Error while consuming AICore SDK for deployment and embedding generation

[shanathshetty]

Ask the Question

Issue Description

We are migrating to SDK from AI Client for one of our existing GenAI feature and facing the issue w.r.t deployment creation and embedding generation Endpoint via service instance binding.(similar issue when tried via destination also). Followed all the steps as per documentation.
Would like to verify if its a bug from SDK.

We follow multi-tenancy and we have custom ResourceGroup, configs and deployments for each tenant.

POM & Service Env Variable
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/pom.xml#L145
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/EnvoirmentofBoundService.txt

Issue with deployment creation.

Implementation .
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/src/main/java/com/sap/c4p/rm/skill/aicore/service/AIClient.java#L600

Error
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/logDeploymentCreation.png

cloud log.
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/skill-srv%20ceateDeployment.txt

Issue with Embedding generation.

Implementation.
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/src/main/java/com/sap/c4p/rm/skill/aicore/service/AIClient.java#L248

Error
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/logEmbCreation.png

cloud log
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/skill-srv%20createEmbeddings.txt

Impact
Blocked development

Both Destination instance and AICore service instance are bound to the service, please feel free if any further input required.

[newtork]

Unfortunately you didn't track the exception message (and potential suppressed exceptions). It's difficult to tell what exactly went wrong.

However I can tell the following:
The internal SAP Cloud SDK...

• successfully finds at least one service binding for aicore.
• fails to translate it to a Destination like object.

From the service bindings, it looks like your first bound instance results in an incorrect service binding payload.
Specifically if certificate-based authentication is assumed, then internal SAP Cloud SDK would expect "credential-type": "x509". Without, it's failing to interpret the first aicore service binding, resulting in an exception.

---

Therefore my suggestion would be to either remove the first service biding with the certificate, or provide full exception details, e.g. by catching and logging/printing it.

[newtork]

I checked back with the AI Core team, they will likely add the missing "credential-type" attribute soon.
In the meantime, please use only one (1) service binding. And for now, only with client-credentials only.

[shanathshetty]

Thanks a lot for the update.

As we are delivering this feature for GA in productive landscape we choose to go with certificate-based authentication for security reason. could you please share the approximate timeline for this to be supported?

Additionally, as part of a POC, we attempted to consume the SDK using client credentials. However, we encountered an issue where the deployment API initialisation does not return any response—there is neither an exception nor further execution.

Execution Log Screenshot:

Compete log:
skill-srv-2025-02-11 04_14_25.296+0000.txt

Implementation
https://github.tools.sap/Cloud4RM/Skill/blob/ca214c6e8af5b4008bf8892cd4ce8722c18c15f4/srv/src/main/java/com/sap/c4p/rm/skill/aicore/service/AIClient.java#L217

Updated env
https://github.tools.sap/Cloud4RM/Skill/blob/dev/aiSDK/srv/logs/EnvoirmentofBoundService.txt

Could you please provide any insights into this behavior? Also, let me know if any additional information is required. If needed, we can arrange a short call to go through the issue in detail.

Thanks
Shanath

[CharlesDuboisSAP]

It seems you resolved the original issue.
The latest logs don't contain any AI SDK classes in the stack-trace.
If you want to debug your code, you can create an .env file and run your application locally.

I hope this helps

[shanathshetty]

Thanks for the input.

we are more interested in consuming sdk with "credential-type" :x509 with certificate for security reasons. since our delivery would be dependent on that would you be able to comment on the approximate timeline for this to be available?

[CharlesDuboisSAP]

The credential-type choice to connect to AI Core is coming in a couple weeks at best, probably a couple of months.