Sap Btp Service Manager

SAP BTP Service Manager Skill

Related Skills

• sap-btp-cloud-platform: Use for platform fundamentals, service understanding, and BTP integration
• sap-btp-best-practices: Use for production deployment patterns and service management guidelines
• sap-btp-connectivity: Use for destination configuration when services require connectivity setup
• sap-cap-capire: Use for CAP service provisioning and binding management

Comprehensive skill for managing services across SAP BTP environments using SAP Service Manager.

---

Table of Contents

• When to Use This Skill
• Quick Start
• Core Concepts
• Cloud Foundry Operations
• Kubernetes Operations
• SMCTL CLI Reference
• API Reference
• Bundled Resources

When to Use This Skill

Use this skill when working on tasks involving:

Service Instance Management:

• Creating service instances in Cloud Foundry, Kyma, Kubernetes, or other environments
• Provisioning services via SAP BTP cockpit, SMCTL CLI, or BTP CLI
• Configuring service parameters and labels
• Deleting service instances and managing lifecycle

Service Binding Management:

• Creating bindings to deliver credentials to applications
• Binding service instances to Cloud Foundry applications
• Creating service keys for external client access
• Managing Kubernetes ServiceBinding CRDs

Platform & Broker Management:

• Registering platforms (OSBAPI-enabled systems)
• Registering service brokers
• Managing broker catalogs and offerings
• Updating and deleting platform/broker registrations

Authentication & Authorization:

• Configuring OAuth2 client credentials
• Working with X.509 certificate authentication
• Assigning Subaccount Service Administrator role
• Managing service manager plans and scopes

Kubernetes/Kyma Integration:

• Setting up SAP BTP Service Operator
• Creating ServiceInstance and ServiceBinding CRDs
• Migrating from Service Catalog (svcat) to SAP BTP Service Operator
• Installing cert-manager for operator communication

API & CLI Operations:

• Using SMCTL command-line interface
• Using BTP CLI for service management
• Working with Service Manager REST APIs
• Filtering and querying service resources

Troubleshooting:

• Debugging service provisioning failures
• Resolving binding credential issues
• Handling rate limiting (HTTP 429)
• Checking async operation status

---

Quick Start

1. Install SMCTL CLI

⚠️ Important: The SMCLI repository was archived on September 30, 2025. While the tool remains functional, consider migration strategies for long-term SAP BTP workflows.

Recommended Method (Go):

# Install via Go (preferred approach)
go install github.com/Peripli/service-manager-cli@latest

# Add to PATH (if not already)
export PATH=$PATH:$(go env GOPATH)/bin
smctl --version

Alternative Method (Prebuilt Binary):

# Download from: https://github.com/Peripli/service-manager-cli/releases/latest
tar -xzf smctl-*.tar.gz && chmod +x smctl
sudo mv smctl /usr/local/bin/ && smctl --version

Note: While the prebuilt binary method remains functional, the Go installation approach is officially recommended. Consider evaluating SAP's native BTP CLI as an alternative for new deployments.

2. Login

# Interactive login
smctl login -a https://service-manager.cfapps.<region>.hana.ondemand.com \
  --param subdomain=<subdomain>

# Client credentials
smctl login -a https://service-manager.cfapps.<region>.hana.ondemand.com \
  --param subdomain=<subdomain> --auth-flow client-credentials \
  --client-id <id> --client-secret <secret>

3. Basic Operations

# Browse services
smctl marketplace

# Create instance (async)
smctl provision my-instance <service> <plan>

# Create binding
smctl bind my-instance my-binding

---

Core Concepts

Service Manager Architecture

SAP Service Manager is the central registry for service brokers and platforms in SAP BTP.

Primary Resources:

• Platforms - OSBAPI-enabled systems where applications run
• Service Brokers - Intermediaries advertising service catalogs
• Service Instances - Individual service instantiations
• Service Bindings - Access credentials for instances
• Service Plans - Capability sets offered by services
• Service Offerings - Service advertisements from brokers

Service Manager Plans

Roles

• Subaccount Service Administrator - Full CRUD on resources
• Subaccount Service Viewer - Read-only access (Feature Set B)

---

Cloud Foundry Operations

Service Instance & Binding

Via Cockpit: Services > Instances > Create > Select service/plan > Cloud Foundry runtime

Via CF CLI:

# Create instance
cf create-service <service> <plan> <instance-name>

# Bind to app
cf bind-service <app-name> <instance-name>

# Create service key (external access)
cf create-service-key <instance-name> <key-name>

---

Kubernetes Operations

Prerequisites

• Kubernetes cluster with kubectl v1.7+
• Helm v3.1.2+
• SMCTL v1.10.1+

Setup Service Operator

1. Install cert-manager:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml

2. Create Service Manager resources:

smctl provision sm-operator service-manager service-operator-access --mode sync
smctl bind sm-operator sm-operator-binding --mode sync
smctl get-binding sm-operator-binding -o json

3. Deploy operator:

helm repo add sap-btp-operator https://sap.github.io/sap-btp-service-operator/
helm install sap-btp-operator sap-btp-operator/sap-btp-operator \
  --namespace sap-btp-operator --create-namespace \
  --set manager.secret.clientid=<id> \
  --set manager.secret.clientsecret=<secret>

Create Resources

ServiceInstance:

apiVersion: services.cloud.sap.com/v1alpha1
kind: ServiceInstance
metadata:
  name: my-service-instance
spec:
  serviceOfferingName: <service-offering>
  servicePlanName: <plan-name>

ServiceBinding:

apiVersion: services.cloud.sap.com/v1alpha1
kind: ServiceBinding
metadata:
  name: my-binding
spec:
  serviceInstanceName: my-service-instance

Reference: See references/kubernetes-operator.md for complete guide.

---

BTP CLI Operations

Alternative to SMCTL using the unified BTP CLI:

# Create instance
btp create services/instance \
  --subaccount <subaccount-id> \
  --service <service-name> \
  --plan <plan-id> \
  --parameters '{"key":"value"}' \
  --labels '{"env":["dev"]}'

# Get instance details
btp get services/instance <instance-id> \
  --subaccount <subaccount-id> \
  --show-parameters

# Create binding
btp create services/binding \
  --subaccount <subaccount-id> \
  --binding <binding-name> \
  --service-instance <instance-id>

# Platform management
btp list services/platform --subaccount <id>
btp register services/platform --subaccount <id> --name <name> --type <type>
btp unregister services/platform <platform-id> --subaccount <id>

---

API Operations

Retrieve OAuth2 Token

curl '<uaa_url>/oauth/token' -X POST \
  -H 'Accept: application/json' \
  -d 'grant_type=client_credentials&client_id=<clientid>&client_secret=<clientsecret>'

Response:

{
  "access_token": "<token>",
  "token_type": "bearer",
  "expires_in": 43199,
  "scope": "<xsappname>.job.read <xsappname>.event.read"
}

API Base URI

https://service-manager.cfapps.<region>.hana.ondemand.com/v1/

Rate Limiting

Three concurrent tiers enforced:

• Level 1: All APIs - 10,000/hour, 1,000/minute
• Level 2: Resource-specific - 1,000-6,000/hour
• Level 3: Instance operations - 50-6,000/hour

HTTP 429 returned with Retry-After header when limits exceeded.

Filtering

Query parameters:

• fieldQuery - Filter by resource attributes
• labelQuery - Filter by resource labels
• Operators: eq, ne, in, contains, etc.

Reference: See references/rate-limiting-filtering.md for complete rate limits and filtering details.

---

SMCTL Command Reference

Key Commands

Common Flags

• --mode sync/async - Execution mode (default: async)
• -c, --parameters - JSON configuration
• -o, --output - Output format (json, yaml, text)
• -v, --verbose - Detailed output

Reference: See references/smctl-commands.md for complete command reference with all flags and examples.

---

Common Operations

Check Async Operation Status

# Get operation URL from provision/bind response
smctl status /v1/service_instances/<id>/operations/<op-id>

API:

GET /v1/{resourceType}/{resourceID}/operations/{operationID}

Response states: in progress, succeeded, failed

Delete Service Instance

Prerequisites: 1. Remove all service bindings 2. Remove all service keys 3. Instance not bound to applications

# Force delete without confirmation
smctl deprovision my-instance -f

# Sync mode
smctl deprovision my-instance --mode sync

Note: Kyma/Kubernetes instances cannot be deleted from BTP cockpit.

