orkungedik/SAP-basis-dataset huggingface dataset:
## 4.1.4.2.5 Getting Support
If you have questions or encounter an issue while working with HTML5 Application Repository, there are various ways to address them.
Create an incident in the SAP Support Portal using one of the following components:
| Service                      | Component      |
|------------------------------|----------------|
| HTML5 Application Repository | BC-CP-CF-HTML5 |
| Application Router           | BC-CP-APR      |
Provide the following incident details:
## HTML5 Application Repository
Enter and attach the following to the incident;
- Subaccount HTML5 Application Repository/app-host entitlement
- Requested app-host size limit
- Upload your mtad.yaml file
- Upload your html5-app-deployer application logs (cf logs &lt;html5-app-deployerAppName&gt; --recent)
## Application Router
Enter and attach the following to the incident;
- Version
- Working with or without HTML5 Apps Repo
- Upload your Application Router xs-app.json file
- Upload your Application Router xs-security.json file or configuration
- Application Router environment (cf env &lt;approuterApp&gt; or from cockpit).
##  Note
The credentials(clientid/clientsecret) should be removed.
- Upload your Application Router logs
## Related Information
Getting Support for SAP BTP [page 3312] Troubleshooting [page 522]
## 4.1.4.2.6 Troubleshooting
A troubleshooting guide for HTML5 application repository.
## Uploading Applications
## 400: Application metadata already exists when uploading HTML5 applications
| Term     | Description                                                                                                                                                                           |
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | HTML5 Application Deployment fails with error "Application metadata for application xyz already exists."                                                                              |
| Cause    | There is already an app-host service instance that contains a manifest.json with app.id = xyz in this space it is not possible to have multiple app-hosts containing the same app.id. |
| Solution | Delete or do not deploy the old app-host instance or use another app.id in the resources folder for a new app-host.                                                                   |
## 400: Failed to run the application router after subscription; route not found
| Term     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | After subscribing to the application router using the <subdo- main>-<myapprouter>.<scp domain> format, the calling the application router fails with error "route not found".                                                                                                                                                                                                                                                                                                                |
| Cause    | In order to support subscriptions out of the box, a route with format *.<custom-domain> should be created and mapped to the application router. The * host represents a wildcard that is replaced by the actual subscriber subdomain during runtime. Without a custom domain, this type of route (wildcard host) cannot be created; only a fixed host can be used. Without a custom domain, the route format is <subdomain>-<myap- prouter>.<scp domain>. It means that you have to create a |
| Solution | In development setups, if you don't have a custom domain before subscription, then create a route with the expected subscriber subdomain.                                                                                                                                                                                                                                                                                                                                                    |
## 400: Uploading application content failed
| Term     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | When trying to upload content, it fails with error: "Upload failed".                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Cause    | One or more of the input validations performed by HTML5 application repository failed. The possible validation failures are: 1. Missing manifest.json file on the root level. 2. manifest.json app.id has invalid characters (hyphens, @, %, &, etc.). 3. manifest.json app.version is not using the following for- mat: xx.xx.xx , where x must be an integer (e.g.: -snap- shot is not supported). 4. app.id of one or more of the applications already exists in another html5-apps-repo/app-host service instance in the same space. |
| Solution | Check if one of the causes is your issue. For example, check the size of your html5-app-deployer resources folder, check manifest.json. If you are not sure if another service instance already uses your app.id, try making a small change to your app.id and deploy it again.                                                                                                                                                                                                                                                          |
## 403: App-host is being modified by another process
Term
Issue
Cause
Solution
Description
HTML5 application repository deployment fails with error
"app-host is being modified by another process."
The HTML5 application repository deployer attempts to up- load content while another deployer is also uploading con-
tent using the same app-host.
Try again after the first HTML5 application repository de- ployer has completed its upload.
