Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

SAP BTP Connectivity Skill · secondsky | DecimalAI

secondsky/sap-btp-connectivity

SkillScore100Maintained

SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up cloud-to-on-premise connectivity, implementing OAuth and principal propagation, deploying connectivity proxies in Kubernetes/Kyma, troubleshooting connectivity errors (405, 407, 503), or configuring multitenancy.

DevOpsby secondsky

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/secondsky-sap-btp-connectivity/SKILL.md

decimalai skills pull secondsky-sap-btp-connectivity --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/secondsky-sap-btp-connectivity/SKILL.md https://app.decimal.ai/s/secondsky-sap-btp-connectivity/SKILL.md

Raw file: /s/secondsky-sap-btp-connectivity/SKILL.md ↗ · machine-readable summary at /s/secondsky-sap-btp-connectivity.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 8d ago

—+138% tokens0% turns100% of whole cases pass with skill (22/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	57%	0%
case-02	✗→✓	▲ Improved	121%	0%
case-04	✗→✓	▲ Improved	313%	0%
case-05	✗→✓	▲ Improved	113%	0%
case-10	✗→✓	▲ Improved	307%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

secondsky / sap-skills

plugins/sap-btp-connectivity/skills/sap-btp-connectivity/SKILL.md

View on GitHub ↗

License GPL-3.0Imported 8/10/2026Version v1Bundled 18 files

Skill contents

references/

templates/

SKILL.md

SAP BTP Connectivity Skill

Related Skills

sap-btp-cloud-platform: Use for platform fundamentals, BTP account setup, and integration patterns
sap-btp-best-practices: Use for implementation guidance, security best practices, and production deployment
sap-cap-capire: Use for CAP service connectivity, destination consumption, and secure API access
sap-fiori-tools: Use for configuring Fiori app destinations and frontend connectivity
sap-abap: Use when connecting to ABAP systems via RFC or implementing principal propagation

When to Use This Skill

Use this skill when configuring BTP destinations, Cloud Connector, OAuth flows, principal propagation, RFC/LDAP/MAIL/TCP connectivity, Kubernetes/Kyma connectivity proxies, multitenant destination access, or troubleshooting connectivity errors such as 405, 407, 503, and proxy failures.

Overview
Quick Start
Connectivity Scenarios
Destination Types
Authentication Configuration
Cloud Connector Setup
Kubernetes/Kyma Connectivity
Common Issues & Troubleshooting
Security Best Practices
Critical Rules
Bundled Resources

Overview

SAP BTP Connectivity provides secure access from SAP BTP applications to remote services across cloud, on-premise, and VPC environments.

Core Components

| Component | Purpose | |-----------|---------| | Destination Service | Manages connection metadata, authentication, routing | | Connectivity Service | Enables Kubernetes workloads via Cloud Connector | | Cloud Connector | Reverse proxy for secure on-premise tunneling | | Connectivity Proxy | Kubernetes component for on-premise access | | Transparent Proxy | Kubernetes component for unified destination access |

Supported Environments: Cloud Foundry, ABAP Environment, Kyma Supported Protocols: HTTP/HTTPS, RFC, TCP (SOCKS5), LDAP/LDAPS, Mail

Quick Start

Create HTTP Destination (Cloud Foundry)

Navigate: Connectivity > Destinations in BTP Cockpit
Select: Create > From Scratch
Configure:

Name: my-destination Type: HTTP URL: https://api.example.com ProxyType: Internet Authentication: OAuth2ClientCredentials clientId: <your-client-id> clientSecret: <your-client-secret> tokenServiceURL: https://auth.example.com/oauth/token

Set Up Cloud Connector

Download from SAP Tools
Access: https://localhost:8443
Login: Administrator / manage (change immediately)
Add subaccount connection

Access Destination in Application (Node.js)

javascript
const { getDestination } = require('@sap-cloud-sdk/connectivity');
const destination = await getDestination({ destinationName: 'my-destination' });

Connectivity Scenarios

Cloud-to-Cloud

ProxyType: Internet
Authentication: OAuth2ClientCredentials | OAuth2SAMLBearerAssertion

Cloud-to-On-Premise

ProxyType: OnPremise
Authentication: BasicAuthentication | PrincipalPropagation

Requires Cloud Connector installation in on-premise network.