Assign Administrator Role

1. Navigate to subaccount > Security > Trust Configuration > SAP ID Service 2. Enter user email 3. Click Show Assignments > Add User 4. Assign Role Collection > Select "Subaccount Service Administrator"

---

Troubleshooting

Issue: Cannot see service in marketplace

Check: 1. Service entitlement added to subaccount? 2. Quota assigned (enterprise accounts)? 3. Correct region selected?

Issue: Instance creation fails

Check: 1. Valid plan selected? 2. Parameters JSON syntax correct? 3. Quota not exceeded? 4. Required dependencies provisioned?

Debug:

smctl get-instance <name> -o json
# Check "last_operation" for error details

Issue: Rate limit exceeded (HTTP 429)

Solution: 1. Check Retry-After header 2. Implement exponential backoff 3. Batch operations where possible 4. Consider caching responses

Issue: Binding credentials missing

Check: 1. Binding completed successfully? 2. Correct binding name referenced? 3. Secret created (Kubernetes)?

# SMCTL
smctl get-binding <name> -o json

# Kubernetes
kubectl get secrets <binding-name> -o yaml

Issue: X.509 authentication fails

Check: 1. Certificate not expired? 2. Correct certificate/key pair? 3. Certificate chain complete? 4. Client ID matches certificate?

---

Best Practices

1. Use Sync Mode for Scripts

smctl provision my-instance service plan --mode sync

2. Label Resources

smctl provision my-instance service plan \
  -c '{}' \
  --labels '{"environment":"production","team":"platform"}'

3. Use Service Keys for External Access

Instead of binding to apps, create service keys for external clients.

4. Implement Retry Logic

For async operations, poll status with exponential backoff.

5. Choose Appropriate Plans

• subaccount-admin: Full management
• subaccount-audit: Read-only monitoring
• container: Isolated per-instance access

6. Secure Credentials

• Rotate service keys periodically
• Use X.509 for production
• Store credentials in secret managers

---

Bundled Resources

Templates (5 files)

Ready-to-use templates in templates/ directory:

• service-instance-cf.json - Cloud Foundry instance parameters
• service-binding-cf.json - Cloud Foundry binding parameters
• service-instance-k8s.yaml - Kubernetes ServiceInstance CRD
• service-binding-k8s.yaml - Kubernetes ServiceBinding CRD
• oauth-token-request.sh - OAuth2 token retrieval script

Reference Documentation (7 files)

Detailed documentation in references/ directory: 1. api-reference.md - Complete API endpoints, operations, and examples 2. smctl-commands.md - Full SMCTL CLI reference with all flags and usage 3. btp-cli-commands.md - Comprehensive BTP CLI command reference 4. kubernetes-operator.md - Service Operator setup, CRDs, migration guide 5. rate-limiting-filtering.md - Rate limits, filtering, and best practices 6. roles-permissions.md - Plans, roles, scopes, and authorization details 7. service-catalog-legacy.md - Legacy svcat and broker proxy setup (deprecated)

Quick Reference Templates

---

Official Documentation Links

Primary Resources

• GitHub Docs: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs
• SAP Help Portal: https://help.sap.com/docs/service-manager
• SMCTL Releases: https://github.com/Peripli/service-manager-cli/releases
• Service Operator: https://github.com/SAP/sap-btp-service-operator

API Documentation

• Swagger UI: https://service-manager.cfapps.<region>.hana.ondemand.com/swaggerui/swagger-ui.html
• Regions: https://help.sap.com/docs/btp/sap-business-technology-platform/regions-and-api-endpoints-available-for-cloud-foundry-environment

Related Documentation

• BTP Cockpit: https://cockpit.btp.cloud.sap/
• cert-manager: https://cert-manager.io/docs/installation/kubernetes/
• Kyma Services: https://help.sap.com/docs/btp/sap-business-technology-platform/using-services-in-kyma-environment

---

Instructions for Claude

When using this skill:

1. Identify the environment - Cloud Foundry, Kyma, Kubernetes, or Other 2. Choose appropriate tool - SMCTL, BTP CLI, CF CLI, kubectl, or cockpit 3. Use correct authentication - OAuth2, X.509, or interactive 4. Check rate limits - Implement retry logic for bulk operations 5. Verify async completion - Poll status for provision/bind operations 6. Reference templates - Use provided templates for common operations 7. Check reference files - Detailed information in references/ directory

For Cloud Foundry: Use cf CLI or cockpit For Kubernetes: Use ServiceInstance/ServiceBinding CRDs For Other environments: Use SMCTL or BTP CLI For API access: Retrieve OAuth2 token first

When troubleshooting:

• Check operation status for async operations
• Verify credentials and permissions
• Review rate limits if getting 429 errors
• Check prerequisites (entitlements, quotas, dependencies)

---

License: GPL-3.0 Version: 1.1.1 Maintained by: Eduard Jiglau Email: hello@sap-ai-skills.com Website: https://sap-ai-skills.com Repository: https://github.com/secondsky/sap-skills

SAP BTP Service Manager Skill

Status: Production Ready Last Updated: 2025-11-27 Version: 1.1.1 ⚠️ Important: SMCLI repository archived (2025-09-30) - Go installation recommended

---

Capability Index

Overview

Comprehensive Claude Code skill for managing SAP BTP services across Cloud Foundry, Kyma, Kubernetes, and other environments using SAP Service Manager.

This skill provides detailed knowledge for:

• Service instance and binding lifecycle management
• SMCTL and BTP CLI command reference
• Service Manager REST API operations
• Kubernetes Service Operator setup and configuration
• OAuth2 authentication (including X.509 certificates)
• Rate limiting and query filtering
• Cross-environment service consumption

---

Auto-Trigger Keywords

Primary Keywords

• SAP Service Manager
• BTP service instance
• BTP service binding
• SMCTL CLI
• service-manager service
• service-operator-access plan

Secondary Keywords

• smctl login
• smctl provision
• smctl bind
• smctl marketplace
• btp create services/instance
• btp create services/binding
• ServiceInstance CRD
• ServiceBinding CRD
• SAP BTP Service Operator
• service broker registration
• platform registration
• subaccount-admin plan
• subaccount-audit plan
• container plan

Technology Keywords

• OSBAPI
• Open Service Broker API
• cf create-service
• cf bind-service
• cf create-service-key
• kubectl apply serviceinstance
• kubectl apply servicebinding
• cert-manager BTP
• Helm sap-btp-operator

Error Keywords

• HTTP 429 rate limit service manager
• service instance creation failed BTP
• service binding credentials missing
• smctl login failed
• OAuth2 token service manager
• X.509 certificate BTP authentication
• service-operator-access plan not found
• svcat to BTP migration

---

What This Skill Does

1. Service Instance Management

• Create, update, delete service instances
• Configure parameters and labels
• Handle async operations

2. Service Binding Management

• Create bindings for applications
• Generate service keys
• Configure X.509 credentials

3. Platform & Broker Management

• Register platforms (Kubernetes, custom)
• Register service brokers
• Manage offerings and plans

4. CLI Command Reference

• Complete SMCTL command guide
• BTP CLI service commands
• CF CLI integration

5. Kubernetes Integration

• SAP BTP Service Operator setup
• ServiceInstance/ServiceBinding CRDs
• Migration from Service Catalog (svcat)

6. API Reference

• All REST API endpoints
• Rate limiting details
• Query filtering operators

---

Known Issues Prevented

---

When to Use This Skill

Use when:

• Creating service instances on SAP BTP
• Binding services to applications
• Setting up service access from Kubernetes
• Managing service brokers and platforms
• Troubleshooting service provisioning
• Automating service management via CLI/API
• Configuring OAuth2/X.509 authentication

Do NOT use when:

• Working with specific SAP service configurations (use service-specific skills)
• Managing SAP BTP account/subaccount settings (use btp-account skill)
• Deploying applications (use CF/Kyma deployment skills)