## 400: Failed to retrieve xs-app.json; invalid app-host ID
| Term     | Description                                                                                                                                                                      |
|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | Serving content from the HTML5 application repository fails with error "Invalid App Host ID. Please check with business service provider if the requested App Host ID is valid". |
| Caution  | HTML5 application repository belongs to a business service and the app host ID is invalid or incompatible.                                                                       |
| Solution | Ask the business service owner to define "public" : true in the app manifest.json or wait until the HTML5 appli- cation repository is restarted.                                 |
## 403: Failed to retrieve xs-app.json; unauthorized
| Term     | Description                                                                                                                                                               |
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | Serving content from the application router fails with error "Unauthorized. Please check with the business service UI provider if the requested UI is defined as public". |
| Cause    | HTML5 application repository belongs to a business service and it is not public.                                                                                          |
| Solution | Ask the business service owner to define "public": true in the app manifest.json.                                                                                         |
## 404: Calls to service endpoints specified in an application's xs-app.json fails
| Term   | Description                                                                                                         |
|--------|---------------------------------------------------------------------------------------------------------------------|
| Issue  | You have defined routes in a UI app's local xs-app.json but calls do not get routed and instead return a 404 error. |
| Term     | Description                                                                                                                                                                                                                                                                                                     |
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Cause    | The routes in the xs-app.json file are processed top to bot- tom. If a route maps the pattern, it is picked even if a route below it is a better match. The route for the HTML5 appli- cation repository typically is a "catch all" route, and if any routes are defined below it, then they are never reached. |
| Solution | Move the route leading to the html5-apps-repo-rt to be the last entry in the xs-app.json file.                                                                                                                                                                                                                  |
## 500: Failed to retrieve xs-app.json
| Term     | Description                                                                    |
|----------|--------------------------------------------------------------------------------|
| Issue    | Serving content fails with error "Error while retrieving xsApp configuration". |
| Cause    | The HTML5 application repository is not available.                             |
| Solution | Wait until HTML5 application repository is restarted.                          |
## 500: Failed to use dynamic destination
| Term     | Description                                                                                                                                                                                                                                                                                                   |
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issue    | Serving content from the application router failed with an internal server error. In the application router application log, an error: "Destination <destinationName> is not defined as a dynamic destination in destination service, configure addi- tional property HTML5.DynamicDestination true" appears. |
| Cause    | The destination name provided on the host or path level is not defined as a dynamic destination in destination service.                                                                                                                                                                                       |
| Solution | In the additional properties section of the destina- tion section of the SAP BTP cockpit, add the HTML5.DynamicDestination property and set the value to true .                                                                                                                                               |
## 4.1.5  Consuming APIs
Discover APIs available on SAP BTP.
SAP BTP supports APIs that your applications can consume to interact, communicate, and exchange information with other applications, websites, and devices.
## SAP Business Accelerator Hub
The central repository for APIs from SAP and selected partners is the SAP Business Accelerator Hub. It contains reference documentation for a variety of REST and ODATA API packages that enable you to leverage the capabilities of SAP BTP.
For an overview of all API offerings for SAP BTP, see SAP BTPon SAP Business Accelerator Hub .
If you're looking for information on APIs for a specific service, you can also use the service catalog in the SAP Discovery Center. Click on a service tile to display the available information. If the service has APIs, you can find links to their documentation under Resources . Y ou can also check if a service is available in your region by opening the Service Plan tab.
## Related Information
## APIs [page 143]
https:/ /answers.sap.com/tags/86cfb43d-204e-485e-a52d-41d9e73a5cd8
https:/ /help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/what-is-sap-businessaccelerator-hub?version=Cloud https:/ /blogs.sap.com/tags/86cfb43d-204e-485e-a52d-41d9e73a5cd8/
## 4.1.6.1.1 Add Authentication and Functional Authorization Checks to Your Application
Learn how to create a security application descriptor file and use it to create a service instance of the Authorization and Trust Management service.
## Context
You want to protect your application resources (functionality and data) so that only authenticated and authorized business users are able to access these resources.
<!-- image -->
You declare your application security descriptor with JSON syntax and store it in a flat file on the filesystem. The standard name for this file is xs-security.json .
## Procedure
1. Create your application security descriptor ( xs-security.json ) and set the xsappname element.
The element xsappname defines a prefix for the runtime name of the application. For each tenant (subaccount), which has subscribed to the application, the XSUAA service supplies a unique tenant index for the application subscription and internally concatenates the tenant index with xsappname at runtime (see also next step).
