Joule Deployment & Configuration Center

# ── 1. Assign Joule entitlement in Global Account ──────────────────
btp assign accounts/entitlement \
  --to-subaccount <SUBACCOUNT_GUID> \
  --for-service joule \
  --plan standard \
  --amount 1

# ── 2. Subscribe to Joule in the subaccount ────────────────────────
btp subscribe accounts/subaccount \
  --subaccount <SUBACCOUNT_GUID> \
  --to-app joule-standard-tenant-subscription \
  --plan standard

# ── 3. Assign Joule_User role collection to a user ─────────────────
btp assign security/role-collection "Joule_User" \
  --to-user user@example.com \
  --of-type user \
  --subaccount <SUBACCOUNT_GUID>

# ── 4. Verify subscription status ─────────────────────────────────
btp list accounts/subscription \
  --subaccount <SUBACCOUNT_GUID> \
  | grep -i joule

{
  "Name": "S4HANA_SYSTEM",
  "Type": "HTTP",
  "URL": "https://my-s4hana.example.com",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "ProxyType": "OnPremise",
  "Description": "S/4HANA backend for Joule principal propagation",
  "audience": "https://my-s4hana.example.com",
  "authnContextClassRef": "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession",
  "clientKey": "<OAUTH_CLIENT_ID>",
  "tokenServiceURL": "https://<IAS_TENANT>.accounts.ondemand.com/oauth2/token",
  "sap-client": "100",
  "HTML5.DynamicDestination": "true",
  "WebIDEEnabled": "true",
  "WebIDEUsage": "odata_abap"
}

{
  "skillId": "com.acme.procurement.order-status",
  "version": "1.0.0",
  "displayName": "Check Purchase Order Status",
  "description": "Retrieves the current status and details of a purchase order by number",
  "actions": [
    {
      "id": "getPurchaseOrderStatus",
      "type": "REST",
      "destination": "S4HANA_SYSTEM",
      "path": "/sap/opu/odata4/sap/api_purchaseorder_2/srvd_a2x/sap/api_purchaseorder_2/0001/A_PurchaseOrder",
      "method": "GET",
      "parameters": [
        {
          "name": "$filter",
          "value": "PurchaseOrder eq '{purchaseOrderNumber}'"
        },
        {
          "name": "$select",
          "value": "PurchaseOrder,OrderStatus,NetOrderAmount,DocumentCurrency,Supplier,CreationDate"
        }
      ],
      "principalPropagation": true
    }
  ],
  "requiredParameters": [
    {
      "name": "purchaseOrderNumber",
      "type": "string",
      "description": "SAP purchase order number (10 digits)"
    }
  ]
}

service JouleActionsService @(requires: 'authenticated-user') {
  action getPurchaseOrderStatus(purchaseOrderNumber: String)
    returns {
      PurchaseOrder:    String;
      OrderStatus:      String;
      NetOrderAmount:   Decimal;
      DocumentCurrency: String;
      Supplier:         String;
      CreationDate:     Date;
    };
}

const cds = require('@sap/cds')

module.exports = cds.service.impl(async function (srv) {
  // Connects via the BTP Destination 'S4HANA_SYSTEM'
  // Principal propagation forwards the logged-in user's JWT
  const S4 = await cds.connect.to('S4HANA_SYSTEM')

  srv.on('getPurchaseOrderStatus', async (req) => {
    const { purchaseOrderNumber } = req.data

    const result = await S4.run(
      SELECT.one
        .from('API_PURCHASEORDER_2.A_PurchaseOrder')
        .where({ PurchaseOrder: purchaseOrderNumber })
        .columns('PurchaseOrder', 'OrderStatus', 'NetOrderAmount',
                 'DocumentCurrency', 'Supplier', 'CreationDate')
    )

    if (!result) {
      req.error(404, `Purchase order ${purchaseOrderNumber} not found`)
    }

    return result
  })
})

{
  "cds": {
    "requires": {
      "S4HANA_SYSTEM": {
        "kind": "odata-v4",
        "model": "srv/external/API_PURCHASEORDER_2",
        "[production]": {
          "credentials": {
            "destination": "S4HANA_SYSTEM",
            "path": "/sap/opu/odata4/sap/api_purchaseorder_2/srvd_a2x"
          }
        }
      }
    }
  }
}

{
  "skillId": "com.acme.hr.leave-request",
  "version": "1.0.0",
  "displayName": "Submit Leave Request",
  "description": "Creates a new leave request workflow in SAP Build Process Automation",
  "actions": [
    {
      "id": "createLeaveRequest",
      "type": "REST",
      "destination": "SBPA_API",
      "path": "/workflow/rest/v1/workflow-instances",
      "method": "POST",
      "headers": {
        "Content-Type": "application/json"
      },
      "body": {
        "definitionId": "leave-request-workflow",
        "context": {
          "employeeId": "{employeeId}",
          "leaveType": "{leaveType}",
          "startDate": "{startDate}",
          "endDate": "{endDate}",
          "reason": "{reason}"
        }
      },
      "principalPropagation": true
    }
  ]
}

{
  "name": "JouleAIUnitThreshold",
  "description": "Alert when AI Units exceed 80% of allocation",
  "condition": {
    "propertyKey": "aiUnitsConsumedPercent",
    "predicate": "GREATER_THAN",
    "propertyValue": "80"
  },
  "actions": [
    {
      "type": "EMAIL",
      "destination": {
        "name": "OpsTeamEmail"
      }
    },
    {
      "type": "SLACK",
      "destination": {
        "name": "OpsSlackChannel"
      }
    }
  ]
}

# ── S/4HANA Diagnostic Transactions ──────────────────────────────

# Check authentication events (IAS SAML assertions)
Transaction: SM21
Filter:      Message class = SAML, Level = Error/Warning

# Check authorization failures for Joule backend calls
Transaction: SU53
User:        <joule-user-email>
Shows:       Last failed authorization check (object, field, value)

# Verify IAS trust configuration
Transaction: SAML2
Shows:       All configured SAML identity providers; check IAS entry

# Test user exists and has correct role in S/4HANA
Transaction: SU01D
User:        <email-from-IAS>
Tab:         Roles — verify Joule business role assigned

# Check Fiori LP tile catalog assignment
Transaction: /n/UI2/FLPD_CUST
Shows:       Catalog assignments; search for JOL catalog

# Check Joule subscription status
btp list accounts/subscription \
  --subaccount <SUBACCOUNT_ID>

# Verify role collection assignments
btp list security/role-collection \
  --subaccount <SUBACCOUNT_ID> | grep -i joule

# Check destination connectivity
btp list connectivity/destination \
  --subaccount <SUBACCOUNT_ID>

# View IAS trust configurations
btp list security/trust \
  --subaccount <SUBACCOUNT_ID>

# Check recent audit log entries (SAP Audit Log Service)
btp list auditlog/security-events \
  --subaccount <SUBACCOUNT_ID> \
  --from "2025-01-01T00:00:00Z"