On-Premise-to-Cloud (Service Channels)

For on-premise systems accessing SAP BTP services via Cloud Connector.

Destination Types

| Type | Use Case | ProxyType | Common Authentication | |------|----------|-----------|----------------------| | HTTP | REST/OData APIs | Internet/OnPremise | OAuth2, Basic, Certificates | | RFC | SAP systems | OnPremise | Basic, PrincipalPropagation | | LDAP | Directory services | Internet | Basic, NoAuth | | MAIL | Email protocols | Internet | Basic, NoAuth | | TCP | Generic TCP | OnPremise | Basic |

Detailed configuration: See references/http-destinations.md, references/rfc-destinations.md, references/mail-tcp-ldap-destinations.md

Authentication Configuration

OAuth2ClientCredentials (Service-to-Service)

Authentication: OAuth2ClientCredentials
clientId: <client-id>
clientSecret: <client-secret>
tokenServiceURL: https://auth.example.com/oauth/token

OAuth2SAMLBearerAssertion (User Propagation)

Authentication: OAuth2SAMLBearerAssertion
audience: <target-audience>
clientKey: <client-key>
tokenServiceURL: https://auth.example.com/oauth2/token
KeyStoreLocation: <certificate-location>

PrincipalPropagation (On-Premise SSO)

Authentication: PrincipalPropagation
ProxyType: OnPremise

Requires Cloud Connector X.509 certificate generation.

Complete reference: references/authentication-types.md (all 17+ types)

Cloud Connector Setup

Installation

Production: Windows MSI/Linux RPM packages (service registration)
Development: Portable archive (manual execution)

Initial Configuration

Access UI: https://<hostname>:8443
Login: Administrator / manage
Change password immediately
Select mode: Master or Shadow
Add subaccount connection

Access Control

Configure on-premise resource access:

Backend Types: ABAP System, SAP Gateway, Non-SAP System, SAP HANA
HTTP Access Control: System mapping + resource paths + policies

High Availability

Master-Shadow: Primary + backup with synchronized config
Requirements: Stable network, separate machines, identical versions

Complete guide: references/cloud-connector.md

Kubernetes/Kyma Connectivity

Connectivity Proxy

Enables Kubernetes workloads to access on-premise systems.

Installation:

bash
helm install connectivity-proxy \
  oci://registry-1.docker.io/sapse/connectivity-proxy \
  --version <version> --namespace <namespace> -f values.yaml

Transparent Proxy

Exposes BTP destinations as Kubernetes Services.

Installation:

bash
helm install transparent-proxy \
  oci://registry-1.docker.io/sapse/transparent-proxy \
  --version <version> --namespace <namespace> -f values.yaml

Usage: Create Destination Custom Resource, access as Kubernetes Service.

Complete configuration: references/kubernetes-connectivity.md

Common Issues & Troubleshooting

HTTP Error Codes

| Code | Cause | Solution | |------|-------|----------| | 400 | Malformed request | Check request syntax | | 401 | Authentication failure | Verify credentials/tokens | | 405 | HTTPS instead of HTTP | Use http:// with port 20003 | | 407 | Missing authorization | Add Proxy-Authorization: Bearer <token> | | 503 | Cloud Connector offline | Check CC connection and Location ID |

Cloud Connector Issues

Cannot connect to subaccount:

Verify region host URL
Check firewall allows outbound HTTPS
Verify subaccount credentials

Access denied to resource:

Check access control configuration
Verify virtual host mapping
Check resource path policy

Complete troubleshooting: references/troubleshooting.md

Security Best Practices

Cloud Connector

Deploy in DMZ under IT control
Change default password immediately
Configure LDAP for user management
Enable audit logging (All level for production)
Deploy high availability (master + shadow)

Destinations

Use OAuth over basic authentication
Store credentials in Destination Service, not code
Enable TLS for all connections
Use mTLS for enhanced security

Critical Rules

Always Do

Change Cloud Connector default password immediately
Use HTTPS for all external connections
Configure access control before exposing resources
Enable audit logging in production
Cache tokens and destinations appropriately

Never Do

Expose Cloud Connector UI to internet
Store credentials in application code
Skip access control configuration
Modify Cloud Connector Tomcat config files
Run multiple master instances (split-brain)

