members
You can add space members and assign roles to them at the space level in the SAP BTP cockpit.
## Prerequisites
- You have the Space Manager or Org Manager role. If you only have the Space Manager role, the users you want to add to the space must already have the Org User role. If you have the Org Manager role, you can assign space roles to users even if they're not members of the
org yet.
##  Note
When you add users who aren't yet members of an org to a space in that org, they get the Org User role by default. This makes them members of the org as well.
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. Navigate to Cloud Foundry Spaces in the SAP BTP cockpit. For more information, see Navigate to Orgs and Spaces [page 2512].
2. Choose a space to which you'd like to add members. For more information, see Navigate to Orgs and Spaces [page 2512].
3. In the navigation area, choose Space Members . The screen displays all members currently assigned to the space in a list.
4. Choose Add Members .
5. Enter one or more e-mail addresses.
Use commas ( , ), spaces ( ), semicolons ( ; ), or line breaks to separate members. The changes you make to the roles of a member take effect immediately.
6. Enter the Origin for the identity provider, which hosts the members you just added.
The default identity provider is sap.ids .
For more information, see Default Identity Provider [page 2335].
If the new members are platform users from a custom identity provider, enter the origin.
Select the corresponding origin of the Identity Authentication tenant.
For more information about finding the origin, see Establish Trust and Federation of Custom Identity Providers for Platform Users [page 2316].
7. Select the space roles you want to assign.
For more information, see About Roles in the Cloud Foundry Environment [page 2510].
8. Choose Add .
## Next Steps
You also have the following options:
- Edit Space Members [page 2524]
- Delete Space Members [page 2525]
## Related Information
Add Org Members Using the Cockpit [page 2516] Add Space Members Using the Cloud Foundry Command Line Interface [page 2573]
## 6.2.4.5.2 Edit Space Members
Remove existing roles or assign new roles to a space member in the SAP BTP cockpit.
## Prerequisites
- You have the Space Manager or Org Manager role.
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. Navigate to Cloud Foundry Spaces in the SAP BTP cockpit. For more information, see Navigate to Orgs and Spaces [page 2512].
2. Choose the space in which you'd like to edit the space roles of any of its members.
3. In the navigation area, choose Space Members . The screen displays all members currently assigned to the space in a list.
4. Choose  (Edit) .
5. Select or unselect the space roles you want to assign or remove. For more information, see About Roles in the Cloud Foundry Environment [page 2510].
## 6. Choose Save .
The changes you make to the roles of a member take effect immediately.
## Related Information
Add Space Members [page 2523] Delete Space Members [page 2525]
## 6.2.4.5.3 Delete Space Members
Delete all roles of a space member in the SAP BTP cockpit. As a consequence, the member is removed from the space.
## Prerequisites
- You have the Space Manager or Org Manager role.
- The users exist in a trusted platform identity provider. For more information, see About User Management in the Cloud Foundry Environment [page 2509].
## Procedure
1. Navigate to Cloud Foundry Spaces in the SAP BTP cockpit. For more information, see Navigate to Orgs and Spaces [page 2512].
2. Choose the space from which you'd like to remove members.
3. In the navigation area, choose Space Members . The screen displays all members currently assigned to the space in a list.
4. To remove all the roles of a member, choose  (Delete) .
This action removes the member from the space.
## Related Information
Managing Space Members [page 2522]
## 6.2.4.6 Managing Space Quotas
Learn what a space quota is, what type of information you will find on the Space Quotas page in the SAP BTP cockpit, and what you can do with a space quota in the Cloud Foundry environment.
## What Is a Space Quota?
A space quota defines the upper consumption limit for all resources in a space, such as:
- Space memory
- Route
- Service instances
- Memory per instance
- Application instances
##  Note
Assigning a space quota to a space is optional. A space without an assigned space quota shares the consumption limits defined in the org quota with all the other spaces part of the org.
When working with space quotas, keep in mind the following additional specifics:
- You can create unlimited space quotas in an organization (org), but you can assign only one space quota to a space at a time.
- If a space quota is larger than the org quota, the org quota limit is applied. Example: If you create a space quota with space memory of 2048MB but the org quota has a total memory of 1024MB, then the space is going to use the org quota instead.
- Also, you can have only one space quota named "dev" in an org, but two orgs can have two separate space quotas with the same name "dev".
- When creating a space quota, you can define whether a space quota allows you to use paid services within a space.
## Prerequisites
To create, edit, or assign space quotas in an org, you must have the Org Manager role.
## What Can You Find on the Space Quotas Page?
You can switch between the following views on this page:
- Space Quotas
<!-- image -->
You find the following in this view:
- A list of all space quotas you have created and whether they are assigned to a space.
- Details about each space quota tile related to the space, such as:
- Space Memory (MB) : T otal amount of memory
- Routes : T otal number of routes
- Service Instances : T otal number of service instances
- Paid Services : Selected if you'd like to allow the provisioning of instances of paid service plans
- App Instances : T otal number of application instances
- Memory per Instance (MB) : Maximum amount of memory an application instance can have
##  Note
The value of -1 represents an unlimited amount.
- The option to create a space quota. For more information, see Create Space Quotas [page 2528].
- The option to edit a space quota. For more information, see Edit Space Quotas [page 2531].
- The option to delete a space quota. You can delete a space quota only if it's not assigned to a space.
- Quota Assignments
<!-- image -->
You find the following in this view:
- A list of all the available spaces in the subaccount you have access to and whether they have a space quota assigned to them or if they are using the org quota instead.
- The option to  (Edit) a quota assignment.
For more information, see Assign Space Quotas to Spaces [page 2530].
## What Can You Do with a Space Quota?
- Create Space Quotas [page 2528]
- Assign Space Quotas to Spaces [page 2530]
- Edit Space Quotas [page 2531]
## Related Information
Managing Spaces [page 2519] About Roles in the Cloud Foundry Environment [page 2510]
## 6.2.4.6.1 Create Space Quotas
You can use the SAP BTP cockpit to create space quotas.
## Prerequisites
You have the Org Manager role for the org in which you want to create a space quota.
## Procedure
1. Navigate to the subaccount that contains the spaces to which you want to add quotas.
2. In the navigation menu, choose Cloud Foundry Space Quotas .
3. Choose Create Space Quota .
4. Enter a name for your space quota and add limits for the following:
- Space Memory (MB) : T otal amount of memory a space can have
- Routes : T otal number of routes
- Service Instances : T otal number of service instances
- Memory per Instance (MB) : Maximum amount of memory an application instance can have
- App Instances : T otal number of application instances
- (Optional) Allow Paid Service : Switch on if you'd like to allow the provisioning of instances of paid service plans.
<!-- image -->
## 5. Choose Create .
## Example: Creating a Space Quota in the Cockpit
<!-- image -->
## Related Information
## Entitlements and Quotas [page 117]