---
schema_version: "1"
id: d0d960907babfdb4e8617469c9462d429093b6a45a706d63a75466d28d62eafe
title: B2C Commerce API Release Notes
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/references/about/about.md
canonical_url: https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: fe923423e678bc68f580987ecf9eaa23802492cf5a9134b62c934af452904d14
products:
  - B2C Commerce API
  - Salesforce APIs
---
# B2C Commerce API Release Notes

Use B2C Commerce API (also known as Salesforce Commerce API or SCAPI) to build headless commerce experiences.

- For status updates and trust notifications, go to the [B2C Commerce Status Page](https://status.salesforce.com/products/B2C_Commerce_Cloud).
- For the general B2C Commerce release notes, go to [Salesforce Help](https://help.salesforce.com/s/articleView?id=commerce.b2c_rn_release_notes.htm&language=en_US&type=5).
- To view the change policy, see: [Change Policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy).
- To use the SDK to **make your first call quickly**, see the [Quick Start](/docs/commerce/commerce-api/guide/api-and-sdk-demo.html).
- For details about **auth**, see [Authorization](/docs/commerce/commerce-api/guide/authorization.html).
- To learn about **using B2C Commerce API**, see the [Guides](/docs/commerce/commerce-api/guide).
- To learn about **using correlation IDs**, see [Investigate by Correlation ID](/docs/commerce/commerce-api/guide/scapi-logs-request-tracking.md#investigate-by-correlation-id).
- To **browse the API endpoints**, use the left navigation. B2C Commerce API is broken into two main groups: Shopper APIs and Admin APIs. All Shopper API groups start with _Shopper_. For details about the differences, see [Get Started](/docs/commerce/commerce-api/guide).
- Note: All secrets and tokens are fictional and provided as placeholders only.
- Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations.

## 10/13/2026

### SLAS Release

- SLAS infrastructure updates for US-East. No customer impact is anticipated.
  - Schedule:
    - US-East: October 13, 2026 at 9:00 PM MT (October 14, 2026 at 3:00 AM UTC)

## 10/08/2026

### SLAS Release

- SLAS infrastructure updates for EU-Central. No customer impact is anticipated.
  - Schedule:
    - EU-Central: October 8, 2026 at 5:00 PM MT (11:00 PM UTC)
- mTLS Enforcement
  - To enhance the security of the SLAS authentication service, we’re enabling mutual TLS (mTLS) client-certificate enforcement at the SLAS gateway. Starting October 7, 2026, SLAS rejects any request that reaches the SLAS origin without a valid client certificate, including a request that bypasses the SCAPI zone.
  - Who is affected:
    - No action is required for integrations that use the standard, published Commerce Cloud SLAS endpoints through the SCAPI zone. This path is the supported integration path and continues to work without changes.
    - Action is required for integrations that connect directly to the SLAS origin and bypass the SCAPI zone, for example integrations that use a hardcoded origin hostname, IP address, or custom network path. SLAS rejects these requests after mTLS enforcement is enabled.
  - Schedule:
    - AP2: October 7, 2026
    - AP3: October 8, 2026
    - EU: October 12, 2026
    - US-East: October 15, 2026

## 10/07/2026

### SCAPI Release

Updated APIs:

- [Assignments](https://developer.salesforce.com/docs/commerce/commerce-api/references/assignments?meta=Summary) 1.0.39
  - `Schedule` no longer requires `startDate`, `endDate`, or `recurrence`. Omitting a bound leaves that side of the validity window open.
  - `timeFrom` and `timeTo` accept `HH:mm` or `HH:mm:ss`. Seconds are ignored and set to 0.
- [Campaigns](https://developer.salesforce.com/docs/commerce/commerce-api/references/campaigns?meta=Summary) 1.1.1
  - Promotion campaign assignment `rank` must be null or a multiple of 10 from 0 to 100.
  - `Schedule` no longer requires `startDate` or `endDate`. Omitting a bound leaves that side of the validity window open.
  - `timeFrom` and `timeTo` accept `HH:mm` or `HH:mm:ss`. Seconds are ignored and set to 0.
- [Environments](https://developer.salesforce.com/docs/commerce/commerce-api/references/environments?meta=Summary) 1.0.5
  - `updateEnvironment` (`PATCH /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}`) now updates server-side rendering configuration in addition to `displayName`. The request is a partial update: only the supplied fields change, and at least one field is required. `displayName` is no longer required.
  - The environment resource and the update request now include `ssrRegion`, `ssrArchitecture` (`x86` or `arm64`), `ssrExternalHostname`, `ssrExternalDomain`, `ssrWhitelistedIps`, `ssrProxyConfigs` (up to 8 proxies; `path`, `host`, and `https` only), `isProduction`, `allowCookies`, `preserveProxyUserAgent`, `enableSourceMaps`, `logLevel` (`trace`, `debug`, `info`, `warn`, `error`, `fatal`), `distributedTracing`, `distributedTracingSamplingRate`, and `certificateId`.
  - For an environment served through eCDN, update `ssrExternalHostname`, `ssrExternalDomain`, and `ssrWhitelistedIps` in Business Manager. The API rejects those changes.
  - `allowCookies` can't be changed on a Storefront Next environment. Cookies stay enabled.
  - Selecting `x86` for `ssrArchitecture` is rejected when the organization isn't permitted to configure SSR architecture, and after x86 end of life. Use `arm64`.
  - `certificateId` is rejected when the certificate is missing, not validated, doesn't match the hostname domain, or the environment uses the default Managed Runtime domain.
- [Preferences](https://developer.salesforce.com/docs/commerce/commerce-api/references/preferences?meta=Summary) 1.2.3
  - Site `cartridges` is now read-only. It returns the effective cartridge path, including system cartridges and the site's custom cartridges.
  - Added `customCartridges`, the configurable custom cartridge path. It does not include system cartridges.
- [Schemas](https://developer.salesforce.com/docs/commerce/commerce-api/references/scapi-schemas?meta=Summary) 1.0.3
  - Schema search accepts `cartridgeName` to filter Custom API schemas. The schema listing includes `cartridgeName` for Custom APIs.
- [Shopper Agents](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-agents?meta=Summary) 1.1.5
  - Guest shopper calls can use `ShopperClientContextToken` with the `sfdc_usid` header. Registered shoppers continue to use `ShopperToken`.
- [Shopper Context](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-context?meta=Summary) 1.1.4
  - Guest shopper calls can use `ShopperClientContextToken` with the `sfdc_usid` header. Registered shoppers continue to use `ShopperToken`.
  - Error responses for these operations use `application/problem+json`.
- [Storefronts](https://developer.salesforce.com/docs/commerce/commerce-api/references/storefronts?meta=Summary) 1.0.4
  - `ssrRegion` values use underscores instead of hyphens. For example, `us-east-2` is now `us_east_2`.
  - `DELETE /organizations/{organizationId}/storefronts/{storefrontId}` returns 409 (`StorefrontBusyErrorResponse`) when a deletion of that storefront is already in progress.

- Updated list of cached API responses: `/shopper-experience` and `/custom` are temporarily not cached in SCAPI CDN cache for its specific handling of authentication.
- Infrastructure change for API validation on Staging and Production instances only. No customer impact is anticipated.
- Bug fixes and internal improvements.