<!-- image -->
}
## 2. Set the scopes element.
Scopes represent the API endpoints - or functions - for which access should be restricted. They're required if you want to define the functions a user is authorized to process. A scope has an arbitrary name and must be prefixed with the runtime application name to distinguish the user scopes between tenants (subaccounts) which have subscribed to the application and equally named scopes between different applications. The $XSAPPNAME dummy value is a wildcard for the application runtime name and is used to prefix the arbitrary scope names. The XSUAA service substitutes the $XSAPPNAME dummy value with the application runtime name for each of the subscribed tenants (see also step 1).
```
 Sample Code { ... "scopes"    : [ { "name"        : "$XSAPPNAME.Display", "description" : "display" }, { "name"        : "$XSAPPNAME.Edit", "description" : "edit" }, { "name"        : "$XSAPPNAME.Delete", "description" : "delete" } ], ... }
```
## 4.1.6.1.2 Propagate User Information Between Applications or Services
When a business application communicates with a service, you must decide whether you want to propagate the identity of the user that called the business application, or if a call from machine-to-machine is sufficient.
## Principal Propagation Versus Technical Communication
If the business application triggers an action of the service that should be auditable or requires that the identity of the user be known, use principal propagation. Principal propagation enables the identity of the user to be propagated from the business application to the service.
If the business application triggers an action of the service for which the identity of the user is unimportant, such as a regular clean-up task or the checking of a queue, then you can use technical communication. In technical communication, the service performs the action for the business application without knowing the identity of the user.
## Cross-Application API Calls from an External System to Applications in the Cloud Foundry Environment
If applications from an external system must make API calls to applications running in the Cloud Foundry environment, administrators must make sure that these applications can communicate with the relevant applications in the external system. In this case, the bearer assertion flow or client credentials identify the external application at the UAA, which can then issue a JSON web token. The external application can use this JSON web token when it makes the API calls to applications in the Cloud Foundry environment.
No browser is involved here. Users are propagated in the following ways:
- Using technical communication, for example, propagating scopes and authorities.
- Using a bearer assertion or client credentials (JSON web tokens) to propagate named users.
## Related Information
Principal Propagation with Tightly Coupled Developments [page 543]
Technical Communication with Tightly Coupled Developments [page 540] Principal Propagation [page 3257]
## 4.1.6.1.2.2.1  Use Foreign Scope Option for Principal Propagation with Tightly Coupled
## Developments
With foreign scope reference, configure the business application to accept new scopes for the service without having to modify the business application.
## Procedure
1. As the service developer, add the attribute granted-apps to scopes you want to share with other business applications in the scopes section of the xs-security.json for this service.
In this attribute, list the names of the applications ( xsappname ) you want to share the scope with.
<!-- image -->
In this example, we've defined two scopes, Read and Approve . Under granted-apps , we list the application names with which we want to share the Read scope. All apps listed here can consume this scope in their role templates.
<!-- image -->
You might reserve the Approve scope for a role template for the service. The approver role is only meant for administrators.
2. Create the UAA service instance for service B.
For example:
cf create-service xsuaa application servb-uaa -c /servb/security/xssecurity.json
3. In the business application, accept all foreign scope references.
```
 Sample Code { "xsappname": "appa", "tenant-mode": "shared", "description": "Application ecurity descriptor for application A", "foreign-scope-references": ["$ACCEPT_GRANTED_SCOPES"], "scopes"        : [ { "name"                 : "$XSAPPNAME.View", "description"          : "View data" } ], "role-templates": [ { "name"                 : "View", "description"          : "View data", "scope-references"     : [ "$XSAPPNAME.View" ] } ] }
```
Under foreign-scope-references , the application security descriptor accepts any and all foreign scopes that were granted to it. You can limit the references to just those applications you want to accept. For example, "$XSAPPNAME(application,servb).Read
4. Create the UAA service instance for application A.
For example:
```
cf create-service xsuaa application appa-uaa -c /appa/security/xs-security.json
```
5. Deploy the developments.
6. As an adminístrator, create a role from the role template from business application A and assign the role to a user.
Only assign the Viewer template from business application A to your test user and no templates from service B.
