RAP, the RESTful Application Programming Model, is SAP’s framework for building service-based applications on modern ABAP. It combines data modeling, business logic, and service exposure into a structured development model that is designed for ABAP Cloud and Clean Core architectures. Instead of creating tightly coupled custom code, developers define entities, behavior, and APIs in a way that is more upgrade-stable and easier to govern.
In cyber security, RAP matters because it can reduce the attack surface created by ad hoc SAP extensions. A well-built RAP service uses controlled interfaces, authorization checks, and predictable data access, which helps prevent unintended exposure of business data and risky direct table access. In real environments, attackers often look for weak custom services, missing authorization logic, or poorly designed APIs. Defenders use RAP to standardize service design, limit custom logic, and keep security and maintainability aligned as SAP systems move toward modern ABAP development.