SCAPI release, SCAPI fixes, and SLAS Release with the B2C Commerce 24.9.1 release:
For more detailed release information, see B2C Commerce API Release Notes.
SCAPI/OCAPI Release
With B2C Commerce version 24.9.1
- Added a read-only, optional
hashedLoginfield in the response as applicable for the following Shopper Customers API endpoints:PATCH /customers/{customerId} (updateCustomer)GET /customers/{customerId} (getCustomer)POST /customers (registerCustomer)
SLAS Service Protection
- As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
- A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same USID (Unique Shopper ID) within a short span of time. This returns a 409 HTTP response. SLAS Trusted System on Behalf (TSOB) logins will have a service protection window of 3 seconds.
- To help you verify the authenticity of callback requests, SLAS provides a SlasCallbackToken (JWT) for each passwordless login and password reset callback that SLAS sends. For more details, see Verify the SLAS Password Action Callback.
- With B2C Commerce version 24.9.1, added a read-only, optional hashedLogin field in the response as applicable for the following Shopper Customers API endpoints:
PATCH /customers/{customerId} (updateCustomer)GET /customers/{customerId} (getCustomer)POST /customers (registerCustomer)
SLAS:
- To enhance security for the Shopper Login API Access Service (SLAS), a
channel_id(site) parameter is now required when requesting a guest access token with agrant_typeofclient_credentials. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include thechannel_id parameterin the client credential call in guest flows using the schedule in Guest Tokens.