--- schema_version: "1" id: 640d3c67cf65317d670db04b3c2ad20142e08fb7c75d3b77bf4d6e1a359dde84 title: Data Users (deprecated) collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/b2c-commerce/references/generated-api-specs/ocapi-data-users.md canonical_url: https://developer.salesforce.com/docs/commerce/b2c-commerce/references/ocapi-data-users source_site: developer.salesforce.com content_type: documentation content_hash: 6fae354ad23bcc4420318ece4f9d8c8506beed726c85a7523f1f24d337b57d8a products: - B2C Commerce - Salesforce APIs --- Data Users (deprecated) # Data Users (deprecated) Data API endpoints enable developers to build applications for merchants: Create, update, delete business objects, like products, customers, pricing and promotions or assignments. They typically provide read and write access and are designed for moderate usage. **Version:** 25.6 ## Servers * `https://{host}/s/-/dw/data/v25_6` Protocols: https. ## Security * `oauth2_application` (oauth2) Authentication flow with client ID and password with account manager. * OAuth flow application (tokenUrl: https://account.demandware.com:443/dwsso/oauth2/access\_token) * Scope x-info: Scopes are NOT supported. This is just a dummy, because the 'scopes' field is required. * `client_id` (apiKey) Add client ID for application identification. Alternative as 'client\_id' query parameter. * API key in header: x-dw-client-id ## Operations ### GET Get Users `GET /users` Operation ID: `Get Users`. Tags: users. Security: oauth2\_application. Action to get all users with no filtering. #### Parameters * `start` (query, integer (int32)) Optional start index for retrieving the items from a given index (default 0). * `count` (query, integer (int32)) Optional count for retrieving only a subset of the items (default is 25). * `select` (query, string) The property selector. #### Responses * **default** Media type: `application/json, text/xml`. Schema: `users`. ### GET Get user password expiration information `GET /users/this` Operation ID: `Get user password expiration information`. Tags: users. Security: oauth2\_application. Action to get the user password expiration information. This endpoint may return the following faults: * 401 - UserIsLockedException - If the user profile is currently locked. * 401 - UserNotAvailableException - If the user provided by the OAuth token cannot be found. #### Responses * **401** `UserIsLockedException` - If the user profile is currently locked. or `UserNotAvailableException` - If the user provided by the OAuth token cannot be found. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `user`. ### PATCH Change a Local User Password `PATCH /users/this/password` Operation ID: `Change a Local User Password`. Tags: users. Security: oauth2\_application. Action to change a local user password. This action cannot change the password for a user managed by Account Manager. This endpoint may return the following faults: * 400 - InvalidPasswordException - If the provided current user password is invalid. * 400 - PasswordNotValidForReuseException - If the same new password was set recently before. * 400 - PasswordPolicyViolationException - If the new password doesn't meet the acceptance crtiteria of a user password. * 401 - UserIsLockedException - If the user profile is currently locked. * 401 - UserNotAvailableException - If the user provided by the OAuth token cannot be found. #### Request body (required) Media type: `application/json, text/xml`. Schema: `password_change_request`. #### Responses * **400** `InvalidPasswordException` - If the provided current user password is invalid. or `PasswordNotValidForReuseException` - If the same new password was set recently before. or `PasswordPolicyViolationException` - If the new password doesn't meet the acceptance crtiteria of a user password. Media type: `application/json, text/xml`. Schema: `fault`. * **401** `UserIsLockedException` - If the user profile is currently locked. or `UserNotAvailableException` - If the user provided by the OAuth token cannot be found. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `user`. ### GET Get User `GET /users/{login}` Operation ID: `Get User`. Tags: users. Security: oauth2\_application. Action to get a user. This endpoint may return the following faults: * 404 - UserNotFoundException - If no user with the specified login could be found. #### Parameters * `login` (path, string, required) login of the user Minimum length: 1. #### Responses * **404** `UserNotFoundException` - If no user with the specified login could be found. