September 2025

SCAPI and SLAS

For more detailed release information, see B2C Commerce API Release Notes.

SCAPI:

With B2C Commerce version 25.10:

• The CORS configuration API now supports the configuration of allowed origins with schemes other than HTTP and HTTPS.
• Shopper Customers v1.1.1
• • Added an optional parameter for making a default customer payment instrument during creation.
  • Now returns the default flag when retrieving payment instruments using the get /customer and get/customer/payment-instrument/{id} endpoints.
• Added a new, read-only Custom API status report that provides:
  • Registration status of your Custom APIs. When you activate a code version containing Custom APIs, this endpoint generates a report that contains comprehensive details about each endpoint's registration outcome, including status, configuration details, and error diagnostics when registration fails.
  • Real-time endpoint monitoring: Get immediate feedback on whether your Custom API endpoints successfully registered as ACTIVE or failed with NOT_REGISTERED status, eliminating the need to manually search through logs for troubleshooting.
  • Comprehensive endpoint details: Each endpoint response includes complete metadata, such as API name and version, cartridge name, HTTP method, implementation script, OpenAPI schema file, site ID, security scheme, and detailed error information for failed registrations.
  • Flexible filtering capabilities: Query all endpoints or filter by registration status to focus on problematic endpoints, with support for organization-level visibility across all sites and cartridges in your B2C Commerce instance.
• New Shopper Configuration API
  • A read-only API that returns merchant-configured instance and site-specific property details including, but not limited to, site ID, name, status, locales , currencies, timezone, and certain enabled features, such as Salesforce Payments.
  • Each configuration value contains a configuration type detailing if it is global- or site-specific.
  • As B2C Commerce evolves, additional instance- and site-specific configuration details will be added to this API.
• Introduced the new dw.order.mergeBasket hook to standardize and simplify basket merging customization. You can invoke this hook using the transferBasket endpoint with the new merge=true parameter. This ensures that the same merge script can be used consistently across all relevant functionalities, unifying the previous discrepancies between controller and REST API merging strategies. We recommend this method for merging, because other merging methods are now deprecated.
• For the Shopper Search API productSearch endpoint, updated the select parameter documentation, including the example.
• Added a download link for each SCAPI OAS specification on the respective API summary page.
• Added the Granular Replication API endpoint for publishing a product, price table, and content asset. Publishing an item is only available from STG to PRD and is not testable on sandboxes. This will be available for use when 25.10 is rolled out on PIG instances.
• With the Custom API endpoint, you can now list your custom APIs on an instance via a user-friendly and secure approach and obtain real-time feedback on endpoint registration status, including successful registrations and failed attempts with error codes.
• The Shopper Configuration API is a read only API that returns details of how the merchant configured both instance and site specific properties including, but not limited to, site id, name, status, locales , currencies, timezone, and certain enabled features, such as Salesforce Payments. Each configuration value contains a configuration type detailing if it is global or site specific. As commerce cloud evolves, additional instance and site specific configuration details be added to this API.

SLAS:

• You can now simultaneously maintain two active secrets, a primary and a secondary, and rotate them without service interruption. See Client Secret Management and Rotation.
• To enhance security and align with OAuth 2.1 specifications, reuse of the same refresh_token for public clients is now prohibited. Implement one-time usage for the refresh_token, using the new refresh_token issued by SLAS on each /token call. For details, see Access Tokens and Refresh Tokens.