Update from SAP DITA CMS (squashed):

commit 0a408ece0d0b1ea46d58f1bb434813099af58196
Author: REDACTED
Date:   Tue Apr 28 11:24:43 2026 +0000

    Update from SAP DITA CMS 2026-04-28 11:24:43

    Project: dita-all/bex1621329160251
    Project map: d3e749bbac3d4f728c12228db6629c45.ditamap
    Output: loio7f3353325512486fb7f82ce960a9573a
    Language: en-US
    Builddable map: e3519d9ca1494d8499d42deaa663c18b.ditamap

commit 50f36ec78877958f2023a1bf2f2df5db2c09dc0f
Author: REDACTED
Date:   Tue Apr 28 11:24:40 2026 +0000

    Update from SAP DITA CMS 2026-04-28 11:24:40

    Project: dita-all/bex1621329160251
    Project map: d3e749bbac3d4f728c12228db6629c45.ditamap
    Output: loiodaa66b2ef49f48539fa2882d82d5b619
    Language: en-US
    Builddable map: f17fa8568d0448c685f2a0301061a6ee.ditamap

commit d2847e3bf8a9744095e42a44464ba612d4aa574e
Author: REDACTED
Date:   Tue Apr 28 07:32:54 2026 +0000

    Update from SAP DITA CMS 2026-04-28 07:32:54

    Project: dita-all/bex1621329160251
    Project map: d3e749bbac3d4f728c12228db6629c45.ditamap

##################################################
[Remaining squash message was removed before commit...]

Author: ditaccms-bot

docs/sap-ai-core/add-a-git-repository-b668176.md

@@ -16,14 +16,14 @@ You can use your own git repository to version control your SAP AI Core template
 
 ## Prerequisites
 
--   You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+-   You've completed the initial setup.
 
 -   You have access to a git repository over the Internet.
 -   You've generated a personal access token for your git repository. For more information, see [Create a Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
 -   If you want to onboard a git repository hosted on GitLab, make sure that the repository URL contains the `.git` suffix.
 -   Secrets aren't permitted in your repository. If secrets are used, it isn't possible to synchronize content.
 
--   You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+-   You've completed the initial setup.
 
 
 > ### Note:  
@@ -98,14 +98,14 @@ Create an application to sync your folders. For more information, see [Create an
 
 ## Prerequisites
 
--   You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+-   You've completed the initial setup.
 
 -   You have access to a git repository over the Internet.
 -   You've generated a personal access token for your git repository. For more information, see [Create a Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
 -   If you want to onboard a git repository hosted on GitLab, make sure that the repository URL contains the `.git` suffix.
 -   Secrets aren't permitted in your repository. If secrets are used, it isn't possible to synchronize content.
 
--   You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+-   You've completed the initial setup.
 
 
 > ### Note:  

docs/sap-ai-core/administration-7937fc1.md

@@ -6,12 +6,19 @@ Creating secrets for external programs and tools, that are used with SAP AI Core
 
 Using SAP AI Core alongside external tools such as GitHub, Docker and Amazon Web Services S3 storage leverages the benefits of version control, containerization, and cloud storage. Your content is made available remotely, if you have a stable internet connection.
 
-Administration is a one-time procedure, but steps can be repeated, if necessary, for example to remove or add a tool.
+You only need to complete the administration steps once. However, you can repeat steps if, for example, you want to add or remove a tool.
 
 > ### Note:  
-> You must have completed the initial setup tasks before configuring your SAP AI Core instance. For more information, see [Initial Setup](initial-setup-38c4599.md).
+> You must have completed the initial setup tasks before configuring your SAP AI Core instance.
 
 -   **[Manage Resource Groups](manage-resource-groups-8aae6cb.md "A resource group is a unique dedicated namespace or workspace environment, where users can create or add configurations, executions,
 		deployments, and artifacts. They are used for running training jobs or model servers.")**  
 A resource group is a unique dedicated namespace or workspace environment, where users can create or add configurations, executions, deployments, and artifacts. They are used for running training jobs or model servers.
+-   **[Manage mTLS Certificate Secrets](manage-mtls-certificate-secrets-200810f.md "")**  
+
+
+**Related Information**  
+
+
+[Initial Setup](initial-setup-38c4599.md "Get started with SAP AI Core using the standard procedures for the SAP BTP, Cloud Foundry environment or Kyma environment.")
 