## 09/29/2026

### SLAS Release

- [Auth Admin](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=Summary)
  - The [Delete Shopper endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=deleteShopper) (`DELETE /tenants/{tenantId}/customers/{customerId}`) now accepts tenant-scoped Account Manager automation tokens, in addition to service-admin and organization-admin credentials.
    - To use it, call the endpoint with a `client_credentials` Account Manager token that has the CCDX_SBX_USER role and is scoped to the target tenant. Tokens without a matching tenant scope are rejected. Deletion behavior, including the rate limit of 100 requests per minute, is otherwise unchanged.
- mTLS Enforcement
  - To enhance the security of the SLAS authentication service, we’re enabling mutual TLS (mTLS) client-certificate enforcement at the SLAS gateway. Starting October 6, 2026, according to the new per-region schedule listed below, any request reaching the SLAS origin without a valid client certificate—including requests that bypass the SCAPI zone—will be rejected.
  - Who is affected:
    - No action required: for integrations using the standard, published Commerce Cloud SLAS endpoints through the SCAPI zone. This is the supported integration path and will continue to work without changes.
    - Action required: for integrations that connect directly to the SLAS origin and bypass the SCAPI zone—for example, by using hardcoded origin hostnames/IP addresses or a custom network path. These requests will be rejected once mTLS enforcement is enabled.
  - Schedule:
    - AP2: October 6, 2026
    - AP3: October 8, 2026
    - EU: October 12, 2026
    - US-East: October 15, 2026

## 09/25/2026

### SCAPI Release

New APIs:

- [Deployments](https://developer.salesforce.com/docs/commerce/commerce-api/references/deployments?meta=Summary) 1.0.5
  - Upload versioned server-side rendering (SSR) bundles and deploy them to a storefront environment on Managed Runtime.
  - Endpoints:
    - `GET/POST /organizations/{organizationId}/storefronts/{storefrontId}/bundles`
    - `GET/POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/deployments`
    - `GET /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/deployments/{deploymentId}`
- [Environments](https://developer.salesforce.com/docs/commerce/commerce-api/references/environments?meta=Summary) 1.0.3
  - SCAPI-native access to Managed Runtime environments for a storefront: create, list, update display name, delete, clone, and promote to primary.
  - Also manages environment variables, CDN cache invalidations, header-based access control, and URL redirects.
  - Environment create/delete are asynchronous. Poll the environment by ID.
  - Endpoints:
    - `GET/POST /organizations/{organizationId}/storefronts/{storefrontId}/environments`
    - `POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/clone`
    - `GET/PATCH/DELETE /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}`
    - `PUT /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/primary`
    - `POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/cache-invalidations`
    - `GET/PATCH /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/environment-variables`
    - `GET/POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/access-control-headers`
    - `GET/DELETE /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/access-control-headers/{accessControlHeaderId}`
    - `GET/POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/redirects`
    - `GET/PATCH/DELETE /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/redirects/{redirectId}`
    - `POST /organizations/{organizationId}/storefronts/{storefrontId}/environments/{environmentId}/redirects/actions/clone`
- [Storefronts](https://developer.salesforce.com/docs/commerce/commerce-api/references/storefronts?meta=Summary) 1.0.2
  - Added SCAPI-native provisioning for Storefront Next and partial administration for PWA Kit. This API replaces the Business Manager and Data API setup flow so that the CLI and tooling can automate the storefront lifecycle.
  - Create and delete operations are asynchronous. The API returns immediately. Poll the storefront by ID until setup completes.
  - Endpoints:
    - `GET /organizations/{organizationId}/storefronts`
    - `POST /organizations/{organizationId}/storefronts`: The first request returns 202. A retry with the same name returns 409 while the record exists.
    - `GET /organizations/{organizationId}/storefronts/{storefrontId}`
    - `PATCH /organizations/{organizationId}/storefronts/{storefrontId}`: Replaces the assigned sites list.
    - `DELETE /organizations/{organizationId}/storefronts/{storefrontId}`: The first request returns 202. After the storefront is deleted, a retry returns 404.