---

Skill Structure

sap-btp-service-manager/
├── SKILL.md                          # Main skill content
├── README.md                         # This file
├── references/
│   ├── api-reference.md              # Complete API endpoints
│   ├── smctl-commands.md             # Full SMCTL CLI reference
│   ├── btp-cli-commands.md           # Full BTP CLI reference
│   ├── kubernetes-operator.md        # Service Operator guide
│   ├── rate-limiting-filtering.md    # Limits and query operators
│   ├── roles-permissions.md          # Plans, roles, scopes
│   └── service-catalog-legacy.md     # Legacy svcat/broker proxy (deprecated)
└── templates/
    ├── service-instance-cf.json      # CF instance parameters
    ├── service-binding-cf.json       # CF binding parameters
    ├── service-instance-k8s.yaml     # K8s ServiceInstance CRD
    ├── service-binding-k8s.yaml      # K8s ServiceBinding CRD
    └── oauth-token-request.sh        # OAuth2 token script

---

Token Efficiency

---

Quick Usage

# Install SMCTL (recommended - Go method)
go install github.com/Peripli/service-manager-cli@latest
export PATH=$PATH:$(go env GOPATH)/bin

# Alternative: Download from releases (repository archived 2025-09-30)
# https://github.com/Peripli/service-manager-cli/releases

# Login
smctl login -a https://service-manager.cfapps.eu10.hana.ondemand.com \
  --param subdomain=my-subaccount

# List available services
smctl marketplace

# Create service instance
smctl provision my-instance xsuaa application --mode sync

# Create binding
smctl bind my-instance my-binding --mode sync

# View binding credentials
smctl get-binding my-binding -o json

---

Documentation Sources

• GitHub Docs: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs
• SAP Help Portal: https://help.sap.com/docs/service-manager
• Service Operator: https://github.com/SAP/sap-btp-service-operator
• SMCTL Releases: https://github.com/Peripli/service-manager-cli/releases
• Swagger API: https://service-manager.cfapps.<region>.hana.ondemand.com/swaggerui/swagger-ui.html

---

Version History

---

Maintenance

Quarterly Tasks:

• Verify SMCTL CLI version compatibility
• Check for new API endpoints
• Update rate limits if changed
• Test Kubernetes operator with latest Helm chart
• Review SAP Help Portal for updates

Next Review: 2026-02-22

---

License

GPL-3.0

---

Contributing

Repository: https://github.com/secondsky/sap-skills

Follow the skill creation guidelines in the Contributor Guide.

SAP Service Manager API Reference

Base URI: https://service-manager.cfapps.<region>.hana.ondemand.com/v1/

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/SAP-Service-Manager

---

Table of Contents

1. Authentication

• User Access Tokens
• Client Access Tokens
• Token Retrieval

2. API Groups

• Platforms API
• Service Brokers API
• Service Offerings API
• Service Plans API
• Service Instances API
• Service Bindings API
• Operations API

3. Common Patterns

• Filtering
• Pagination
• Error Handling

4. Response Formats

• Success Responses
• Error Responses

5. Rate Limiting

• Limits Overview
• Headers

---

Authentication

User Access Tokens

• Represent named users
• Scopes derived from assigned roles
• Obtained via password or SSO flow

Client Access Tokens

• Represent technical clients
• Scopes derived from service plan
• Obtained via client credentials flow

Token Retrieval

curl '<uaa_url>/oauth/token' -X POST \
  -H 'Accept: application/json' \
  -d 'grant_type=client_credentials&client_id=<clientid>&client_secret=<clientsecret>'

Response:

{
  "access_token": "<access_token>",
  "token_type": "bearer",
  "expires_in": 43199,
  "scope": "<xsappname>.job.read <xsappname>.event.read"
}

Usage: Include Authorization: Bearer <access_token> header in all requests.

---

API Groups

1. Platforms API

Base: /v1/platforms

Platform Registration Request:

{
  "name": "my-platform",
  "type": "kubernetes",
  "description": "My K8s cluster"
}

Platform Response:

{
  "id": "platform-id",
  "name": "my-platform",
  "type": "kubernetes",
  "description": "My K8s cluster",
  "created_at": "2025-01-01T00:00:00Z",
  "updated_at": "2025-01-01T00:00:00Z",
  "credentials": {
    "basic": {
      "username": "generated-user",
      "password": "generated-pass"
    }
  }
}

---

2. Service Brokers API

Base: /v1/service_brokers

Broker Registration Request:

{
  "name": "my-broker",
  "broker_url": "https://broker.example.com",
  "description": "My service broker",
  "credentials": {
    "basic": {
      "username": "broker-user",
      "password": "broker-pass"
    }
  }
}

---

3. Service Instances API

Base: /v1/service_instances

Create Instance Request:

{
  "name": "my-instance",
  "service_plan_id": "plan-guid",
  "parameters": {
    "key1": "value1"
  },
  "labels": {
    "environment": ["production"]
  }
}

Instance Response:

{
  "id": "instance-id",
  "name": "my-instance",
  "service_plan_id": "plan-guid",
  "platform_id": "platform-id",
  "context": {},
  "parameters": {},
  "labels": {},
  "ready": true,
  "usable": true,
  "created_at": "2025-01-01T00:00:00Z",
  "updated_at": "2025-01-01T00:00:00Z",
  "last_operation": {
    "type": "create",
    "state": "succeeded"
  }
}

Query Parameters:

• fieldQuery: Filter by field values
• labelQuery: Filter by label values
• max_items: Limit results
• token: Pagination token

---

4. Service Bindings API

Base: /v1/service_bindings

Create Binding Request:

{
  "name": "my-binding",
  "service_instance_id": "instance-id",
  "parameters": {
    "credential-type": "x509"
  }
}

Binding Response (Default Credentials):

{
  "id": "binding-id",
  "name": "my-binding",
  "service_instance_id": "instance-id",
  "credentials": {
    "clientid": "client-id",
    "clientsecret": "client-secret",
    "url": "https://service.example.com",
    "sm_url": "https://service-manager.cfapps.region.hana.ondemand.com"
  },
  "ready": true,
  "created_at": "2025-01-01T00:00:00Z"
}

Binding Response (X.509 Credentials):

{
  "credentials": {
    "clientid": "client-id",
    "certificate": "-----BEGIN CERTIFICATE-----...",
    "key": "-----BEGIN RSA PRIVATE KEY-----...",
    "certurl": "https://cert.auth.url"
  }
}

---

5. Service Plans API

Base: /v1/service_plans

Plan Response:

{
  "id": "plan-id",
  "name": "subaccount-admin",
  "description": "Full administrative access",
  "free": false,
  "bindable": true,
  "service_offering_id": "offering-id",
  "catalog_id": "catalog-id",
  "catalog_name": "subaccount-admin",
  "metadata": {}
}

---

6. Service Offerings API

Base: /v1/service_offerings

Offering Response:

{
  "id": "offering-id",
  "name": "service-manager",
  "description": "SAP Service Manager",
  "bindable": true,
  "broker_id": "broker-id",
  "catalog_id": "catalog-id",
  "catalog_name": "service-manager"
}

---

7. Operations API

Base: /v1/{resourceType}/{resourceID}/operations

Path Parameters:

• resourceType: platforms, service_brokers, service_bindings, service_instances
• resourceID: Resource identifier
• operationID: Operation identifier

Operation Response:

{
  "id": "operation-id",
  "type": "create",
  "state": "in progress",
  "resource_id": "resource-id",
  "resource_type": "service_instances",
  "description": "Provisioning service instance",
  "created_at": "2025-01-01T00:00:00Z",
  "updated_at": "2025-01-01T00:00:00Z"
}

Operation States:

• in progress - Operation running
• succeeded - Operation completed successfully
• failed - Operation failed

---

HTTP Status Codes

---

Async Operations

POST, PATCH, and DELETE operations on instances and bindings are async by default.

