Skip to content
ERP Preflight

Clean Core Object Guard

Token-based ABAP Cloud / Clean Core static analysis and released-object classification

Content reviewed September 26, 2026

Engine
CLEAN_CORE_OBJECT_GUARD
Domain
Migration & Clean Core
Version
2.2.0
Target releases
S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Accepted formats
ABAP, ZIP, JSON

Input contract

Custom ABAP source (report, class, function group include), an abapGit repository ZIP containing *.abap files, or an object list JSON {'objects': [{'name', 'type': TABL|FUNC|CLAS|DDLS}]} for release-status lookup.

Required input

  • ABAP source with at least one statement, an abapGit ZIP, or an object list
  • Released-object knowledge snapshot: clean-core-released-objects/2408.1
  • configuration.abap_references accepts AST-derived references (kind TABLE|CDS|FUNCTION_MODULE|CLASS|DYNAMIC|INTERFACE|TYPE|METHOD|FIELD, name, operation READ|WRITE|CALL, artifact, line, column) from an external analyzer such as abaplint (not bundled); they are classified by the same rules, capped at RULE_DERIVED.
  • SQL access classification: INSERT / UPDATE / MODIFY / DELETE targets are database tables where the statement form says so; ambiguous short forms are resolved by the DATA / TYPES / FIELD-SYMBOLS / parameter declarations in scope, then by the knowledge snapshot, and only then by naming convention (a DB-write verdict on that heuristic basis is RULE_DERIVED, never VERIFIED). metrics.sqlAccess lists every decision.
  • configuration.released_objects (sent by the API from the latest immutable knowledge-graph snapshot of the official SAP Cloudification Repository) takes precedence over the static list for the objects it covers; the snapshot id is recorded in every finding (knowledgeGraphSnapshotId). Objects in state 'deprecated' are reported as CLEAN_CORE_DEPRECATED_OBJECT_USED (with the successor the snapshot names).
  • Release-state verdicts resting on the curated static list are capped at RULE_DERIVED (CURATED_UNVERIFIED knowledge); only exact-release snapshot verdicts can be VERIFIED.

Finding codes

Finding codes (10)

  • CLEAN_CORE_DIRECT_DB_MUTATIONDefault severity: BlockerCategory: MIGRATION_CLEAN_CORE

    Direct write to an SAP standard table

    Remediation: Never INSERT/UPDATE/MODIFY/DELETE SAP tables: use the released RAP business object (EML MODIFY ENTITIES) or released API of the owning application; direct writes bypass validations and are blocked in ABAP Cloud.

  • CLEAN_CORE_DIRECT_DB_ACCESSDefault severity: CriticalCategory: MIGRATION_CLEAN_CORE

    Direct read of an SAP standard table

    Remediation: Replace the SELECT on the standard table with the released (C1) CDS view named as successor (e.g. MARA -> I_Product); if none is released, request one via the Customer Influence portal or read via a released API.

  • CLEAN_CORE_OBSOLETE_SYNTAXDefault severity: CriticalCategory: MIGRATION_CLEAN_CORE

    Obsolete or cloud-forbidden ABAP statement

    Remediation: Refactor the statement as described in the finding; it is not part of the ABAP Cloud language version.

  • CLEAN_CORE_UNRELEASED_APIDefault severity: CriticalCategory: MIGRATION_CLEAN_CORE

    Call to a function module not released for cloud development

    Remediation: Replace the call with the released successor named in the finding (Cloudification Repository). Function modules absent from the released list must be treated as unreleased until SAP releases them.

  • CLEAN_CORE_UNRELEASED_CLASSDefault severity: CriticalCategory: MIGRATION_CLEAN_CORE

    Use of a class not released for cloud development

    Remediation: Replace the class with the released successor (e.g. CL_BCS -> CL_BCS_MAIL_MESSAGE); SAP GUI / ALV classes have no ABAP Cloud equivalent and require a Fiori UI.