Updated APIs:

- [Auth Admin](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=Summary) 1.19.0
  - Log out up to 50 shoppers in one request by `loginId`. This request revokes refresh tokens and inactivates access tokens across all sessions. Shoppers must sign in again. Passwords are unchanged.
  - The API skips duplicate `loginId` values as `not_processed`. The response reports `success`, `failure`, or `not_processed` for each `loginId`.
  - New endpoint:
    - `POST /tenants/{tenantId}/batch-logout`
  - For details, see [Log Out Multiple Shoppers](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-batch-logout.html).
- [Experiences](https://developer.salesforce.com/docs/commerce/commerce-api/references/experiences?meta=Summary) 1.4.0
  - Added admin retrieval of Page Designer types for a site. The `siteId` query parameter is required.
  - New endpoints:
    - `GET /organizations/{organizationId}/component-types`: Returns component types with group, region definitions, and attribute definitions.
    - `GET /organizations/{organizationId}/page-types`: Returns page types with region definitions, attribute definitions, and supported aspect types.
- [Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=Summary) 1.6.4
  - Added normalized, read-only payment enrichment on existing order resources. The API omits these objects when no data is available. Historical orders remain readable.
  - `PaymentInstrument.fraudDecisions`: `preAuthorization` and `postAuthorization`.
  - `PaymentInstrument.paymentDetails`: `type`, `brand`, `last4`, `walletType`, `expirationMonth`, `expirationYear`, `token`, `tokenType`, `accountHolderName`, `bin`, `dpanLast4`, `issuingCountry`, and `fundingType`.
  - `PaymentTransaction.transactionDetails`: `cvcResult`, `avsResult`, `threeDSResult`, `threeDSVersion`, `threeDSTransactionId`, `electronicCommerceIndicator`, `approvalCode`, `reasonCode`, and `processorResponseText`.
- [Price Books](https://developer.salesforce.com/docs/commerce/commerce-api/references/price-books?meta=Summary) 1.1.0
  - Added create, read, update, and delete (CRUD) for price books, price book entries, and site assignments. Search remains available. List endpoints return paginated results without a search query.
  - Price books created through this API are always type `standard`. For `feed_based` price books, metadata remains editable. Writes to price book entries are rejected.
  - Supports quantity-tier pricing through `priceTables` (absolute amount or percentage discount, each with a validity window). A PATCH replaces the `priceTables` array.
  - New endpoints:
    - `GET /organizations/{organizationId}/price-books`
    - `GET/PUT/PATCH/DELETE /organizations/{organizationId}/price-books/{priceBookId}`
    - `GET /organizations/{organizationId}/price-books/{priceBookId}/price-book-entries`
    - `GET/PUT/PATCH/DELETE /organizations/{organizationId}/price-books/{priceBookId}/price-book-entries/{productId}`
    - `GET /organizations/{organizationId}/price-books/{priceBookId}/site-assignments`
    - `PUT/DELETE /organizations/{organizationId}/price-books/{priceBookId}/site-assignments/{siteId}` — `PUT` is idempotent: HTTP 201 when newly assigned, HTTP 200 when already assigned.
- [Promotions](https://developer.salesforce.com/docs/commerce/commerce-api/references/promotions?meta=Summary) 1.2.0
  - `GET/PUT/PATCH /promotions/{id}/compatibility`
  - `GET/PUT/PATCH/DELETE /promotions/{id}/discount-rule`
- [Replications](https://developer.salesforce.com/docs/commerce/commerce-api/references/replications?meta=Summary) 1.0.8
  - Documentation update for timeouts and RFC 7807 error handling.
- [Shopper Baskets V2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary) 2.13.4
  - `OrderPaymentInstrument` now includes shopper-safe, read-only `fraudDecisions` (`preAuthorization` only) and `paymentDetails` (`type`, `brand`, `last4`, `walletType`, `expirationMonth`, `expirationYear`, `token`, `tokenType`, and `accountHolderName`).
- [Shopper Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary) 1.10.0
  - Completes saved-payment setup after the provider succeeds (registered customer ShopperToken only). `paymentMethodReferenceSetupId` is the provider setup identifier (for example a Stripe SetupIntent ID).
  - `gatewayProperties` is no longer required on payment-method-reference setup.
  - `CustomerPaymentMethodReference` now returns read-only `accountHolderName` (SEPA), and `brand` / `expiryMonth` / `expiryYear` (cards).
  - Embedded Product includes `slug` and `primaryCategory`.
  - New endpoint:
    - `POST /customers/{customerId}/payment-method-references/actions/complete`
- [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.22.4
  - Added the same `fraudDecisions` and `paymentDetails` enrichment as Shopper Baskets V2.
  - `OmsReturnProductItem.reasonText`: optional free-text note alongside the coded return reason.
- [Shopper Payments](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-payments?meta=Summary) 1.7.0
  - `POST /payment-instruments/balance` is provider-generic instead of gift-card-specific.
  - The request now requires `provider` and `providerProperties` instead of `giftCard`. Don't send PCI data (PAN). Use a client-side token or encrypted fields.
- [Shopper Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) 1.13.0
  - When the Enable Shopper SEO Slug (CFT) feature toggle is on, Shopper Products returns an SEO slug for the request locale, generated from the site’s storefront URL rules. `getCategory` and `getCategories` accept a category ID or `slug`, and the `category` and each `parentCategoryTree` entry include `slug`. A product includes `slug` only when `expand=slug` is requested, and its primary category includes `slug` when `expand=primary_category` is requested. The toggle is off by default, so existing requests continue to return categories by ID and omit `slug`. To enable the feature toggle, contact Customer Support.
- [Shopper Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) 1.15.0
  - Added `SuggestedProduct.slug` for SEO-friendly suggestion links. This is the slug segment, not a full URL.