Response (202 Accepted):

{
  "id": "resource-id",
  "last_operation": {
    "type": "create",
    "state": "in progress"
  }
}

Headers:

• Location: /v1/service_instances/{id}/operations/{opId} - Poll this URL

Polling:

# Initial request
POST /v1/service_instances
# Response: 202 with Location header

# Poll status
GET /v1/service_instances/{id}/operations/{opId}
# Repeat until state is "succeeded" or "failed"

---

Swagger UI

Access interactive API documentation:

https://service-manager.cfapps.<region>.hana.ondemand.com/swaggerui/swagger-ui.html

Example Regions:

• EU10 (Frankfurt): eu10.hana.ondemand.com
• US10 (US East): us10.hana.ondemand.com
• AP10 (Australia): ap10.hana.ondemand.com

---

Documentation Links

• API Groups: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/sap-service-manager-api-groups-9b97aee.md
• Service Instances: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/instances-23af00d.md
• Service Bindings: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/service-bindings-392eb36.md
• Platforms: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/platforms-7610c08.md
• Brokers: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/brokers-743f3f7.md

BTP CLI Service Manager Commands

The SAP BTP CLI (btp) provides service management commands as an alternative to SMCTL.

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/SAP-Service-Manager

---

Table of Contents

1. Prerequisites 2. Service Instance Commands

• btp create services/instance
• btp get services/instance
• btp list services/instances
• btp delete services/instance
• btp update services/instance

3. Service Binding Commands

• btp create services/binding
• btp get services/binding
• btp list services/bindings
• btp delete services/binding

4. Platform Commands

• btp list services/platform
• btp register services/platform
• btp unregister services/platform
• btp get services/platform

5. Marketplace Commands

• btp list services/offering
• btp list services/plan

6. Common Examples 7. Migration from SMCTL

---

Prerequisites

1. Install BTP CLI: https://tools.hana.ondemand.com/#cloud 2. Login: btp login 3. Set target: btp target --subaccount <subaccount-id>

---

Service Instance Commands

btp create services/instance

Create a new service instance.

Syntax:

btp create services/instance [parameters]

Required Parameters:

Optional Parameters:

Label Format:

{"<label_name>": ["<label_value>"]}

• Keys: max 100 chars, alphanumeric + . _ -
• Values: arrays of unique strings, max 255 chars each

Examples:

# Basic creation
btp create services/instance \
  --subaccount abc-123 \
  --service xsuaa \
  --plan application

# With parameters
btp create services/instance \
  --subaccount abc-123 \
  --service hana \
  --plan hdi-shared \
  --parameters '{"database_id":"db-123"}'

# With labels
btp create services/instance \
  --subaccount abc-123 \
  --service xsuaa \
  --plan application \
  --labels '{"environment":["production"],"team":["platform"]}'

---

btp get services/instance

Get details of a service instance.

Syntax:

btp get services/instance <instance-id> [parameters]

Parameters:

Example:

btp get services/instance inst-123 \
  --subaccount abc-123 \
  --show-parameters

---

btp list services/instance

List all service instances.

Syntax:

btp list services/instance [parameters]

Parameters:

Example:

btp list services/instance --subaccount abc-123 --fields-filter "ready eq 'true'"

---

btp update services/instance

Update a service instance.

Syntax:

btp update services/instance [parameters]

Required Parameters:

Optional Parameters:

Note: Plan updates only available if additional plans exist and are entitled.

---

btp delete services/instance

Delete a service instance.

Syntax:

btp delete services/instance <instance-id> [parameters]

Parameters:

---

Service Binding Commands

btp create services/binding

Create a service binding.

Syntax:

btp create services/binding [parameters]

Required Parameters:

Optional Parameters:

Examples:

# Basic binding
btp create services/binding \
  --subaccount abc-123 \
  --binding my-binding \
  --service-instance inst-123

# With X.509 credentials
btp create services/binding \
  --subaccount abc-123 \
  --name my-binding \
  --instance-name my-instance \
  --parameters '{"credential-type":"x509"}'

---

btp get services/binding

Get binding details.

Syntax:

btp get services/binding <binding-id> [parameters]

Parameters:

---

btp list services/binding

List all bindings.

Syntax:

btp list services/binding [parameters]

Parameters:

---

btp delete services/binding

Delete a binding.

Syntax:

btp delete services/binding <binding-id> [parameters]

---

Platform Commands

btp list services/platform

List all registered platforms.

Syntax:

btp list services/platform [parameters]

Parameters:

---

btp get services/platform

Get platform details.

Syntax:

btp get services/platform <platform-id> [parameters]

Parameters:

Output: ID, Name, Type, Description, URL, Created, Updated, Labels

---

btp register services/platform

Register a new platform (Kubernetes only).

Syntax:

btp register services/platform [parameters]

Required Parameters:

Optional Parameters:

Example:

btp register services/platform \
  --subaccount abc-123 \
  --name my-k8s \
  --type kubernetes \
  --description "Production cluster"

Output: Platform credentials (username/password) returned on success.

---

btp update services/platform

Update a platform.

Syntax:

btp update services/platform <platform-id> [parameters]

---

btp unregister services/platform

Unregister a platform.

Syntax:

btp unregister services/platform <platform-id> --subaccount <id>

---

Broker Commands

btp list services/broker

List all registered brokers.

Syntax:

btp list services/broker [parameters]

Parameters:

Output: ID, Name, Description, Broker URL, Created, Updated, Labels

---

btp get services/broker

Get broker details.

Syntax:

btp get services/broker <broker-id> [parameters]

Parameters:

Output: ID, Name, Description, Broker URL, Created, Updated, Labels

---

btp register services/broker

Register a service broker.

Syntax:

btp register services/broker [parameters]

Required Parameters:

Optional Parameters:

Label Format:

• Keys: max 100 chars, alphanumeric + . _ -
• Values: arrays of strings, max 255 chars each, no newlines

---

btp unregister services/broker

Unregister a broker.

Syntax:

btp unregister services/broker <broker-id> --subaccount <id>

---

Offering Commands

btp list services/offering

List available service offerings.

Syntax:

btp list services/offering [parameters]

Parameters:

Note: Without --environment, returns services consumable through Service Manager bindings.

---

btp get services/offering

Get offering details.

Syntax:

btp get services/offering <offering-id> [parameters]

Parameters:

---

Plan Commands

btp list services/plan

List available service plans.

Syntax:

btp list services/plan [parameters]

Parameters:

---

btp get services/plan

Get plan details.

Syntax:

btp get services/plan <plan-id> [parameters]

Parameters:

---

Common Patterns

Set Target (Skip Subaccount on Each Command)

# Set target once
btp target --subaccount abc-123

# Now commands don't need --subaccount
btp list services/instance
btp create services/instance --service xsuaa --plan application

JSON Output

btp --format json list services/instance

Parameters from File

btp create services/instance \
  --service hana \
  --plan hdi-shared \
  --parameters @params.json

---

SMCTL vs BTP CLI Comparison

Recommendation: Use SMCTL for Service Manager-specific operations; use BTP CLI for unified BTP management.

---

Documentation Links

• Create Instance: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/create-services-instance-5a44ad8.md
• Create Binding: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/create-services-binding-7cf9dc5.md
• Get Instance: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/get-services-instance-adb4c54.md
• Platform Commands: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/platforms-7610c08.md

SAP BTP Service Operator for Kubernetes

The SAP BTP Service Operator enables Kubernetes clusters to consume SAP BTP services through native Kubernetes resources.

GitHub Repository: https://github.com/SAP/sap-btp-service-operator

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments

---

Table of Contents

1. Prerequisites

• Infrastructure & Tools
• Environment Setup
• SAP BTP Requirements

2. Setup Process

• Install cert-manager
• Create Service Manager Credentials
• Extract Credentials
• Deploy Operator with Helm

3. Custom Resource Definitions

• ServiceInstance CRD
• ServiceBinding CRD

4. Using Credentials in Pods

• Environment Variables
• Volume Mount

5. Migration from Service Catalog (svcat)

• Prerequisites
• Step 1: Prepare Platform
• Step 2: Install Migration CLI
• Step 3: Dry Run Migration
• Step 4: Execute Migration
• Migration Process
• Important Notes

6. Troubleshooting

• Operator Not Starting
• Instance Creation Fails
• Binding Creation Fails
• Secret Not Created

7. Best Practices 8. Documentation Links

---

Prerequisites

Infrastructure & Tools

Environment Setup

# Configure kubeconfig
export KUBECONFIG='/path/to/kubeconfig.yaml'

# Verify kubectl
kubectl version --client

# Verify Helm
helm version

SAP BTP Requirements

• Active SAP Service Manager subscription
• Subaccount Service Administrator role
• Access to SAP BTP cockpit or SMCTL

---

Setup Process

Step 1: Install cert-manager

cert-manager handles TLS certificates for operator communication.

