BTP & Integrationintermediate

BTP Event Mesh Part 2: Queues, Subscriptions and Security

Key takeaway

Configure Event Mesh: service instance with a service descriptor (namespace, options, topic and queue rules), queues and topic subscriptions, webhooks for push delivery, OAuth client credentials for clients, and least-privilege rules for publish/consume.

Explanation

📌 KEY POINTS
✅ The service descriptor defines the instance name, namespace and rules for which topics/queues a client may publish or subscribe to.
✅ Queues are created and subscribed to topics (wildcards possible).
✅ Webhooks push messages from queues to HTTP endpoints; clients can also pull.
✅ Clients authenticate with OAuth client credentials from service keys.
⚠️ Overly broad rules (e.g. publish to any topic) let one client impersonate other producers.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 1 explained concepts. Now configuration.

━━━━━━━━━━━━━━━━━━━━
▶ 1. SERVICE DESCRIPTOR

emname, namespace, options, rules.

━━━━━━━━━━━━━━━━━━━━
▶ 2. QUEUES & SUBSCRIPTIONS

Topic patterns; wildcards.

━━━━━━━━━━━━━━━━━━━━
▶ 3. WEBHOOKS

Push to HTTPS; authentication.

━━━━━━━━━━━━━━━━━━━━
▶ 4. CLIENT AUTH

Service keys; OAuth tokens.

━━━━━━━━━━━━━━━━━━━━
▶ 5. RULES

Publish/subscribe filters; least privilege.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Create an instance with a descriptor.
Create a queue with a topic subscription.
Add a webhook and publish a test event.

✅ CHECKPOINT: webhook receives the event.

Code example

ABAP Code

===== SERVICE DESCRIPTOR ====={  "emname": "acme-orders",  "namespace": "acme/orders/v1",  "options": { "management": true, "messagingrest": true, "messaging": true },  "rules": {    "topicRules": { "publishFilter": ["${namespace}/*"], "subscribeFilter": ["${namespace}/*", "default/sap.s4.beh/*"] },    "queueRules": { "publishFilter": ["${namespace}/*"], "subscribeFilter": ["${namespace}/*"] }  }} ===== QUEUE & SUBSCRIPTION =====Queue acme/orders/v1/crm-updates → subscription acme/orders/v1/SalesOrder/Created

Real project scenario

A project team configured a webhook but received nothing; the queue had no topic subscription matching the producer's topic. Correcting the subscription pattern fixed delivery.

Common mistakes

Broad publish rules.
Shared service keys.
Wrong subscription patterns.
Unauthenticated webhooks.
Inconsistent namespaces.

Best practices

Least-privilege rules.
Key per client.
Test subscriptions.
Secure webhooks.
Namespace conventions.

Interview angle

Questions: "What is the service descriptor?", "How do queues get events?", "How do clients authenticate?"
Strong answer: descriptor, queues/subscriptions, webhooks, auth, rules.

Practice this lesson

Quick check

1. What is the main purpose of the namespace assigned to an SAP BTP Event Mesh service instance?

2. How does a client application typically authenticate when calling the REST messaging API of an SAP BTP Event Mesh service instance?

3. Besides the messaging API used to send and receive events, which other REST API category does SAP BTP Event Mesh expose for administrative tasks such as creating queues or managing subscriptions programmatically?

Interview questions

1. How would you apply Event Mesh in a real SAP project? Walk through the design or implementation approach.

Answer it in your own words first, then compare.

2. Set up Event Mesh for an orders application with several consumers.