docs/sap-ai-core/consume-mtls-certificate-secrets-6845793.md

@@ -0,0 +1,113 @@
+<!-- loio684579369a5146a7be8f46a2bf1e8ff7 -->
+
+# Consume mTLS Certificate Secrets
+
+You can consume mTLS certificate secrets in your workloads to authenticate securely with external services that require mutual TLS.
+
+The `mTLS` certificate secrets can be mounted as volumes in your execution or deployment containers. The secret provides a certificate and private key in PEM format. Your workload uses these files to send mTLS-authenticated requests to external services.
+
+> ### Note:  
+> `mTLS` certificate secrets can only be consumed as volume mounts. You can't use them as environment variables.
+
+
+
+## Mount an mTLS Certificate Secret as a Volume
+
+To mount the certificate and key files in your workload container, define a volume referencing the secret and a corresponding volume mount in your workflow or serving template.
+
+The secret contains two data keys:
+
+-   `tls.crt`— the PEM-encoded X.509 client certificate
+-   `tls.key` — the PEM-encoded private key
+
+You can project these keys to custom file paths by using the `items` field.
+
+**Example workflow template:**
+
+```
+
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: my-mtls-workflow
+  annotations:
+    scenarios.ai.sap.com/name: "my-scenario"
+    executables.ai.sap.com/name: "my-executable"
+spec:
+  entrypoint: main
+  templates:
+    - name: main
+      inputs:
+        parameters:
+          - name: mtlsSecretName
+      volumes:
+        - name: mtls-cert-volume
+          secret:
+            secretName: "{{inputs.parameters.mtlsSecretName}}"
+            items:
+              - key: tls.crt
+                path: client.crt
+              - key: tls.key
+                path: client.key
+      container:
+        image: my-image:latest
+        volumeMounts:
+          - name: mtls-cert-volume
+            mountPath: /mnt/mtls
+            readOnly: true
+```
+
+Inside the container, the following files are available:
+
+-   `/mnt/mtls/client.crt` — the client certificate
+-   `/mnt/mtls/client.key` — the private key
+
+Your application can use these files to configure an mTLS-authenticated HTTP client. For example, in Python:
+
+```
+
+import requests
+response = requests.get(
+    "https://external-service.example.com/api/data",
+    cert=("/mnt/mtls/client.crt", "/mnt/mtls/client.key")
+)
+      
+```
+
+
+
+## Parameterize the Secret Name
+
+You can parameterize the secret name so that it's provided during execution creation instead of being hardcoded. Use the `inputs.parameters` mechanism:
+
+```
+
+inputs:
+  parameters:
+    - name: mtlsSecretName
+      
+```
+
+When creating the execution through the AI API, provide the parameter value:
+
+```
+
+{
+    "parameterBindings": [
+        {
+            "key": "mtlsSecretName",
+            "value": "my-mtls-cert"
+        }
+    ]
+}
+      
+```
+
+
+
+## Additional Information
+
+-   Only `mTLS` certificate secrets that belong to the same resource group as the execution or deployment can be mounted. The platform validates this during admission.
+-   If the referenced secret doesn't exist or doesn't belong to the same resource group, the workload is rejected.
+-   After certificate rotation, see [Rotate an mTLS Certificate Secret](rotate-an-mtls-certificate-secret-e427cc3.md), the mounted files update automatically. If your application caches the certificate in memory, you must restart the workload to use the new certificate.
+

docs/sap-ai-core/create-a-generic-secret-1831845.md

@@ -16,7 +16,7 @@ A generic secret authorizes SAP AI Core to use your resource group without expos
 
 ## Prerequisites
 
-You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+You've completed the initial setup.
 
 You have access to a public-facing Docker registry over the internet. It isn't possible to use a Docker registry behind a VPN or corporate network.
 
@@ -94,7 +94,7 @@ curl --location --request POST "$AI_API_URL/v2/admin/secrets" \
 
 ## Prerequisites
 
-You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+You've completed the initial setup.
 
 You have access to a public-facing Docker registry over the internet. It isn't possible to use a Docker registry behind a VPN or corporate network.
 

docs/sap-ai-core/create-a-resource-group-01753f4.md

@@ -23,7 +23,7 @@
 
 ## Prerequisites
 
-You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+You've completed the initial setup.
 
 You have access to a public-facing Docker registry over the internet. It isn't possible to use a Docker registry behind a VPN or corporate network.
 