# Install cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml

# Verify installation
kubectl get pods -n cert-manager

Wait for all cert-manager pods to be Running.

---

Step 2: Create Service Manager Credentials

Option A: Using SMCTL

# Login to Service Manager
smctl login -a https://service-manager.cfapps.<region>.hana.ondemand.com \
  --param subdomain=<subdomain>

# Create instance with service-operator-access plan
smctl provision sm-operator service-manager service-operator-access --mode sync

# Create binding
smctl bind sm-operator sm-operator-binding --mode sync

# Get credentials
smctl get-binding sm-operator-binding -o json

Option B: Using BTP Cockpit

1. Navigate to Services > Service Marketplace 2. Find "Service Manager" 3. Create instance with plan "service-operator-access" 4. Create binding and download credentials

---

Step 3: Extract Credentials

From the binding, extract:

Default Credentials:

• clientid
• clientsecret
• sm_url
• url (UAA URL)

X.509 Credentials (if configured):

• clientid
• certificate
• key
• certurl
• sm_url

---

Step 4: Deploy Operator with Helm

Using Default Credentials:

# Add Helm repository
helm repo add sap-btp-operator https://sap.github.io/sap-btp-service-operator/
helm repo update

# Install operator
helm install sap-btp-operator sap-btp-operator/sap-btp-operator \
  --namespace sap-btp-operator \
  --create-namespace \
  --set manager.secret.clientid=<clientid> \
  --set manager.secret.clientsecret=<clientsecret> \
  --set manager.secret.sm_url=<sm_url> \
  --set manager.secret.tokenurl=<url>/oauth/token

Using X.509 Credentials:

helm install sap-btp-operator sap-btp-operator/sap-btp-operator \
  --namespace sap-btp-operator \
  --create-namespace \
  --set manager.secret.clientid=<clientid> \
  --set manager.secret.tls.crt="$(cat cert.pem)" \
  --set manager.secret.tls.key="$(cat key.pem)" \
  --set manager.secret.sm_url=<sm_url> \
  --set manager.secret.tokenurl=<certurl>/oauth/token

Verify Installation:

kubectl get pods -n sap-btp-operator
kubectl get crds | grep services.cloud.sap.com

---

Custom Resource Definitions

ServiceInstance CRD

apiVersion: services.cloud.sap.com/v1alpha1 kind: ServiceInstance

Full Specification:

apiVersion: services.cloud.sap.com/v1alpha1
kind: ServiceInstance
metadata:
  name: my-service-instance
  namespace: default
  labels:
    app: my-app
spec:
  # Required: Service offering name from marketplace
  serviceOfferingName: xsuaa

  # Required: Service plan name
  servicePlanName: application

  # Optional: External name (appears in BTP cockpit)
  externalName: my-instance-external-name

  # Optional: Service-specific parameters
  parameters:
    xsappname: my-app
    tenant-mode: dedicated
    scopes:
      - name: read
        description: Read access
    role-templates:
      - name: Viewer
        scope-references:
          - read

  # Optional: Reference to secret containing parameters
  parametersFrom:
    - secretKeyRef:
        name: my-params-secret
        key: parameters

  # Optional: Custom tags
  customTags:
    - environment:production
    - team:platform

Create Instance:

kubectl apply -f service-instance.yaml

Check Status:

kubectl get serviceinstances
kubectl describe serviceinstance my-service-instance

Status Conditions:

• Ready: Instance is ready for use
• Failed: Provisioning failed

---

ServiceBinding CRD

apiVersion: services.cloud.sap.com/v1alpha1 kind: ServiceBinding

Full Specification:

apiVersion: services.cloud.sap.com/v1alpha1
kind: ServiceBinding
metadata:
  name: my-binding
  namespace: default
spec:
  # Required: Reference to ServiceInstance
  serviceInstanceName: my-service-instance

  # Optional: External name
  externalName: my-binding-external

  # Optional: Binding parameters
  parameters:
    credential-type: x509
    key-length: 4096
    validity-type: MONTHS
    validity: 6

  # Optional: Reference to secret containing parameters
  parametersFrom:
    - secretKeyRef:
        name: binding-params
        key: parameters

  # Optional: Name of secret to create (defaults to binding name)
  secretName: my-binding-secret

  # Optional: Secret template for custom formatting
  secretKey: credentials.json

  # Optional: Root key in secret
  secretRootKey: credentials

Create Binding:

kubectl apply -f service-binding.yaml

Check Status:

kubectl get servicebindings
kubectl describe servicebinding my-binding

Access Credentials:

# Credentials stored in Kubernetes secret
kubectl get secret my-binding -o yaml

# Decode credentials
kubectl get secret my-binding -o jsonpath='{.data.clientid}' | base64 -d
kubectl get secret my-binding -o jsonpath='{.data.clientsecret}' | base64 -d

---

Using Credentials in Pods

Environment Variables

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
    - name: app
      image: my-app:latest
      env:
        - name: XSUAA_CLIENTID
          valueFrom:
            secretKeyRef:
              name: my-binding
              key: clientid
        - name: XSUAA_CLIENTSECRET
          valueFrom:
            secretKeyRef:
              name: my-binding
              key: clientsecret
        - name: XSUAA_URL
          valueFrom:
            secretKeyRef:
              name: my-binding
              key: url

Volume Mount

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
    - name: app
      image: my-app:latest
      volumeMounts:
        - name: credentials
          mountPath: /etc/secrets
          readOnly: true
  volumes:
    - name: credentials
      secret:
        secretName: my-binding

---

Migration from Service Catalog (svcat)

Prerequisites

• SMCTL CLI installed
• Service Catalog (svcat) currently deployed
• Access to both svcat and SAP BTP Service Operator

Step 1: Prepare Platform

# Get cluster ID from catalog ConfigMap
CLUSTER_ID=$(kubectl get configmap cluster-info -n catalog -o jsonpath='{.data.id}')

# Prepare platform for migration
smctl curl -X PATCH "/v1/platforms/<platformID>" \
  -d '{"credentials":{"rotatable":true}}' \
  --param subaccount_id=<subaccount-id>

Step 2: Install Migration CLI

# From GitHub releases
# https://github.com/SAP/sap-btp-service-operator/releases

# Or via Go
go install github.com/SAP/sap-btp-service-operator/tools/btpmigrate@latest

Step 3: Dry Run Migration

# Test migration without making changes
btpmigrate --dry-run

Review any errors before proceeding.

Step 4: Execute Migration

# Perform actual migration
btpmigrate

Migration Process

1. Scanning: Fetches all instances/bindings from svcat and BTP 2. Validation: Verifies each resource can be migrated 3. Migration: Removes from svcat, adds to BTP operator

Important Notes

• Platform becomes suspended during migration
• Reversible until actual migration starts
• Original svcat platform unusable after migration
• Test in non-production first

---

Troubleshooting

Operator Not Starting

# Check operator pods
kubectl get pods -n sap-btp-operator

# Check operator logs
kubectl logs -n sap-btp-operator deployment/sap-btp-operator-controller-manager

# Verify cert-manager
kubectl get pods -n cert-manager

Instance Creation Fails

# Check instance status
kubectl describe serviceinstance <name>

# Look for events
kubectl get events --field-selector involvedObject.name=<instance-name>

Common Issues:

• Service not entitled in subaccount
• Invalid parameters
• Plan not available in region
• Quota exceeded

Binding Creation Fails

# Check binding status
kubectl describe servicebinding <name>

# Verify instance is ready
kubectl get serviceinstance <instance-name>

Common Issues:

• Referenced instance not ready
• Instance doesn't support bindings
• Invalid binding parameters

Secret Not Created

# Check binding status
kubectl get servicebinding <name> -o yaml

# Verify secret exists
kubectl get secrets | grep <binding-name>

---

Best Practices

1. Namespace Organization: Group related services in namespaces 2. Labels: Use labels for filtering and organization 3. External Names: Use descriptive external names for cockpit visibility 4. Parameters in Secrets: Store sensitive parameters in Kubernetes secrets 5. Resource Limits: Set appropriate limits on operator deployment 6. Monitoring: Monitor operator health and CRD status 7. Backup: Document all ServiceInstance/ServiceBinding manifests

---

Documentation Links

• Setup: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/setup-e977f23.md
• Prerequisites: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/prerequisites-dd5faaa.md
• Working with Operator: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/working-with-sap-btp-service-operator-0ccebd7.md
• Migration: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/migrating-from-svcat-to-sap-btp-service-ec7f5c7.md
• GitHub Repository: https://github.com/SAP/sap-btp-service-operator

Rate Limiting and Filtering Reference

Complete reference for SAP Service Manager API rate limits and query filtering.