## 09/23/2026

### SCAPI Release

- Configured SCAPI CDN caching ahead of an upcoming release to reduce response times for non-personalized Custom APIs.
- Bug fixes and internal improvements.
- Infrastructure change for API validation on Sandbox and Development instances only.

### SLAS Release

- SLAS Infrastructure Deployment:
  - During the deployment of required infrastructure updates, registered shopper logins and token refresh calls may have elevated response times and 5xx errors for less than one minute. Our internal simulations of production peak traffic resulted in less than 15 seconds of performance degradation, with no impact on existing sessions and guest shoppers.
  - The deployment is scheduled at these times (UTC):
    - AP2: September 23, 16:00
    - AP3: September 23, 17:00
    - EU-Central: September 23, 23:00
    - US-East: September 24, 03:00

## 09/22/2026

### SLAS Release

- Infrastructure updates.
- Fixed an intermittent bad signature verifier error on /userinfo that could occur during tenant signing key rotation. Tokens signed with the previous key are now accepted during the rotation window, and token handling has been strengthened to ensure signatures are fully verified.
- **Fixed Trusted-Agent guest flow authorization errors**: Resolved a 403 SSO Unauthorized error that could occur in the Trusted-Agent guest flow (/trusted-agent/callback → /token) when client-state pass-through was enabled. Guest sessions now complete successfully in this scenario.
- **Improved IDP error message clarity**: Updated IDP error messages returned as 412 responses to clearly distinguish between missing configuration fields and IDP HTTP errors. There is no behavioral change, and detailed error message exposure remains controlled by the existing configuration setting.
- **mTLS Enforcement**
  - To enhance the security of the SLAS authentication service, we’re enabling mutual TLS (mTLS) client-certificate enforcement at the SLAS gateway. Starting October 6, 2026, according to the new per-region schedule listed below, any request reaching the SLAS origin without a valid client certificate—including requests that bypass the SCAPI zone—will be rejected.
  - Who is affected:
    - No action required: for integrations using the standard, published Commerce Cloud SLAS endpoints through the SCAPI zone. This is the supported integration path and will continue to work without changes.
    - Action required: for integrations that connect directly to the SLAS origin and bypass the SCAPI zone—for example, by using hardcoded origin hostnames/IP addresses or a custom network path. These requests will be rejected once mTLS enforcement is enabled.
  - Schedule:
    - AP2: October 6, 2026
    - AP3: October 8, 2026
    - EU: October 12, 2026
    - US East: October 15, 2026

## 08/26/2026

### SCAPI Release

- Prepared standard cacheable endpoints for SCAPI CDN caching to reduce response times for Shopper API traffic.