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `user`. ### PUT Create User `PUT /users/{login}` Operation ID: `Create User`. Tags: users. Security: oauth2\_application. Action to create or overwrite a user. If a user with the given login already exists, the existing user will be overwritten. If no such login exists, a new user is created. This endpoint may return the following faults: * 400 - ExternalIdAlreadyExistsException - If another user with the same external id already exists. * 400 - InvalidCredentialsException - If password or external id of the user are invalid. * 400 - LocalUserCreationException - If creation of a local Business Manager user is not allowed with the current server settings. * 400 - PasswordPolicyViolationException - If the password doesn't meet the acceptance crtiteria of a user password. * 400 - UnknownLocaleException - If either the Preferred UI Locale or the Preferred Data Locale are unknown. * 400 - IdConflictException - If the login in the request URL is different from the login in the request body. * 403 - UserOperationNotAllowedException - If creation or replacement of a user with the given login is not allowed. #### Parameters * `login` (path, string, required) login of the user Minimum length: 1. #### Request body (required) Media type: `application/json, text/xml`. Schema: `user`. #### Responses * **400** `ExternalIdAlreadyExistsException` - If another user with the same external id already exists. or `InvalidCredentialsException` - If password or external id of the user are invalid. or `LocalUserCreationException` - If creation of a local Business Manager user is not allowed with the current server settings. or `PasswordPolicyViolationException` - If the password doesn't meet the acceptance crtiteria of a user password. or `UnknownLocaleException` - If either the Preferred UI Locale or the Preferred Data Locale are unknown. or `IdConflictException` - If the login in the request URL is different from the login in the request body. Media type: `application/json, text/xml`. Schema: `fault`. * **403** `UserOperationNotAllowedException` - If creation or replacement of a user with the given login is not allowed. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `user`. ### DELETE Delete User `DELETE /users/{login}` Operation ID: `Delete User`. Tags: users. Security: oauth2\_application. Action to delete a single user. This endpoint may return the following faults: * 404 - UserNotFoundException - If no user with the specified login could be found. #### Parameters * `login` (path, string, required) login of the user Minimum length: 1. #### Responses * **204** * **404** `UserNotFoundException` - If no user with the specified login could be found. Media type: `application/json, text/xml`. Schema: `fault`. ### PATCH Update User `PATCH /users/{login}` Operation ID: `Update User`. Tags: users. Security: oauth2\_application. Action to update a user. Note: The `locked` flag and the user `password` cannot be updated with this resource. This endpoint may return the following faults: * 400 - ExternalIdAlreadyExistsException - If another user with the same external id already exists. * 400 - ExternalIdNullException - If the external id is explicitly set to null for an externally managed user * 400 - UnknownLocaleException - If either the Preferred UI Locale or the Preferred Data Locale are unknown. * 400 - IdConflictException - If the login in the request URL is different from the login in the request body. * 403 - UserOperationNotAllowedException - If creation or replacement of a user with the given login is not allowed. * 404 - UserNotFoundException - If no user with the specified login could be found. #### Parameters * `login` (path, string, required) login of the user Minimum length: 1. #### Request body (required) Media type: `application/json, text/xml`. Schema: `user`. #### Responses * **400** `ExternalIdAlreadyExistsException` - If another user with the same external id already exists. or `ExternalIdNullException` - If the external id is explicitly set to null for an externally managed user or `UnknownLocaleException` - If either the Preferred UI Locale or the Preferred Data Locale are unknown. or `IdConflictException` - If the login in the request URL is different from the login in the request body. Media type: `application/json, text/xml`. Schema: `fault`. * **403** `UserOperationNotAllowedException` - If creation or replacement of a user with the given login is not allowed. Media type: `application/json, text/xml`. Schema: `fault`. * **404** `UserNotFoundException` - If no user with the specified login could be found. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `user`. ### GET Get access key `GET /users/{login}/access_key/{scope}` Operation ID: `Get access key`. Tags: users. Security: oauth2\_application. Gets a single access key. This endpoint may return the following faults: * 403 - UserNotExternallyManagedException - When the specified user is not externally managed. * 403 - UserAccessForbiddenException - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. * 404 - AccessKeyNotFoundException - If the access key does not exist. * 404 - AuthenticationScopeNotFoundException - If the access scope does not exist. * 404 - UserNotFoundException - If no user was found for the login. #### Parameters * `login` (path, string, required) The login of the user. Minimum length: 1. * `scope` (path, string, required) The scope of the access key. #### Responses * **403** `UserNotExternallyManagedException` - When the specified user is not externally managed. or `UserAccessForbiddenException` - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. Media type: `application/json, text/xml`. Schema: `fault`. * **404** `AccessKeyNotFoundException` - If the access key does not exist. or `AuthenticationScopeNotFoundException` - If the access scope does not exist. or `UserNotFoundException` - If no user was found for the login. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `access_key_details`. ### PUT Creates access key `PUT /users/{login}/access_key/{scope}` Operation ID: `Creates access key`. Tags: users. Security: oauth2\_application. Creates a single access key (and removes an existing one for the same scope). This endpoint may return the following faults: * 400 - AccessKeyIsExpiredException - If the acces key is already expired. * 403 - UserNotExternallyManagedException - When the specified user is not externally managed. * 403 - UserAccessForbiddenException - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. * 404 - AuthenticationScopeNotFoundException - If the access scope does not exist. * 404 - UserNotFoundException - If no user was found for the login. #### Parameters * `login` (path, string, required) The login of the user. Minimum length: 1. * `scope` (path, string, required) The scope of the access key. #### Request body Media type: `application/json, text/xml`. Schema: `empty_body`. #### Responses * **400** `AccessKeyIsExpiredException` - If the acces key is already expired. Media type: `application/json, text/xml`. Schema: `fault`. * **403** `UserNotExternallyManagedException` - When the specified user is not externally managed. or `UserAccessForbiddenException` - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. Media type: `application/json, text/xml`. Schema: `fault`. * **404** `AuthenticationScopeNotFoundException` - If the access scope does not exist. or `UserNotFoundException` - If no user was found for the login. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `access_key_details`. ### DELETE Delete access key `DELETE /users/{login}/access_key/{scope}` Operation ID: `Delete access key`. Tags: users. Security: oauth2\_application. Deletes a single access key. This endpoint may return the following faults: * 403 - UserNotExternallyManagedException - When the specified user is not externally managed. * 403 - UserAccessForbiddenException - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. * 404 - AccessKeyNotFoundException - If the access key does not exist. * 404 - AuthenticationScopeNotFoundException - If the access scope does not exist. * 404 - UserNotFoundException - If no user was found for the login. #### Parameters * `login` (path, string, required) The login of the user. Minimum length: 1. * `scope` (path, string, required) The scope of the access key. #### Responses * **204** * **403** `UserNotExternallyManagedException` - When the specified user is not externally managed. or `UserAccessForbiddenException` - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. Media type: `application/json, text/xml`. Schema: `fault`. * **404** `AccessKeyNotFoundException` - If the access key does not exist. or `AuthenticationScopeNotFoundException` - If the access scope does not exist. or `UserNotFoundException` - If no user was found for the login. Media type: `application/json, text/xml`. Schema: `fault`. ### PATCH Enable / disable access key `PATCH /users/{login}/access_key/{scope}` Operation ID: `Enable / disable access key`. Tags: users. Security: oauth2\_application. Enables / disables a single access key. This endpoint may return the following faults: * 403 - UserNotExternallyManagedException - When the specified user is not externally managed. * 403 - UserAccessForbiddenException - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. * 404 - AccessKeyNotFoundException - If the access key does not exist. * 404 - AuthenticationScopeNotFoundException - If the access scope does not exist. * 404 - UserNotFoundException - If no user was found for the login. #### Parameters * `login` (path, string, required) The login of the user. Minimum length: 1. * `scope` (path, string, required) The scope of the access key. #### Request body Media type: `application/json, text/xml`. Schema: `access_key_update_request`. #### Responses * **403** `UserNotExternallyManagedException` - When the specified user is not externally managed. or `UserAccessForbiddenException` - When the user executing the request is missing the required functional permission 'Manage\_Users\_Access\_Keys'. Media type: `application/json, text/xml`. Schema: `fault`. * **404** `AccessKeyNotFoundException` - If the access key does not exist. or `AuthenticationScopeNotFoundException` - If the access scope does not exist. or `UserNotFoundException` - If no user was found for the login. Media type: `application/json, text/xml`. Schema: `fault`. * **default** Media type: `application/json, text/xml`. Schema: `access_key_details`. ## Schemas ### users Document representing a list of users. * `count` (_integer (int32)_) The number of returned documents. * `data` (_array of user_) The list of users. * `expand` (_array of string_) The list of expands set for the search request. Expands are optional. * `next` (_string_) The URL of the next result page. * `previous` (_string_) The URL of the previous result page. * `select` (_string_) The fields that you want to select. * `start` (_integer (int32)_) The zero-based index of the first search hit to include in the result. Minimum: 0. * `total` (_integer (int32)_) The total number of documents. _Example_ ``` { "count": 2, "data": [ { "disabled": false, "email": "ocapi@example.com", "first_name": "Ocapi", "last_login_date": "2017-01-12", "last_name": "RoleDude", "locked": false, "login": "roleDude", "preferred_data_locale": "default", "preferred_uilocale": "default" }, { "disabled": false, "email": "ocapi@example.com", "first_name": "Ocapi", "last_name": "SecondRoleManager", "locked": false, "login": "secondRoleManager", "preferred_data_locale": "en", "preferred_uilocale": "de" } ], "select": "(**)", "start": 0, "total": 2 } ``` ### fault Document representing a fault message that is returned whenever the HTTP status code is greater than or equal to 400 (which indicates an error). * `arguments` (_object_) A map that provides fault arguments. Data can be used to provide error messages on the client side. Additional properties: `object`. * `cause` (_cause_) * `display_message_pattern` (_string_) The localized display message pattern, if the request parameter display\_locale was given * `message` (_string_) The message text of the java exception. * `stack_trace` (_string_) * `type` (_string_) The name of the java exception. ### user Document representing a user. * `creation_date` (_string (date-time)_) * `disabled` (_boolean_) Flag whether the user is disabled. * `email` (_string_, required) The email address. Maximum length: 256. * `external_id` (_string_) The external id. This attribute is only valid when the user uses centralized authentication. Maximum length: 256. * `first_name` (_string_) The first name. Maximum length: 256. * `last_login_date` (_string (date)_) Last login of the user. * `last_modified` (_string (date-time)_) * `last_name` (_string_, required) The last name. Maximum length: 256. * `link` (_string_) URL that is used to get this instance. This property is computed and cannot be modified. * `locked` (_boolean_) Flag whether the user is locked. * `login` (_string_) The user login. Maximum length: 256. * `password` (_string_) The password. This attribute is only used to set the password upon user creation. This attribute is only valid when the user does not use centralized authentication. * `password_expiration_date` (_string (date-time)_) The user password expiration time * `password_modification_date` (_string (date-time)_) The time, where the password was last modified * `preferred_data_locale` (_string_) The effective preferred data locale of the user. A locale is only considered if the user has at least read permission on the locale. * `preferred_ui_locale` (_string_) The preferred UI locale of the user. * `roles` (_array of string_) List of role ids the user is assigned to. _Example_ ``` { "disabled": false, "email": "someUserl@example.com", "external_id": "e2b07841-1db0-a5c1-9a1f-f6a02b6fa25c", "first_name": "John", "last_name": "Doe", "locked": false, "login": "someUser", "password_expiration_date": "2016-01-14T16:48:07Z", "password_modification_date": "2016-04-14T16:48:07Z", "preferred_data_locale": "default", "preferred_ui_locale": "en-US", "roles": [ "FirstRole", "SecondRole" ] } ``` ### password\_change\_request * `current_password` (_string_, required) The current user password Minimum length: 1. * `password` (_string_, required) The new user password Minimum length: 1. ### access\_key\_details Access key information * `access_key` (_string_) The newly created access key (only available upon access key creation, missing otherwise). * `enabled` (_boolean_) True when the access key is enabled. * `expiration_date` (_string (date-time)_) The date when the access key expires. _Example_ ``` { "enabled": true, "expiration_date": "2023-04-05T10:19:59.408Z" } ``` ### empty\_body Type: `any`. ### access\_key\_update\_request Request body to enable / disable an access key. * `enabled` (_boolean_) True when the access key should be enabled. ### cause * `cause` (_cause_) * `message` (_string_) * `type` (_string_)