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/SAP-Service-Manager

---

Table of Contents

1. Rate Limiting

• Identification
• Level 1: All APIs Combined
• Level 2: Resource-Specific Limits
• Level 3: Instance Operations
• HTTP 429 Responses

2. Query Filtering

• Field Filtering
• Label Filtering
• Operators
• Combining Filters

3. Best Practices

• Rate Limit Handling
• Filter Optimization

4. Examples

• Common Query Patterns
• Rate Limit Scenarios

---

Rate Limiting

SAP Service Manager implements three concurrent rate limiting levels. Exceeding any tier triggers throttling, even if other allowances remain.

Identification

Callers identified by:

• Username (for user tokens)
• OAuth Client ID (for client tokens)

Level 1: All APIs Combined

Applies to all API endpoints combined.

---

Level 2: Resource-Specific Limits

---

Level 3: Method-Specific Limits

Note: CREATE has a stricter minute limit (50/min) to prevent provisioning storms.

---

Rate Limit Error Response

HTTP Status: 429 Too Many Requests

Response Headers:

HTTP-date Format: Sun, 06 Nov 1994 08:49:37 GMT

Example Response:

{
  "error": "rate_limit_exceeded",
  "description": "Request rate limit exceeded. Please retry after the time specified in the Retry-After header."
}

---

Best Practices for Rate Limits

1. Implement Exponential Backoff:

async function withRetry(fn, maxRetries = 5) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      return await fn();
    } catch (error) {
      if (error.status === 429) {
        const retryAfter = error.headers['retry-after'];
        const waitTime = retryAfter ?
          new Date(retryAfter) - Date.now() :
          Math.pow(2, i) * 1000;
        await sleep(waitTime);
      } else {
        throw error;
      }
    }
  }
}

2. Batch Operations: Group related operations where possible

3. Cache Responses: Cache listing responses (offerings, plans)

4. Stagger Requests: Distribute requests over time

5. Monitor Usage: Track request counts to stay within limits

---

Filtering

The SAP Service Manager APIs support filtering via query parameters on GET (list) endpoints.

Query Parameter Types

Both can be combined; results must match both criteria.

---

Supported Literal Types

String Escaping: Double single quotes for embedded quotes ('it''s valid')

---

Field Query Operators

Universal Operators (Field & Label Queries)

Field-Only Operators

---

Filterable Resources

---

Common Field Names

Service Instances

Service Bindings

Platforms

---

Query Examples

Single Field Filter

GET /v1/service_instances?fieldQuery=ready eq true

Multiple Conditions (AND)

GET /v1/service_instances?fieldQuery=ready eq true and usable eq true

In List

GET /v1/service_instances?fieldQuery=service_plan_id in ('plan-1','plan-2','plan-3')

Date Range

GET /v1/service_instances?fieldQuery=created_at gt '2025-01-01T00:00:00Z' and created_at lt '2025-02-01T00:00:00Z'

String Contains

GET /v1/service_instances?fieldQuery=name contains 'production'

Label Query

GET /v1/service_instances?labelQuery=environment eq 'production'

Combined Field and Label Query

GET /v1/service_instances?fieldQuery=ready eq true&labelQuery=team eq 'platform'

Complex Query

GET /v1/service_instances?fieldQuery=broker_id eq 'abc-123' and plan_name in ('small','medium') and ready eq true&labelQuery=environment eq 'dev'

---

URL Encoding

Special characters must be URL-encoded:

Example:

# Original
fieldQuery=name eq 'my instance'

# Encoded
fieldQuery=name%20eq%20%27my%20instance%27

---

Pagination

List endpoints support pagination:

Response:

{
  "items": [...],
  "num_items": 50,
  "token": "next-page-token"
}

Usage:

GET /v1/service_instances?max_items=50
GET /v1/service_instances?max_items=50&token=<token-from-previous>

---

Syntax Rules

1. String literals require single quotes 2. Boolean literals must not be quoted 3. Literals cannot use brackets (except in in/notin lists) 4. Embedded quotes use double single quotes ('') 5. Whitespace around operators is optional but recommended 6. Case sensitivity: Field names are case-sensitive

---

Error Handling

Invalid Query Syntax:

{
  "error": "InvalidQuery",
  "description": "Invalid fieldQuery syntax at position 15"
}

Unknown Field:

{
  "error": "InvalidField",
  "description": "Field 'invalid_field' is not supported for filtering"
}

---

Documentation Links

• Rate Limiting: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/rate-limiting-97be679.md
• Filtering: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/filtering-parameters-and-operators-3331c6e.md

SAP Service Manager Roles and Permissions

Complete reference for SAP Service Manager plans, roles, and scopes.

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/SAP-Service-Manager

---

Table of Contents

1. Service Manager Plans

• subaccount-admin
• subaccount-audit
• container

2. Roles in SAP BTP

• Subaccount Service Administrator
• Subaccount Service Viewer
• Assigning Roles

3. Scope Reference

• Broker Scopes
• Platform Scopes
• Service Instance Scopes
• Service Binding Scopes

4. Best Practices

• Choose the Right Plan
• Principle of Least Privilege
• Client vs User Scopes

---

Service Manager Plans

Three broker plans with different access levels:

1. subaccount-admin

Purpose: Full administrative access to manage all resources in a subaccount.

Use Case: Administrators who need to create, update, and delete all service resources.

Scopes (10 total):

---

2. subaccount-audit

Purpose: Read-only access for monitoring and auditing.

Use Case: Auditors, monitoring systems, and read-only dashboards.

Scopes (6 total):

Note: No manage/write permissions.

---

3. container

Purpose: Isolated access scoped to individual service instances.

Use Case: Applications that need to manage their own bindings without access to other resources.

Visibility Rules:

• Instances created via container credentials are visible from:
• The container instance itself
• Instances of subaccount-* plans
• NOT visible from other container instances

Scopes (7 total):

---

Role Collections

Subaccount Service Administrator

Description: Full management access to service resources in the subaccount.

Permissions (10):

• Manage and read brokers
• Manage and read platforms
• Manage and read service instances
• Manage and read service bindings
• Read service plans
• Read service offerings

Assignment: 1. Navigate to subaccount > Security > Trust Configuration 2. Select SAP ID Service 3. Enter user email 4. Click Show Assignments > Add User 5. Assign Role Collection > Subaccount Service Administrator

---

Subaccount Service Viewer (Feature Set B)

Description: Read-only access to service resources.

Permissions (6):

• Read brokers
• Read platforms
• Read service instances
• Read service bindings
• Read service plans
• Read service offerings

Note: Available only in Feature Set B subaccounts.

