sap-btp-cias

# SAP BTP Cloud Integration Automation Service (CIAS)

Cloud Integration Automation Service provides guided workflows to integrate SAP cloud solutions with on-premise and other SAP cloud solutions. It offers both manual task instructions and automated configuration capabilities.

## Table of Contents
- [Quick Reference](#quick-reference)
- [Core Workflows](#core-workflows)
- [Service Limitations](#service-limitations)
- [Security Architecture](#security-architecture)
- [Common Error Patterns](#common-error-patterns)
- [Support Channels](#support-channels)
- [OAuth2 API Access](#oauth2-api-access)
- [Data Protection](#data-protection)
- [Glossary](#glossary)
- [Task UI Controls Quick Reference](#task-ui-controls-quick-reference)
- [Bundled Resources](#bundled-resources)
- [Documentation Sources](#documentation-sources)

## Quick Reference

### Service Plans

| Plan | Type | Purpose |
|------|------|---------|
| **Standard** | Application | UI access for scenario planning, task monitoring, integration management |
| **OAuth2** | Service | API access for programmatic operations (required for ABAP automation) |

### Role Collections

| Role | Collection | Capabilities |
|------|------------|--------------|
| Integration Administrator | `CIASIntegrationAdministrator` | Full access: Plan for Integration, My Inbox, Monitoring; terminate scenarios |
| Integration Expert | `CIASIntegrationExpert` | My Inbox access; work on assigned tasks |
| Integration Monitor | `CIASIntegrationMonitor` | Read-only access to Scenario Execution Monitoring |

### Supported Regions

**AWS**: EU10 (Frankfurt), EU11 (Frankfurt EU Access), US10 (Virginia), AP10 (Sydney), JP10 (Tokyo), CA10 (Montreal)
**Azure**: EU20 (Netherlands), CN20 (China North 3)
**Alibaba**: CN40 (Shanghai)

## Core Workflows

### 1. Subscribe to CIAS (Standard Plan)

1. Navigate to SAP BTP Cockpit → Global Account → Subaccount
2. Go to **Services** → **Service Marketplace**
3. Filter by "Cloud Integration Automation Service"
4. Click tile → **Create** → Select **Standard** plan
5. Confirm creation
6. Access via **Instances and Subscriptions** → "Go to Application" icon

### 2. Assign Roles to Users

1. Navigate to **Security** → **Role Collections** in subaccount
2. Select role collection (e.g., `CIASIntegrationAdministrator`)
3. Click **Edit** → **Users** tab
4. Add users by email ID or login user ID
5. Save changes

> Multiple users can be assigned per role using comma-separated user IDs.

### 3. Plan Integration Scenario

1. Access CIAS application from Instances and Subscriptions
2. Open **Plan for Integration** tile
3. Browse available solutions in **Solutions** tab
4. Select scenario and scenario option
5. Choose systems for integration (by customer number)
6. Specify:
   - Target subaccount for workflow
   - SAP BTP Workflow Users (must have subaccount access)
   - Transaction name for monitoring
7. Confirm workflow generation
8. Access tasks in **My Inbox** tile

### 4. Work with Tasks (My Inbox)

1. Open **My Inbox** tile (requires Administrator or Expert role)
2. Click **Claim** to lock task for your user
3. Follow instructions in **Task Instructions** tab
4. For automation tasks: Configure parameters → Click **Execute Step**
5. Click **Task Completed** when done
6. Click **Refresh** to display next task
7. Repeat until viewing Execution Summary

### 5. Create Destination for Automation

1. In My Inbox → Confirm System Components task
2. Click **Create Destination** link
3. Configure:
   - **Name**: Valid identifier
   - **Description**: Purpose description
   - **URL**: Target system host URL
   - **Authentication**: Method + credentials
   - **Type**: HTTP (default)
4. Save configuration

> Always use HTTPS for secure communication.

### 6. Monitor Scenario Execution

1. Open **Scenario Execution Monitoring** tile (requires Administrator or Monitor role)
2. Filter workflows by status: Running, Completed, Canceled
3. View tabs: Task Details, Targets, Roles and Users, Scope, Support Information
4. Use **Terminate Execution** to remove scenarios permanently
5. Access **Logs** tab for automation execution details

## Service Limitations

- Maximum **15 active workflows** per subaccount
- No self-service data deletion (submit ticket to component `BC-INS-CIT-RT`)
- Logs retained for **90 days**
- OAuth2 certificate maximum validity: **1 year**
- Execution scope cannot be changed after confirmation
- Destination cannot be changed if already used in automation task
- Supported browsers: Google Chrome, Microsoft Edge (Chromium), Mozilla Firefox, Apple Safari (macOS)

## Security Architecture

CIAS comprises six core components:

1. **Runtime**: Backbone framework rendering integration tasks
2. **Planning**: UI for planning integration scenarios
3. **Inbox**: UI for end-user task access
4. **Monitoring**: UI for scenario implementation monitoring
5. **Managed System**: System configured during integration
6. **Automation Runtime**: Calls configuration APIs of managed systems

Security features:
- Role-based access via SAP BTP authorization framework
- XSRF protection for backend connectivity calls
- Identity provider integration (SAML assertion Name ID attribute supported)
- Credentials stored in Credential Store service (inaccessible to external parties)

## Common Error Patterns

### Empty Destination Dropdown

**Symptom**: Destination dropdown shows no options during task execution.

**Cause**: No destinations exist matching the tenant's Host Base URL.

**Solution**:
1. Create destination manually following Destination Creation steps
2. Ensure destination URL matches tenant Host Base URL exactly
3. Refresh the dropdown after creation

### Workflow Conflict Lock

**Symptom**: Cannot proceed with task; execution lock activated.

**Cause**: Multiple integration workflows exist with identical system components.

**Solutions**:
- **Proceed**: Continue without resolving (manual resolution later)
- **Terminate**: End selected conflicting instanc