For more information, see Administration: Managing Authentication and Authorization.
7. As a business user, test business application A.
Your test user can use the scopes delivered from the Viewer template to access business application A or service B directly or indirectly.
## Related Information
Principal Propagation with Tightly Coupled Developments [page 543]
## 4.1.6.1.5 Retrieving Access Tokens with Mutual Transport Layer Security (mTLS)
Mutual Transport Layer Security (mTLS) is considered more secure than the combination of client ID and client secret. Unlike retrieving the access token with client ID and client secret, no secret is shared between calling application and the service instance of SAP Authorization and Trust Management service (XSUAA).
This configuration enables your application to retrieve or exchange access tokens from an instance of the SAP Authorization and Trust Management service with mTLS. When using TLS, the client verifies the identity of the OAuth server during their handshake. By using mTLS, the OAuth server also verifies the identity of the client. Calls to other services and applications with the access token use the standard OAuth protocols.
You, as a developer, have the option to have the service provide the X.509 certificate for the binding or service key or if you already have your own public key infrastructure (PKI), you can provide your own.
<!-- image -->
##  Restriction
If you use your own PKI, your certificates must be issued by certificate authorities trusted by the service.
For more information, see Binding Parameters of SAP Authorization and Trust Management Service [page 2378].
## Related Information
Enable mTLS Authentication to SAP Authorization and Trust Management Service for Your Application [page 554]
Implementing Custom Token Retrieval from SAP Authorization and Trust Management Service with mTLS [page 557]
## 4.1.6.3 Tasks On Demand
Here you can find information regarding the available extended tasks for creating authorization artifacts, as well as the process of configuring redirect URLs.
In addition, as an application developer, you may want to create role collections for immediate use. For example, to deliver role collections that administrators can use in the SAP BTP cockpit and easily assign to users in an onboarding process.
## Update a Service Instance [page 561]
You can update a service instance from the xsuaa service using the service broker.
## Sharing and Unsharing Service Instances [page 562]
You can share service instances of the SAP Authorization and Trust Management service across multiple spaces or environments. This has the advantage that you don't need to create separate service instances in multiple spaces or environments.
## Compatible Changes in the Security Descriptor File [page 563]
If you update a service instance, you can add, change, and/or delete scopes, attributes, and role templates. Whenever you change role templates, you adapt roles that are derived from the changed role template.
## Retrieve Credentials for Remote Applications [page 564]
You need to get the credentials of a service instance for an application that runs outside SAP BTP.
## Configure Redirect URLs for Browser Logout [page 566]
To avoid open redirect attacks, direct users to a safe and valid URL when they log out.
## Create Role Collections with Predefined Roles [page 569]
As an application developer, you want to create role collections for immediate use. You want to deliver role collections that administrators can use in the cockpit, and easily assign to users, for example in an onboarding process.
## Validation and Revocation of Access Tokens [page 570]
To confirm that access tokens were truly issued by the SAP Authorization and Trust Management service and are still valid, applications check the tokens for validity.
## Include Tokens from Corporate Identity Providers or SAP Cloud Identity Services in Tokens of the SAP Authorization and Trust Management Service [page 571]
In scenarios where your SAP BTP application interacts with applications that don't support tokens issued by the SAP Authorization and Trust Management service, but require a token from a corporate identity provider or SAP Cloud Identity Services, you can configure SAP Authorization and Trust Management service to include this token.
## Best Practices When Handling Access Tokens [page 574]
Calls to SAP Authorization and Trust Management service can fail for many reasons, including network latency, connection errors, service downtime, idle connections closed by routing components and so on. The following sections provide recommendations on when to retry connections and the caching of tokens.
## 4.1.6.3.1 Update a Service Instance
You can update a service instance from the xsuaa service using the service broker.
## Context
You are running a service instance that grants user access to an application. It uses the security descriptor file xs-security.json . If you change properties, for example, you want to reflect the compatible changes you made in the xs-security.json file in an existing service instance.
<!-- image -->
## Restriction
If you define or update role templates and attributes in the xs-security.json file, observe the following configuration restrictions in Relationship Between default-values of attribute-references and valueRequired .