---

Plan Selection Guide

---

Scope Matrix

---

API Scope Requirements

Platforms API

Brokers API

Instances API

Bindings API

Plans & Offerings API

---

Token Scope Verification

Check token scopes:

# Decode JWT token (without verification)
echo "<access_token>" | cut -d'.' -f2 | base64 -d | jq '.scope'

Expected format:

{
  "scope": [
    "<xsappname>.subaccount_service_instance_manage",
    "<xsappname>.subaccount_service_instance_read",
    ...
  ]
}

---

Best Practices

1. Principle of Least Privilege: Use audit plan for read-only needs 2. Container Isolation: Use container plan for application self-service 3. Separate Credentials: Different credentials for different environments 4. Rotate Credentials: Regular rotation of client secrets 5. Audit Access: Monitor who has admin access 6. X.509 for Production: Use certificate auth in production

---

Documentation Links

• Broker Plans: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/sap-service-manager-broker-plans-917a8a7.md
• Roles: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/sap-service-manager-roles-d95fbe7.md
• Role Assignment: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/assign-the-subaccount-service-administrator-collection-0735965.md

Service Catalog (svcat) and Broker Proxy Reference

Legacy Kubernetes integration using Service Catalog and Service Manager Broker Proxy.

Note: For new installations, prefer the SAP BTP Service Operator. See kubernetes-operator.md.

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments

---

Table of Contents

1. Overview 2. Prerequisites 3. Installation

• Install Service Catalog
• Configure Broker Proxy

4. Usage

• List Services
• Create Instance
• Create Binding

5. Migration to Service Operator

• Migration Steps
• Key Differences

6. Troubleshooting

• Common Issues

7. Deprecation Notice

---

Overview

Before the SAP BTP Service Operator, Kubernetes clusters used: 1. Service Catalog (svcat) - Kubernetes SIG project for service management 2. Service Manager Broker Proxy - Connects Service Catalog to SAP Service Manager

This approach is now deprecated in favor of the SAP BTP Service Operator.

---

Prerequisites

• Kubernetes cluster with kubeconfig
• kubectl v1.17.4+ compatible
• Helm v3.x
• SMCTL CLI installed and logged in
• SAP Service Manager subscription

---

Cluster Configuration

Step 1: Register the Cluster as a Platform

# Register Kubernetes cluster with Service Manager
smctl register-platform <platform-name> kubernetes

# Note: Platform name must be unique within the region
# Returns credentials (username/password) needed for broker proxy

Save the returned credentials - they are needed for the broker proxy installation.

---

Step 2: Install Service Catalog

# Add Service Catalog Helm repository
helm repo add svc-cat https://svc-catalog-charts.storage.googleapis.com

# Create catalog namespace
kubectl create namespace catalog

# Install Service Catalog
helm install catalog svc-cat/catalog --namespace catalog

Version Note: svcat v0.3.0 is required for compatibility with Kubernetes v1.17.4+.

Verify Installation:

kubectl get pods -n catalog

---

Step 3: Install Service Manager Broker Proxy

# Add Peripli Helm repository
helm repo add peripli https://peripli.github.io

# Create namespace
kubectl create namespace service-broker-proxy

# Install broker proxy
helm install service-broker-proxy peripli/service-broker-proxy \
  --namespace service-broker-proxy \
  --version 0.7.0 \
  --set config.sm.url=https://service-manager.cfapps.<region>.hana.ondemand.com \
  --set sm.user=<username-from-step-1> \
  --set sm.password=<password-from-step-1>

SM_URL Format: https://service-manager.cfapps.<landscape domain>`

Regional Examples:

• EU10 (Frankfurt): https://service-manager.cfapps.eu10.hana.ondemand.com
• US10 (US East): https://service-manager.cfapps.us10.hana.ondemand.com

---

Service Catalog CLI (svcat)

Installation

Mac OS:

# Download binary
curl -sLO https://download.svcat.sh/cli/latest/darwin/amd64/svcat

# Make executable
chmod +x ./svcat

# Move to PATH
sudo mv ./svcat /usr/local/bin/

# Verify
svcat version --client

Windows:

# Download executable
iwr https://download.svcat.sh/cli/latest/windows/amd64/svcat.exe -o svcat.exe

# Create bin directory
mkdir ~\bin

# Move executable
Move-Item svcat.exe ~\bin\

# Add to PATH (PowerShell profile)
$env:PATH += ";$HOME\bin"

# Verify
svcat version --client

Reference: https://svc-cat.io/docs/install/#installing-the-service-catalog-cli

---

svcat Commands

Browse Marketplace

# List all available services
svcat marketplace

# Short form
svcat mp

---

Provision Service Instance

# Create service instance
svcat provision <instance-name> --class <service-name> --plan <plan-name>

# Example: Create XSUAA instance
svcat provision my-xsuaa --class xsuaa --plan application

# With parameters
svcat provision my-hana --class hana --plan hdi-shared \
  --param database_id=<hana-db-guid>

---

List Instances

# List all provisioned instances
svcat get instances

---

Deprovision Service Instance

# Delete service instance
svcat deprovision <instance-name>

---

Create Binding

# Create binding for instance
svcat bind <instance-name>

# With specific binding name
svcat bind <instance-name> --name <binding-name>

---

List Bindings

# List all bindings
svcat get bindings

---

Delete Binding

# Remove binding
svcat unbind <instance-name> --name <binding-name>

---

Get Credentials

# View binding credentials (stored in Kubernetes secret)
kubectl get secret <binding-name> -o yaml

---

Migration to SAP BTP Service Operator

Important: Service Catalog is deprecated. Migrate to SAP BTP Service Operator.

See kubernetes-operator.md for:

• SAP BTP Service Operator setup
• Migration procedure from svcat
• ServiceInstance and ServiceBinding CRDs

Quick Migration Overview

1. Install SAP BTP Service Operator (see kubernetes-operator.md) 2. Install migration CLI tool 3. Prepare platform: smctl curl -X PATCH "/v1/platforms/<platformID>" -d '{"credentials":{"rotatable":true}}' 4. Dry run: btpmigrate --dry-run 5. Execute: btpmigrate

Warning: Once migration starts, the platform becomes suspended. The process is reversible until actual resource migration begins.

---

Troubleshooting

Service Catalog Not Finding Services

Check: 1. Broker proxy running: kubectl get pods -n service-broker-proxy 2. Service Manager credentials valid 3. Platform registered: smctl list-platforms

Provisioning Fails

Check: 1. Service entitled in subaccount 2. Correct plan name 3. Broker proxy logs: kubectl logs -n service-broker-proxy deployment/service-broker-proxy

svcat Command Not Found

Solution: Ensure svcat is in PATH:

# Mac/Linux
export PATH=$PATH:/usr/local/bin

# Or reinstall
curl -sLO https://download.svcat.sh/cli/latest/darwin/amd64/svcat
chmod +x svcat
sudo mv svcat /usr/local/bin/

---

Documentation Links

• Cluster Configuration: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/cluster-configuration-a55506d.md
• Service Catalog Guide: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/working-with-service-catalog-86ab6f9.md
• Service Catalog Official: https://svc-cat.io/docs/
• Migration Guide: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/Consuming-SAP-BTP-Services-from-Various-Environments/migrating-from-svcat-to-sap-btp-service-ec7f5c7.md

SMCTL Command Reference

Service Manager Control (SMCTL) is the CLI for SAP Service Manager.

Installation: https://github.com/Peripli/service-manager-cli/releases/latest

Documentation: https://github.com/SAP-docs/sap-btp-service-manager/tree/main/docs/Service-Consumption/SAP-Service-Manager

---

Table of Contents

1. Global Flags 2. Authentication Commands

• smctl login
• smctl logout

3. Service Instance Commands

• smctl provision
• smctl deprovision
• smctl list-instances
• smctl get-instance
• smctl update-instance

4. Service Binding Commands

• smctl bind
• smctl unbind
• smctl list-bindings
• smctl get-binding

5. Service Broker Commands

• smctl register-broker
• smctl update-broker
• smctl list-brokers
• smctl delete-broker

6. Platform Commands

• smctl register-platform
• smctl update-platform
• smctl list-platforms
• smctl delete-platform

7. Marketplace Commands

• smctl marketplace

8. Operations Commands

• smctl status
• smctl list-operations

9. Common Examples 10. Tips and Best Practices

---

Global Flags

Available on all commands:

---

Authentication Commands

smctl login

Authenticate to SAP Service Manager.