@@ -61,7 +61,7 @@ curl --location --request POST "$AI_API_URL/v2/admin/resourceGroups" --header "A
 
 ## Prerequisites
 
-You've completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+You've completed the initial setup.
 
 You have access to a public-facing Docker registry over the internet. It isn't possible to use a Docker registry behind a VPN or corporate network.
 

docs/sap-ai-core/create-an-mtls-certificate-secret-d3a4678.md

@@ -0,0 +1,116 @@
+<!-- loiod3a467832f8f40439dc62323bb919270 -->
+
+# Create an mTLS Certificate Secret
+
+Create an mTLS certificate secret so that your workloads can make mutually authenticated TLS \(mTLS\) requests to external services.
+
+
+
+## Prerequisites
+
+Make sure that you completed the initial setup. For more information, see [Initial Setup](initial-setup-38c4599.md).
+
+
+
+## Context
+
+An `mTLS` certificate secret instructs SAP AI Core to obtain an X.509 client certificate from the SAP BTP Certificate Service on your behalf. Unlike generic secrets, where you provide the credential payload, SAP AI Core generates both the certificate and the private key.
+
+You can mount the generated certificate in executions or deployments to enable mTLS-authenticated requests to external services that trust the certificate's subject DN.
+
+`mTLS` certificate secrets are scoped to a single resource group. They do not support main-tenant scope, tenant-wide scope, or shared resource groups.
+
+When you create the secret, the response includes the `subjectDN`. You must configure trust for this subject DN on the external service before authentication succeeds.
+
+You can optionally specify a `commonName`. If you omit it, SAP AI Core uses the secret name as the common name. The common name appears in the Common Name field of the certificate’s subject distinguished name.
+
+> ### Note:  
+> Creation is asynchronous. After you send a successful `POST` request \(HTTP 202\), the certificate may take a few moments to become available. Use a `GET` request to verify readiness before you run an execution or deployment that mounts the secret.
+
+
+
+## Procedure
+
+1.  Send a POST request to the endpoint <code><code>$AI_API_URL/v2/admin/mtlsCertificateSecrets</code> </code>.
+
+2.  Include the `AI-Resource-Group` header to specify the resource group.
+
+    **Minimal request \(common name defaults to secret name\):**
+
+    ```
+    curl --location --request POST "$AI_API_URL/v2/admin/mtlsCertificateSecrets" \
+    --header "Authorization: Bearer $TOKEN" \
+    --header "Content-Type: application/json" \
+    --header "AI-Resource-Group: default" \
+    --data-raw '{
+        "name": "my-mtls-cert"
+    }'
+    ```
+
+    **Request with a custom common name:**
+
+    ```
+    curl --location --request POST "$AI_API_URL/v2/admin/mtlsCertificateSecrets" \
+    --header "Authorization: Bearer $TOKEN" \
+    --header "Content-Type: application/json" \
+    --header "AI-Resource-Group: default" \
+    --data-raw '{
+        "name": "my-mtls-cert",
+        "data": {
+            "commonName": "my-service-client"
+        }
+    }'
+    ```
+
+    > ### Note:  
+    > The secret name must match the pattern `^[a-z0-9\-\.]+$` and be at most 252 characters. A common name can be up to 64 characters.
+
+
+
+
+## Results
+
+The service returns HTTP `202 Accepted` and includes the issued certificate’s subject DN.
+
+> ### Output Code:  
+> ```
+> 202 Accepted
+> {
+>     "name": "my-mtls-cert",
+>     "message": "...",
+>     "subjectDN": "C=DE, O=SAP SE, OU=SAP Cloud Platform Clients, OU=<subaccount-ou>, L=<locality-hash>, CN=my-service-client"
+> }
+> ```
+
+Use the returned `subjectDN` to configure trust on the external service.
+
+<a name="task_cl5_cjc_q3c"/>
+
+<!-- task\_cl5\_cjc\_q3c -->
+
+## Using a Third-Party API Platform
+
+
+
+## Procedure
+
+1.  Send a POST request to `{{apiurl}}/v2/admin/mtlsCertificateSecrets.`
+
+2.  Select *raw* for the request body and enter the JSON payload.
+
+    ```
+    
+    {
+        "name": "my-mtls-cert",
+        "data": {
+            "commonName": "my-service-client"
+        }
+    }
+                            
+    ```
+
+3.  Set the `AI-Resource-Group` header to the target resource group name.
+
+4.  Send the request.
+
+