## Procedure
1. Edit the xs-security.json file and make your changes in the security descriptors.
2. Update the service instance. During the update, you use the security descriptors you changed in the xs-security.json file.
cf update-service &lt;service\_instance\_name&gt; -c xs-security.json
##  Example
cf update-service authorizationtest-uaa -c xs-security.json
## 4.1.6.3.2 Sharing and Unsharing Service Instances
You can share service instances of the SAP Authorization and Trust Management service across multiple spaces or environments. This has the advantage that you don't need to create separate service instances in multiple spaces or environments.
- You must have the Subaccount Service Administrator role collection in the specified subaccount. Use the SAP BTP cockpit to assign this role collection (see Assigning Role Collections to Users or User Groups [page 2354].)
Using the SAP BTP command line interface (btp CLI), you can share service instances across spaces or environments (for example, Cloud Foundry and Kubernetes). Shared service instances don't have the same credential. The client ID can be the same or different. Sharing service instances is possible with service instances of the application and broker plan.
##  Note
It depends on the specific service whether sharing and unsharing servivc instances is available.
##  Restriction
You can only share service instances in the same subaccount.
For more information, see btp share services/instance and btp unshare services/instance.
## 4.1.6.3.3 Compatible Changes in the Security Descriptor File
If you update a service instance, you can add, change, and/or delete scopes, attributes, and role templates. Whenever you change role templates, you adapt roles that are derived from the changed role template.
Compatible Changes in xs-security.json
| Security Artifacts in the xs-secur- ity.json File   | Action                                                                                                                                                                                                       |
|-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Scope                                               | • Add • Delete • Change • description • granted-apps                                                                                                                                                         |
| Attribute                                           | • Add • Delete • Change • description                                                                                                                                                                        |
| Role template                                       | • Add • Delete • Change • description • scope-references • attribute-references (can be deleted only)                                                                                                        |
|                                                     |  Restriction When you define or update role templates and attributes, observe the follow- ing configuration restrictions in Relationship Between default-values of attribute-references and valueRequired . |
## 4.1.6.3.6 Create Role Collections with Predefined Roles
As an application developer, you want to create role collections for immediate use. You want to deliver role collections that administrators can use in the cockpit, and easily assign to users, for example in an onboarding process.
## Prerequisites
- You have the Space Developer role in this subaccount (see the related link).
## Context
You define the role collections in the application security descriptor file ( xs-security.json ). These role collections reference role templates. As soon as you've deployed your application, the cockpit displays the role collections. They contain predefined roles.
## Procedure
1. Deploy an application you want to use for creating security artifacts.
2. Edit the application descriptor file ( xs-security.json ) and add the role-collections property. For more information, see Application Security Descriptor Configuration Syntax [page 576].
```
 Sample Code { "role-templates": [ { "name": "Viewer", "description": "View Users", "scope-references": [ "$XSAPPNAME.Display" ] }, { "name": "Manager", "description": "Maintain Users", "scope-references": [ "$XSAPPNAME.Display", "$XSAPPNAME.Update" ] } ], "role-collections": [ { "name": "UserManagerRC", "description": "User Manager Role Collection", "role-template-references": [ "$XSAPPNAME.Viewer",
```
```
"$XSAPPNAME.Manager" ] } ] }
```
3. Go to the folder where the application security descriptor ( xs-security.json ) file is stored.
4. To deploy the security information, create a service using your xs-security.json file.
5. (If you do not use a manifest file) Bind your application to the service.
```
cf create-service xsuaa application <service_name> -c xs-security.json
```
```
 Example cf create-service xsuaa application rolecoll-serv -c xs-security.json
```
cf bind-service &lt;application\_name&gt; &lt;service\_name&gt;
<!-- image -->
You have created a role collection that is visible in the cockpit. It contains predefined roles. Using the cockpit, administrators can assign this role collection to users.
## Related Information
About Roles in the Cloud Foundry Environment [page 2510]
```
Adding Authentication and Authorization [page 530] Deploy Business Applications in the Cloud Foundry Environment [page 742] Mapping Role Collections [page 2358] Tutorials for the SAP Authorization and Trust Management Service [page 558] Application Security Descriptor Configuration Syntax [page 576]
```
## 4.1.6.4 Reference Information
Use additional reference information such as the syntax required to set the properties and values defined in the application security descriptor file.