Bundled Resources

Configuration References

references/http-destinations.md - Complete HTTP destination properties
references/rfc-destinations.md - RFC destination properties and pooling
references/mail-tcp-ldap-destinations.md - Mail, TCP, LDAP configuration
references/authentication-types.md - All 17+ authentication configurations

Setup & Configuration

references/cloud-connector.md - Cloud Connector setup and configuration
references/kubernetes-connectivity.md - Connectivity Proxy and Transparent Proxy
references/destination-service-api.md - REST API reference

Advanced Topics

references/advanced-configuration.md - MTA, config.json, chaining, ZTIS
references/identity-propagation-scenarios.md - ABAP, NetWeaver Java, custom IDP
references/operational-guides.md - Network zones, solution management
references/connectivity-alternatives-and-config.md - Reverse proxy, user roles, RFC config

Development & SDK

references/java-sdk-development.md - Java APIs, JCo, SAP Cloud SDK
references/mail-protocols.md - SMTP, IMAP, POP3 configuration

Templates

templates/destination-http-oauth.json - HTTP destination with OAuth template
templates/destination-onpremise.json - On-premise destination template
templates/connectivity-proxy-values.yaml - Helm values for Connectivity Proxy
templates/transparent-proxy-values.yaml - Helm values for Transparent Proxy

Documentation Links

Official SAP Documentation: https://help.sap.com/docs/connectivity
GitHub Repository: https://github.com/SAP-docs/btp-connectivity
Destination API: https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination
Release Notes: https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56

Last Updated: 2025-11-27 Next Review: 2026-02-27 Source: https://github.com/SAP-docs/btp-connectivity (383 files, 352+ analyzed)

Want to see if secondsky/sap-btp-connectivity would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/21/2026, 17:01 UTC · 22 cases