  • CLEAN_CORE_DEPRECATED_OBJECT_USEDDefault severity: MajorCategory: MIGRATION_CLEAN_CORE

    Use of a deprecated SAP object

    Remediation: Replace the deprecated object with the successor named in the finding (Cloudification Repository). Deprecated objects stay usable for now but SAP can withdraw them in a later release; plan the switch before the next upgrade and re-run the analysis.

  • CLEAN_CORE_DYNAMIC_CALL_UNVERIFIABLEDefault severity: MajorCategory: MIGRATION_CLEAN_CORE

    Dynamic call target cannot be verified

    Remediation: Dynamic targets (FROM (lv_tab), CALL FUNCTION lv_fm, CALL METHOD (…)) cannot be checked statically. Replace them with static calls, or restrict the possible values to released objects and document the allow-list; ABAP Cloud checks dynamic targets only at runtime.

  • CLEAN_CORE_UNRELEASED_OBJECTDefault severity: MajorCategory: MIGRATION_CLEAN_CORE

    Reference to an object not in the released-object snapshot

    Remediation: Verify the object's release state in ADT (Properties > API State) or the Cloudification Repository; use the released successor or a custom CDS view on released views.

  • CLEAN_CORE_UNRELEASED_TYPE_REFERENCEDefault severity: MajorCategory: MIGRATION_CLEAN_CORE

    Type reference to a DDIC object not released for cloud development

    Remediation: Type the data object with the released successor named in the finding (e.g. TYPE mara -> TYPE i_product, TYPE mara-matnr -> a released data element or CDS field) or a local type; ABAP Cloud rejects typing against unreleased tables and structures at syntax check.

  • CLEAN_CORE_OBJECT_RELEASEDDefault severity: InfoCategory: MIGRATION_CLEAN_CORE

    Object is released for cloud development

    Remediation: No action: the object is released (C1) in the knowledge snapshot used for this analysis.

Input validation codes (5)

  • CLEAN_CORE_ARCHIVE_REJECTEDDefault severity: MajorCategory: INPUT_VALIDATION

    Archive rejected by ingestion safety limits

    Remediation: The archive exceeded the 100:1 expansion ratio, 500 MB total size, entry-count or 2-level nesting limit, or contained path traversal / encrypted members. Upload a flat, unencrypted archive of the export files. No verdict was produced. Re-export the artifact in one of the formats accepted by Clean Core Object Guard (ABAP, ZIP, JSON) and re-run the analysis.

  • CLEAN_CORE_INVALID_INPUTDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact does not match the engine input contract

    Remediation: Provide the artifact type documented for this engine; unrelated or structurally invalid documents are rejected. No verdict was produced. Re-export the artifact in one of the formats accepted by Clean Core Object Guard (ABAP, ZIP, JSON) and re-run the analysis.

  • CLEAN_CORE_PARSE_ERRORDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact could not be parsed

    Remediation: Fix the syntax error at the reported line/column (or re-export the file unmodified from SAP). No verdict was produced. Re-export the artifact in one of the formats accepted by Clean Core Object Guard (ABAP, ZIP, JSON) and re-run the analysis.

  • CLEAN_CORE_PAYLOAD_TOO_LARGEDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact exceeds the size limit

    Remediation: Split the export (e.g. per package, company code or date range) so each upload stays under the service payload limit. No verdict was produced. Re-export the artifact in one of the formats accepted by Clean Core Object Guard (ABAP, ZIP, JSON) and re-run the analysis.

  • CLEAN_CORE_INSUFFICIENT_INPUTDefault severity: InfoCategory: INPUT_VALIDATION

    Required input missing

    Remediation: Supply every input the engine's contract marks as required (see the engine catalog entry). No verdict was produced. Re-export the artifact in one of the formats accepted by Clean Core Object Guard (ABAP, ZIP, JSON) and re-run the analysis.

Back to the documentation
Clean Core Object Guard — ERP Preflight Docs