Modern applications often require handling files, attachments, and media content. SAP CAP provides built-in support for managing binary data through OData media entities, associations, and service handlers.
This guide explains how to upload files, manage attachments, and handle media efficiently in CAP applications.
Why File & Media Handling Matters
CAP applications often need to support:
- Document uploads (PDF, Word, Excel)
- Images and media attachments
- Large binary files
- User-generated content
Proper handling ensures:
- Secure storage
- Efficient retrieval
- Integration with OData services
- Scalable solutions for enterprise apps
OData Media Entities
CAP uses media entities to handle binary content. Media entities are linked to standard CDS entities but store content separately.
Example: Document Entity
entity Documents @(Capabilities.MediaType) {
key ID : UUID;
name : String;
mimeType : String;
}
CAP automatically exposes:
$valueendpoint for binary data- CRUD operations for metadata (name, mimeType)
- Upload/download capabilities via OData
Uploading Files via CAP Service Handler
Example using Node.js CAP service:
const cds = require('@sap/cds');
module.exports = cds.service.impl(async function () {
const { Documents } = this.entities;
this.on('UPLOAD', async req => {
const file = req.data.file; // binary data
const metadata = {
name: req.data.name,
mimeType: req.data.mimeType
};
await INSERT.into(Documents).entries(metadata);
// Store file in database or storage service
return { status: 'success', name: metadata.name };
});
});
Handling Attachments
CAP allows associating files with other entities via associations.
Example: Product with Attachments
entity Products {
key ID : UUID;
name : String;
attachments : Composition of many ProductAttachments on attachments.product = $self;
}
entity ProductAttachments @(Capabilities.MediaType) {
key ID : UUID;
product : Association to Products;
fileName : String;
mimeType : String;
}
- Parent entity manages lifecycle of attachments
- Supports cascading deletes
- Enables
$expandqueries for metadata
Storing Media Outside the Database
For large files, storing media in the database is not efficient. Use:
- SAP BTP Object Store
- External storage services (S3, Azure Blob)
- CAP handlers to upload/download files via APIs
Example: Upload to Object Store
const objectStore = require('./objectStoreClient');
this.on('UPLOAD', async req => {
const file = req.data.file;
const key = await objectStore.upload(file, req.data.name);
await INSERT.into(Documents).entries({ name: req.data.name, mimeType: req.data.mimeType, url: key });
});
Downloading Files
Download via OData $value endpoint:
GET /odata/v4/Documents(ID)/$value
Or via custom handler:
this.on('DOWNLOAD', async req => {
const doc = await SELECT.one.from(Documents).where({ ID: req.data.ID });
const file = await objectStore.download(doc.url);
return file;
});
Security & Access Control
- Use XSUAA and RBAC for file access
- Restrict download/upload to authorized users
- Validate MIME types and file size
- Scan uploaded files for malware
Best Practices
- Use media entities for small to medium files
- Use external storage for large files (>5MB)
- Separate metadata from binary content
- Always validate and sanitize file uploads
- Implement streaming for large file transfers
- Secure APIs with scopes and roles
Real-World Example
- User uploads PDF invoice
- CAP service stores metadata in HANA Cloud
- Binary file stored in Object Store
- OData service exposes
$valuefor download - RBAC ensures only authorized users access the file
Conclusion
CAP provides robust options for file uploads, attachments, and media handling. Using media entities, compositions, and external storage, developers can build scalable, secure, and maintainable solutions for document and media management in enterprise applications.

WhatsApp us