Measured on 20 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+32%

100% vs 68%

Agent turns

1.0 vs 1.0

Tokens

+138%

3,902.65 vs 1,641.95

fail → pass · 7pass → pass · 15

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-07 We need high availability for our SAP Cloud Connector instance in our production DMZ. Should we run two active Master instances sharing a virtual IP, or use a Master and Shadow architecture?	pass→pass	12,028	11,524	-4%	1	1	0%	1,907	4,335	+127%	0	0	—
case-01 We are deploying a microservice on SAP BTP Kyma runtime that needs to access a remote destination securely without hardcoding tokens in our codebase. Can you provide a guide for deploying the transparent proxy component, including the Helm command template and the Kubernetes Custom Resource manifest definition for exposing the destination locally?	fail→pass	16,531	10,143	-39%	1	1	0%	2,795	4,383	+57%	0	0	—
case-02 We are setting up Kubernetes connectivity to access our on-premise SAP ABAP backend from a Kyma cluster. What is the standard Helm command and OCI registry path to install the SAP Connectivity Proxy?	fail→pass	9,472	4,827	-49%	1	1	0%	1,585	3,510	+121%	0	0	—
case-03 When making an HTTP call through the Cloud Connector proxy interface, our Node.js app gets an HTTP 405 Method Not Allowed error on port 20003 when connecting over HTTPS. How should the URL protocol be configured when routing through this proxy port?	pass→pass	17,007	9,847	-42%	1	1	0%	2,906	4,356	+50%	0	0	—
case-04 Our custom Python container running in Cloud Foundry fails with HTTP 407 Proxy Authentication Required when attempting to reach an on-premise HTTP destination. Which authorization header must be passed to authenticate with the connectivity proxy?	fail→pass	14,538	8,185	-44%	1	1	0%	972	4,013	+313%	0	0	—
case-05 An API request to an on-premise ERP system via SAP BTP Destination Service produces an HTTP 503 Service Unavailable status code. What are the two primary Cloud Connector settings to verify?	fail→pass	10,516	7,545	-28%	1	1	0%	1,740	3,712	+113%	0	0	—
case-06 We just installed SAP Cloud Connector on a dedicated Linux server for our enterprise trial. What is the local web management URL and the initial default credentials required for first login?	pass→pass	6,794	4,233	-38%	1	1	0%	1,156	3,187	+176%	0	0	—
case-08 Configure an HTTP destination for an external REST API requiring OAuth 2.0 client credentials grant. What key property names belong in the destination configuration for the credentials and token URL?	pass→pass	6,671	5,515	-17%	1	1	0%	1,099	3,628	+230%	0	0	—
case-09 We want our Cloud Foundry application users' identity to pass through to an on-premise SAP S/4HANA system without prompting for passwords. Which Authentication and ProxyType values should be set on the destination?	pass→pass	6,297	4,837	-23%	1	1	0%	1,041	3,371	+224%	0	0	—
case-10 Our enterprise security compliance auditor requires complete request tracing through the SAP Cloud Connector in production. Which audit log level should be set in the administrator settings?	fail→pass	19,202	7,136	-63%	1	1	0%	878	3,576	+307%	0	0	—
case-11 We are using the SAP Cloud SDK in a Node.js microservice to fetch connection metadata for a destination named 'sales-api'. What function call handles this?	pass→pass	3,767	4,585	+22%	1	1	0%	627	3,328	+431%	0	0	—
case-12 When setting up an HTTP destination in BTP Cockpit to connect to a public SaaS third-party REST endpoint, what ProxyType parameter should be configured?	pass→pass	3,881	3,662	-6%	1	1	0%	547	3,124	+471%	0	0	—
case-13 We are defining an RFC destination type to invoke Remote Function Modules in our on-premise ABAP system. What ProxyType value is required for RFC destinations routed through Cloud Connector?	pass→pass	4,187	3,663	-13%	1	1	0%	668	3,192	+378%	0	0	—
case-14 Where should the SAP Cloud Connector service be deployed within our corporate network infrastructure to balance security and connectivity?	pass→pass	14,871	10,263	-31%	1	1	0%	2,200	4,266	+94%	0	0	—
case-15 We need to configure an HTTP destination for user propagation using SAML 2.0 assertions. Which Authentication type and token properties should be defined?	fail→pass	11,556	13,576	+17%	1	1	0%	1,996	4,546	+128%	0	0	—
case-16 We have a custom non-HTTP database protocol needing connectivity from Cloud Foundry to on-premise over TCP. Which proxy mechanism protocol does BTP Connectivity rely on for arbitrary TCP traffic?	pass→pass	6,495	8,965	+38%	1	1	0%	948	4,040	+326%	0	0	—
case-17 Our team wants to put client secrets directly into environment variables inside our Cloud Foundry manifest.yml for third-party API destinations. What is the recommended SAP BTP best practice for storing these credentials?	pass→pass	12,354	11,532	-7%	1	1	0%	2,155	4,512	+109%	0	0	—
case-18 Can we configure port forwarding or open a public firewall port to access the SAP Cloud Connector web administration UI directly over the public internet for remote admins?	fail→pass	10,627	16,440	+55%	1	1	0%	1,690	3,758	+122%	0	0	—
case-19 An integration flow in SAP BTP returns HTTP 401 Unauthorized when connecting to an OAuth-protected HTTP destination. What are the primary items to verify on the destination configuration?	pass→pass	13,155	11,428	-13%	1	1	0%	2,023	4,470	+121%	0	0	—
case-20 We are building a CAP application on SAP BTP and need to define a Core Data Services (CDS) schema file for a SalesOrders entity with UUID keys and managed aspects. Can you provide the CDS definition?	pass→pass	15,975	6,899	-57%	1	1	0%	1,560	3,875	+148%	0	0	—
case-21 We are building an SAPUI5 / Fiori application for inventory management. Can you provide an XML view containing a ResponsiveTable with column bindings for ProductID and Quantity?	pass→pass	10,358	6,995	-32%	1	1	0%	1,926	3,735	+94%	0	0	—
case-22 How do we assign subaccount entitlements and quota for the Destination Service and SAP HANA Cloud using the SAP BTP Command Line Interface (btp CLI)?	pass→pass	12,366	11,274	-9%	1	1	0%	2,270	4,725	+108%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +32 percentage points is the difference between those two pass rates over the 20 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 68.2%
Pass rate with the skill: 100%
Cases attempted: 22
Cases counted toward lift: 20
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/21/2026, 17:01 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We are deploying a microservice on SAP BTP Kyma runtime that needs to access a remote destination securely without hardcoding tokens in our codebase. Can you provide a guide for deploying the transparent proxy component, including the Helm command template and the Kubernetes Custom Resource manifest definition for exposing the destination locally?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run100

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+152% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 7 days ago

Other measured skills in the registry, with their headline benchmark lift.