You can also authenticate Node.js applications. A collection of Node.js packages developed by SAP is provided as part of the Cloud Foundry environment at SAP BTP
Application Security Descriptor Configuration Syntax [page 576]
The syntax required to set the properties and values defined in the xs-security.json application security descriptor file.
Client Libraries for SAP BTP Security Services [page 594]
We provide client libraries to simplify your consumption of our services.
## 4.1.6.4.2 Client Libraries for SAP BTP Security Services
We provide client libraries to simplify your consumption of our services.
## List of Client Libraries
Client Libraries for SAP BTP Security Services
| Library                                                 | Description                                                                                                                                                                                                                                                          | Link                                                                             |
|---------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|
| SAP BTP Security Services Node.js In- tegration Library | This module allows Node.js applications to authenticate users with JWT tokens issued by SAP BTP security services (SAP Cloud Identity Services and SAP Authorization and Trust Management Service). It also provides an API for fetching tokens from these services. | https:/ /npmjs.com/package/@sap/ xssec                                           |
| @sap/ams-dev                                            | This is the Node.Js runtime library used to perform authorization checks in ap- plications which authenticate users via the SAP Cloud Identity Services.                                                                                                             | https:/ /www.npmjs.com/package/ @sap/ams                                         |
| SAP BTP Security Services Java Inte- gration Libraries  | This repository offers a comprehen- sive set of libraries designed to sim- plify the integration of SAP BTP se- curity services (SAP Cloud Identity Services and SAP Authorization and Trust Management Service).                                                    | https:/ /github.com/SAP/cloud-secur- ity-services-integration-library/tree/ main |
| sap-xssec                                               | Learn how to validate OAuth tokens us- ing a Python library. Use this library to add authentication in your Python ap- plication.                                                                                                                                    | https:/ /github.com/SAP/cloud-py- sec                                            |
|                                                         |  Note This library isn't part of an SAP BTP license. However, it belongs to a re- lated open source project.                                                                                                                                                        |                                                                                  |
## 4.1.7  Setting Up Database Artifacts
Learn how to set up database artifacts using SAP HANA.
SAP HANA is an innovative in-memory relational database management system that you can leverage when developing in the SAP BTP, Cloud Foundry environment. It minimizes data movements by making it possible for you to work with the data directly in memory.
With SAP HANA, you can leverage current hardware capabilities to increase performance and reduce costs, for example by building applications that integrate the business control logic and database layer.
<!-- image -->
In the Cloud Foundry environment, the SAP HANA database supports up to 1,000 simultaneous connections per database.
We recommend using SAP HANA Cloud when following a multitarget application (MTA) approach.
To find out more about the tools, data modeling strategy, and development scenarios, see Developing SAP HANA in the Cloud Foundry Environment [page 595].
## 4.1.7.1.1 SAP HANA Cloud
This section is a quick introduction to the latest SAP HANA offering on SAP BTP, Cloud Foundry environment. In essence, you get to know the most important tools and information about data modeling. This content is meant to provide an overview. Please follow the links to the content you're interested in and start your learning journey.
## Tools
There are two tools you need to know, SAP Business Application Studio and SAP HANA Cockpit.
- SAP Business Application Studio SAP Business Application Studio is the recommended tool to develop your SAP HANA database artifacts. You can use an SAP HANA Native Application dev space, which is preconfigured to support the creation of database artifacts. For SAP Cloud Application Programming Model projects, we recommend to create a Full Stack Cloud Application dev space and add the following extensions:
- SAP HANA Calculation View Editor
- SAP HANA Tools
- SAP HANA Smart Data Integration Tools
<!-- image -->
With that configuration you have the editors and tools for the programming model and SAP HANA database artifacts.
- SAP HANA Cockpit
The SAP HANA Cockpit is used to monitor and administer your SAP HANA instances, see Open the SAP HANA Cockpit
To learn how to access the SAP HANA Cockpit, see Accessing SAP HANA Cockpit for SAP HANA Cloud
## Data Modeling
To develop your data model, we recommend the SAP Cloud Application Programming Model.