Syntax:

smctl login [flags]

Aliases: login, l

Required Flags:

Optional Flags:

Examples:

# Interactive password login
smctl login -a https://service-manager.cfapps.eu10.hana.ondemand.com \
  --param subdomain=my-subaccount

# Client credentials (default)
smctl login -a https://service-manager.cfapps.eu10.hana.ondemand.com \
  --param subdomain=my-subaccount \
  --auth-flow client-credentials \
  --client-id abc123 \
  --client-secret xyz789

# Client credentials (X.509)
smctl login -a https://service-manager.cfapps.eu10.hana.ondemand.com \
  --param subdomain=my-subaccount \
  --auth-flow client-credentials \
  --client-id abc123 \
  --cert /path/to/cert.pem \
  --key /path/to/key.pem

2FA Note: If 2FA enabled, append passcode to password (e.g., Password1234 + 5678 = Password12345678)

Session: Expires after 30 minutes of inactivity.

---

smctl logout

End current session.

Syntax:

smctl logout

---

Instance Commands

smctl provision

Create a service instance.

Syntax:

smctl provision [name] [offering] [plan] [flags]

Arguments:

Flags:

Examples:

# Basic provisioning (async)
smctl provision my-instance xsuaa application

# Sync mode
smctl provision my-instance xsuaa application --mode sync

# With parameters
smctl provision my-instance hana hdi-shared \
  -c '{"database_id":"abc-123"}'

# JSON output
smctl provision my-instance xsuaa application -o json

---

smctl deprovision

Delete a service instance.

Syntax:

smctl deprovision [name] [flags]

Flags:

Examples:

# Interactive deletion
smctl deprovision my-instance

# Force delete (no confirmation)
smctl deprovision my-instance -f

# Sync mode
smctl deprovision my-instance --mode sync -f

---

smctl list-instances

List all service instances.

Syntax:

smctl list-instances [flags]

Aliases: list-instances, li

Flags:

Output columns: ID, Name, Service Plan, Platform, Created, Updated, Ready, Usable, Labels

---

smctl get-instance

Get details of a specific instance.

Syntax:

smctl get-instance [name] [flags]

Aliases: get-instance, gi

Flags:

Examples:

# Basic retrieval
smctl get-instance sample-instance

# With configuration parameters
smctl get-instance sample-instance --show-instance-params

# JSON output
smctl get-instance sample-instance -o json

Output: ID, Name, Service Plan ID, Platform ID, Created, Updated, Ready, Usable, Labels, Last Operation

---

Binding Commands

smctl bind

Create a service binding.

Syntax:

smctl bind [instance-name] [binding-name] [flags]

Flags:

Examples:

# Basic binding
smctl bind my-instance my-binding

# With X.509 credentials
smctl bind my-instance my-binding -c '{"credential-type":"x509"}'

# X.509 with custom validity
smctl bind my-instance my-binding -c '{
  "credential-type": "x509",
  "key-length": 4096,
  "validity-type": "MONTHS",
  "validity": 6
}'

# Sync mode
smctl bind my-instance my-binding --mode sync

X.509 Parameters:

---

smctl unbind

Delete a service binding.

Syntax:

smctl unbind [instance-name] [binding-name] [flags]

Flags:

---

smctl list-bindings

List all service bindings.

Syntax:

smctl list-bindings [flags]

Aliases: list-bindings, lsb

Flags:

---

smctl get-binding

Get details of a specific binding (includes credentials).

Syntax:

smctl get-binding [name] [flags]

Aliases: get-binding, gsb

Flags:

Examples:

# Basic retrieval
smctl get-binding sample-binding

# With binding parameters
smctl get-binding sample-binding --show-binding-params

# JSON output
smctl get-binding sample-binding -o json

Output: ID, Name, Instance Name, Credentials, Created, Updated, Ready, Labels, Last Operation

---

Broker Commands

smctl register-broker

Register a service broker.

Syntax:

smctl register-broker [name] [url] <description> [flags]

Aliases: register-broker, rb

Required Flags:

Optional Flags:

Example:

smctl register-broker my-broker https://broker.example.com "My broker" \
  -b admin:password123

---

smctl update-broker

Update a registered broker.

Syntax:

smctl update-broker [name] <json_broker> [flags]

Aliases: update-broker, ub

Flags:

Example:

smctl update-broker broker '{"name": "new-name", "description": "new-description", "broker_url": "http://broker.com", "credentials": { "basic": { "username": "admin", "password": "admin" }}}'

---

smctl list-brokers

List all registered brokers.

Syntax:

smctl list-brokers [flags]

Aliases: list-brokers, lb

Flags:

Output columns: ID, Name, URL, Description, Created, Updated

---

smctl delete-broker

Delete one or more registered brokers.

Syntax:

smctl delete-broker [name] <name2> <name3> ... [flags]

Aliases: delete-broker, db

Flags:

Example:

smctl delete-broker sample-broker-1
# Output: Broker with name: sample-broker-1 successfully deleted

---

Platform Commands

smctl register-platform

Register a platform.

Syntax:

smctl register-platform [name] [type] <description> [flags]

Aliases: register-platform, rp

Flags:

Example:

smctl register-platform my-k8s-cluster kubernetes "Production K8s cluster"

---

smctl update-platform

Update a registered platform.

Syntax:

smctl update-platform [name] <json_platform> [flags]

Aliases: update-platform, up

Flags:

Example:

smctl update-platform platform '{"name": "new-name", "description": "new-description", "type": "new-type"}'

Note: When using --regenerate-credentials, old credentials can no longer be used.

---

smctl list-platforms

List all registered platforms.

Syntax:

smctl list-platforms [flags]

Aliases: list-platforms, lp

Flags:

Output columns: ID, Name, Type, Description, Created, Updated

---

smctl delete-platform

Delete one or more platforms.

Syntax:

smctl delete-platform <name1> <name2> ... <nameN> [flags]

Aliases: delete-platform, dp

Flags:

Examples:

# Standard deletion
smctl delete-platform sample-platform
# Output: Platform with name: sample-platform successfully deleted

# Cascade delete (async)
smctl delete-platform sample-platform --cascade-delete
# Returns: smctl status /v1/platforms/{id}/operations/{operation-id}

Note: Cascade delete schedules an async operation; use smctl status to monitor.

---

Marketplace Commands

smctl marketplace

List available service offerings and plans.

Syntax:

smctl marketplace [flags]

Aliases: marketplace, m

Flags:

Examples:

# List all offerings
smctl marketplace

# List plans for specific service
smctl marketplace -s xsuaa

---

smctl list-offerings

List all service offerings associated with the Service Manager.

Syntax:

smctl list-offerings [flags]

Aliases: list-offerings, lo

Flags:

Example:

smctl list-offerings
smctl lo -o json

Output columns: ID, Name, Description, Broker ID, Ready, Labels

---

smctl list-plans

List all service plans associated with the Service Manager.

Syntax:

smctl list-plans [flags]

Flags:

Example:

smctl list-plans
smctl list-plans -o json

Output columns: ID, Name, Description, Offering ID, Ready, Labels

---

Status Commands

smctl status

Check async operation status.

Syntax:

smctl status <operation-url>

Example:

# After async provision
smctl status /v1/service_instances/abc-123/operations/op-456

---

Other Commands

smctl help

Display help for any command.

Syntax:

smctl help [command]
smctl [command] --help

smctl info

Display information about the connected SAP Service Manager instance.

Syntax:

smctl info [flags]

Aliases: info, i

Flags:

Output: Service Management URL and authenticated user account.

---

smctl version

Display SMCTL version information.

Syntax:

smctl version [flags]

Aliases: version, v

Example:

smctl version
# Output: Service Management Client 0.0.1

---

Documentation Links

• Installation: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/installing-the-service-manager-control-smctl-command-line-tool-93532bd.md
• Login: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/login-a8ed7cf.md
• Provision: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/provision-b327b66.md
• Bind: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/bind-f53ff26.md
• Get Instance: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/get-instance-24fb85c.md
• Get Binding: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/get-binding-8495036.md
• List Offerings: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/list-offerings-8a0659f.md
• List Plans: https://github.com/SAP-docs/sap-btp-service-manager/blob/main/docs/Service-Consumption/SAP-Service-Manager/list-plans-b0e4863.md
• GitHub Releases: https://github.com/Peripli/service-manager-cli/releases