Auth Studio for SAP BTP
See who can do what in your CAP app, and why a request gets 403.
A visual editor for xs-security.json, and a view of AMS policies for apps on Identity Authentication (IAS), both checked against your CAP model. Fix missing roles in a click, and paste a token to find out why a request fails.
Free and open source (Apache 2.0) · Version 0.1.0 preview, November 2026 · Made by Hemanth Kodhanda, HAVISUN Technologies
Roles live in three places that drift apart
CAP checks roles from @requires and @restrict in your .cds files. XSUAA only knows the scopes and role templates in xs-security.json, and users only get them through role collections. When the three stop matching, users get 403 or the deploy fails. Auth Studio puts them side by side.
Matches your CDS model
Every role the model checks, where it is used, and whether it has a scope, a role template and a role collection. Add what is missing one at a time or all at once.
Edits safely
Changes go through the open document, so Undo, Save and Git work as usual, and your formatting is kept. Values that mta.yaml adds at deploy are taken into account.
Explains tokens
Paste a token from a failing request to see the user, scopes, role collections, attributes and expiry, and which of your CDS roles it grants.
A visual editor for xs-security.json
Open an xs-security.json and click the shield in the editor title bar. No file yet? Auth Studio can create one from your CDS model.
Roles
Roles from the CDS model with their scope, role templates and role collections. Tick which scopes each role template grants.
Role collections
Tick which role templates each collection contains.
Attributes
The $user attributes your @restrict conditions read, and which role templates pass them on.
Settings
xsappname, tenant mode and redirect URIs, with the values mta.yaml overrides shown next to them. Prepares cf update-service for you, without running it.
Checks
Unknown references, duplicate names and names XSUAA rejects, as you type, plus the role and login checks from Deploy Doctor, with one-click fixes.
Token
Decodes a token on your machine and tells you when it comes from a different XSUAA instance, has expired or is a technical token.
AMS policies, checked against your model
CAP apps that log in with Identity Authentication give roles through Authorization Management Service (AMS) policies in .dcl files instead of xs-security.json. Open any .dcl file and click the shield.
- Roles: every role your CDS model checks, and the policies that give it, directly or by building on another policy.
- Add policy: a role no policy gives fails every request with 403. One click adds it.
cds builddoes not regenerate a policy file that already exists, so roles added later are easy to miss. - Policies and attributes: all policies by package, the attributes in
schema.dcland the CDS elements they map to. - Checks: misspelled roles, unknown policies, duplicate policies, missing attributes and a missing policy deployer, most with a one-click fix.
- IAS tokens: IAS tokens carry no roles, so Auth Studio lists, for each CDS role, the policies to assign the user.
- Syntax highlighting for
.dclfiles.
Check the whole project with Deploy Doctor
Auth Studio covers roles and login. Deploy Doctor checks the rest of the deployment too: mta.yaml, dependencies, Fiori apps and multitenancy, and explains failed deploy logs.
Tokens never leave your machine.
No telemetry and no network requests. Tokens are decoded locally and never stored or sent anywhere. The source is open under the Apache 2.0 licence.
Not covered yet: writing @requires and @restrict annotations into .cds files, editing AMS policies in a form, assigning role collections or policies to users, and CAP Java projects.
Not affiliated with or endorsed by SAP SE. SAP, SAP BTP, SAP Business Application Studio and SAP Fiori are trademarks or registered trademarks of SAP SE in Germany and other countries.
Need help with BTP security?
HAVISUN Technologies sets up roles, role collections, Identity Authentication and AMS policies for SAP BTP apps. Tell us about your project and we reply within one business day.