Salesforce Docs Portal

February 2025

SCAPI, OCAPI, and SLAS

For more detailed release information, see B2C Commerce API Release Notes.

SCAPI:

  • Runtime version update for internal SCAPI supporting applications. No customer impact is anticipated.
    • API request path validation now identifies empty path segments and handles them consistently across various components.
    • Support added for CORS headers with ports.
    • Update to the 01/07/2025 correlation ID header announcement: The new sfdc_correlation_id response header for the SCAPI Correlation ID is now fully enabled for SCAPI on all instances:
      • On sandbox and development instances, the deprecated x-correlation-id response header is no longer returned.
      • On staging and production instances, the deprecated x-correlation-id response header is still available, but is subject to removal in a future release.
    • Security updates. No customer impact is anticipated.
    • With B2C Commerce version 25.2:
      • The Shopper Search and Shopper Products APIs now support Page Meta Tag Rules. You can create Page Meta Tags in Business Manager (Merchant Tools > SEO > Page Meta Tag Rules) using a rule-based approach to enhance storefront pages with unique meta tag content and increase the SEO value across Product List Pages (PLPs) and Product Detail Pages (PDPs). A new optional page_meta_tags expansion, which controls the inclusion of page meta tags rules, has been added to /product-search and /products.

OCAPI:

  • With B2C Commerce version 25.2:
    • Fixed an issue with the createScapiRemoteInclude() script functionality when used in combination with a Shopper API. As an example, this led to a 500 exception during the use of the Shopper Baskets API.

SLAS:

  • SLAS 4xx Logs are now available in Log Center. Log information includes the correlationID, which you can use for end-to-end request tracking.
  • SLAS now supports custom query parameters for the /login endpoint.
  • SLAS now supports merging claims for Azure IDP.
  • The SLAS PasswordReset flow no longer requires PKCE. You can now make password reset requests using the new, optional hint query parameter instead of a Proof Key for Code Exchange (PKCE) code_challenge and code_verifier. For details, see Password Reset.
  • Improved error handling and validation to return more meaningful error messages for Auth0 IDP.
  • The channel_id (site) parameter is now required when requesting a guest access token with a grant_type of client_credentials. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the channel_id parameter in the client credential call in guest flows. For details, see Guest Tokens.
    • The original schedule was 09/01/2024 for all sandbox tenants and 10/01/2024 for all other non-production tenants. We will now implement this change for all non-production tenants starting 02/10/2025.
  • As of 02/10/25, we are now strictly enforcing the documented rate limit of 25 requests per minute (RPM) for the /jwks endpoint.
  • In preparation for the removal of the SLAS_ORGANIZATION_ADMIN (Account Manager API-Client) and SLAS_TRUSTED_AGENT_READ_ONLY (Account Manager User) Account Manager roles, these roles were removed from the SLAS code base. Because these roles were never made available for SLAS production use, no customer impact is anticipated.
  • Additional performance improvements included.