- The SAP Cloud Application Programming Model (CAP) provides a guide explaining the concepts and best practices of domain modeling using CAP CDS, see Domain Modeling
- To define your data models, queries and expressions, there's a CAP CDS reference guide. It contains samples and best practices that support your learning journey. See Core Data Services (CDS) - Language Reference Documentation for the application programming model .
- You have existing database objects and want to use them with CAP CDS. Learn about facade entities in CAP CDS and how to design them. See Native SAP HANA .
When you've created your data model with the SAP Cloud Application Programming Model, you want to leverage more of the SAP HANA power. The SAP HANA Cloud documentation provides an extensive library of guides. Find here selected links that make an easy start.
- SAP HANA Cloud Modeling Guide for SAP Web IDE Full-Stack
- SAP HANA Cloud product page, development overview
## References
- SAP HANA Cloud product page on the Help Portal
- Feature Scope Description for SAP HANA Cloud
## 4.1.8  Deploying to the Cloud Foundry Environment
Get an overview of available deployment options.
When deploying applications and services to the cloud, you can choose from a number of different approaches and tools, depending on your development setup.
## Multitarget Applications
If you've decided to develop your application or service with the multitarget approach, you can deploy it to SAP BTP using a single .mtar archive file. For more information, see Multitarget Applications in the Cloud Foundry Environment [page 598].
## Continuous Integration and Delivery
Continuous Integration and Delivery (CI/CD) are two interrelated concepts that can enhance your development process by adding frequent integration, automated testing, and faster delivery. For more information, see Continuous Integration and Delivery [page 739] .
## Cloud Foundry Command Line Interface
If you prefer to develop on your local machine, you can deploy your application from the folder on your computer directly to SAP BTP using the Cloud Foundry Command Line Interface (CF CLI). For more information, see Deploy Business Applications in the Cloud Foundry Environment [page 742].
## SAP BTP Cockpit
You can also deploy your application with or without a manifest.yml file using the SAP BTP cockpit. For more information, see Deploy an Application [page 2580].
## Docker Images
If you want a higher degree of freedom when realizing your project, you can also deploy your applications and services using Docker images and the Cloud Foundry Command Line Interface (CF CLI). Note that Docker images can't be used in combination with buildpacks. For more information, see Deploy Docker Images in the Cloud Foundry Environment [page 743].
## 4.1.8.1.2 Getting Started
To learn how to deploy a simple multitarget application (MTA) to SAP Business Technology Platform, Cloud Foundry environment using the MultiApps CF CLI Plugin, you can follow the steps in the tutorial Deploy Your First Multitarget Application .
If you want to see more MTA examples, see CF MTA Examples on GitHub.
## 4.1.8.1.3 Defining Multitarget Application Development Descriptors
Multitarget Applications are defined in a development descriptor required for design-time purposes.
The development descriptor ( mta.yaml ) defines the elements and dependencies of a Multitarget Application (MTA) compliant with the Cloud Foundry environment.
##  Note
The MTA development descriptor ( mta.yaml ) is used to generate the deployment descriptor ( mtad.yaml ), which is required for deploying an MTA to the target runtime. If you use command-line tools to deploy an MTA, you do not need an mta.yaml file. However, in these cases you have to manually create the mtad.yaml file.
For more information about the MTA development descriptor, see Defining Multitarget Application Deployment Descriptors for Cloud Foundry.
## Related Information
Developing Multitarget Applications
## 4.1.8.1.5 Defining Multitarget Application Deployment Descriptors for Cloud Foundry
The Multitarget Application (MTA) deployment descriptor is a YAML file that defines the relations between you as a provider of deployable artifacts and the SAP Cloud Deployment service in SAP BTP as a deployer tool.
Using the YAML data serialization language you describe the MTA in an MTA deployment descriptor ( mtad.yaml ) file following the Multitarget Application Structure [page 612].
##  Note
As there are technical similarities between SAP HANA XS Advanced and Cloud Foundry, you can adapt application parameter for operation in either platform. Note that each environment supports its own set of module types, resource types, and configuration parameters. For more information, see the official specification documents The Multitarget Application Model v.2 and The Multitarget Application Model v.3.
## Schema Store
Writing YAML descriptors in plain text is often hard, so we have contributed a schema to the public Schema Store. This would provide you with an almost out-of-the-box support when writing MTA deployment descriptors in some of the more popular IDEs. The schema would provide you with auto-completion as well as suggestions and syntax checking.
For more information, see Editor Schema Support .
## 4.1.8.1.6 Multitarget Application Structure
The following chapter contains information about:
- Global elements - an identifier and version that uniquely identify the MTA, including additional optional information such as a description, the providing organization, and a copyright notice for the author.
- Modules [page 625] - the deployable parts contained in the MTA deployment archive, most commonly Cloud Foundry applications or content.
- Resources [page 613] - they contain properties of resource types, which are entities not part of an MTA, but required by the modules at runtime or at deployment time.
- Dependencies between modules and resources.
- Parameters - variables which belong to a module or a resource, whose value is used during the deployment or at runtime. For more information, see Parameters and Properties [page 653].
- Properties - these result in the application environment variables that have to be available to the respective module at runtime. For more information, see Parameters and Properties [page 653].
- Technical configuration parameters, such as URLs, and application configuration parameters such as environment variables. For more information, see Parameters and Properties [page 653].
- Metadata - provide additional information about the declared parameters and properties. For more information, see Metadata for Properties and Parameters [page 665].
- Module Hooks [page 649] - use hooks to change the typical deployment process, for example to set them to be executed before or after the actual deployment steps for a module.
- If needed, use alternative arrangement of the properties' syntax. For more information see Parameters and Properties [page 653].
## 4.1.8.1.6.5  Metadata for Properties and Parameters
It is possible to declare metadata for parameters and properties defined in the MTA deployment description, for example, using the ' parameters-metadata: ' or ' properties-metadata: ' keys, respectively; the mapping is based on the keys defined for a parameter or property.
You can specify if a property is required ( optional; false ) or can be modified ( overwritable: true ), as illustrated in the following (incomplete) example:
The overwritable: and optional keywords are intended for use in extension scenarios, for example, where a value for a parameter or property is supplied at deployment time and declared in a deployment-extension descriptor file ( myMTADeploymentExtension.mtaext ).
You can declare metadata for the parameters and properties that are already defined in the MTA deployment description. However, any parameters or properties defined in the mtad.yaml deployment descriptor with the metadata value overwritable: false cannot be overwritten by a value supplied from the extension descriptor. In this case, an error would occur in the deployment.
##  Tip
Parameters or properties can be declared as sensitive. Information about properties or parameters flagged as sensitive is not written as plain text in log files; it is masked, for example, using a string of asterisks ( ******** ). Note the secret\_token: element in the example.
##  Code Syntax Metadata for MTA Deployment Parameters and Properties modules: - name: frontend type: javascript.nodejs parameters: memory: 128M domain: ${default-domain} parameters-metadata: memory: optional: true overwritable: true domain: overwritable: false properties: secret\_token: ${generated-password} backend\_types: order\_management: sap-erp data\_warehouse: sap-bw
## 4.1.8.1.8 SAP Business Technology Platform Capabilities
This section contains information about how to manage standard Cloud Foundry entities with MTA modelling.
- Applications [page 670]
- Tasks [page 674]
- Services [page 675]
- Routes [page 686]
## 1. Operation parameters / Command-Line Options (Highest Priority):
The highest priority is given to operation parameters passed during the MTA deployment. If you provide a timeout value as a command-line option, it overrides any other parameters defined into the MTA descriptor. These operation parameters apply to all applications.
```
 Example cf deploy … --apps-upload-timeout 40 -apps-upload-timeout 50 --apps-starttimeout 30 -apps-task-execution-timeout 100
```
## 2. Module-Level Parameters:
If you do not provide any command-line arguments, the module-level parameters are used instead.
<!-- image -->
## 3. Global-Level Parameters:
If neither a command-line option nor a module-level parameter are provided, the global parameters are used. Global parameters are applicable to all applications.
<!-- image -->