### SLAS Release

- SLAS Admin Batch Logout: Admin users can now log out up to 50 shoppers in a single request, invalidating their sessions and refresh tokens. Existing single-shopper logout functionality remains unchanged. For details, see [Log Out Multiple Shoppers](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-batch-logout.html).
- The SLAS Admin [Delete Shopper](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=deleteShopper) endpoint is now rate limited to 100 requests per minute per tenant by default. Requests exceeding the limit receive HTTP 429 responses and should be retried after backing off. For details, see [Delete Shopper Rate Limiting](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-best-practices.html#delete-shopper-rate-limiting).
- SLAS now forwards `c_*` custom headers to ECOM on the `/login` endpoint, enabling per-request context for third-party security and bot mitigation solutions. For details, see [Custom Header Forwarding](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-best-practices.html#custom-header-forwarding).
- The OAuth `state` parameter is now preserved end-to-end through the [Trusted Agent On Behalf](https://developer.salesforce.com/docs/commerce/sfra/guide/slas-trusted-agent.html) (TAOB) flow, enabling consistent state handling across the authentication flow. For details, see [Preserve OAuth State in Trusted Agent On Behalf Flows](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-best-practices.html#preserve-oauth-state-in-trusted-agent-on-behalf-flows).
- SLAS Admin idle-session timeout and Account Manager JWT acceptance window are now extended to 30 minutes, reducing unnecessary session expirations.
- **[Refresh Token Service Protection](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-best-practices.html#refresh-token-service-protection)**
  - To protect against refresh-token replay abuse, SLAS is limiting how frequently a single refresh token can be exchanged at `/oauth2/token`.
    - A refresh token can be exchanged up to 3 times within 60 seconds.
    - Additional attempts return HTTP 429 (Too Many Requests) with a `Retry-After` header.
    - Repeated use of revoked, expired, or unknown tokens may also result in HTTP 429 responses.
  - Action Required
    - Review your integration to avoid reusing or concurrently exchanging the same refresh token, and ensure your application properly handles HTTP 429 responses.
- **mTLS Enforcement**
  - To enhance the security of the SLAS authentication service, we’re enabling mutual TLS (mTLS) client-certificate enforcement at the SLAS gateway. Starting October 6, 2026, according to the new per-region schedule listed below, any request reaching the SLAS origin without a valid client certificate—including requests that bypass the SCAPI zone—will be rejected. This change was originally scheduled for September 1, and then September 23.
  - Who is affected:
    - No action required: for integrations using the standard, published Commerce Cloud SLAS endpoints through the SCAPI zone. This is the supported integration path and will continue to work without changes.
    - Action required: for integrations that connect directly to the SLAS origin and bypass the SCAPI zone—for example, by using hardcoded origin hostnames/IP addresses or a custom network path. These requests will be rejected once mTLS enforcement is enabled.
  - Schedule:
    - AP2: October 6, 2026
    - AP3: October 8, 2026
    - EU: October 12, 2026
    - US-East: October 15, 2026
- **Strict Client Auth Enforcement for Private Clients**
  - [Strict Client Auth](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-best-practices.html#strict-client-auth), previously optional for SLAS private clients, is scheduled to become mandatory on these dates:
    - Non-production: January 26, 2027
    - Production: February 24, 2027
  - Prior to these enforcement dates, make sure that your private clients use the following header on all `/login` and `/authorize` requests:
    - `x-slas-client-auth: Base64(client_id:client_secret)`
  - After enforcement, requests with a missing or invalid header will be rejected with 401 Unauthorized.

## 08/12/2026

### SCAPI Release

- For B2C Commerce version 26.8 or later, Custom API timeouts are now configurable. By default, Custom API requests use a gateway timeout of 60 seconds, up from the previous 10-second limit on Shopper Custom APIs. To change this default, use the [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) to set a timeout up to a maximum of 120 seconds. For Shopper-facing Custom APIs, use a 10-second timeout to keep storefronts responsive. For details, see [Timeouts and Limits](https://developer.salesforce.com/docs/commerce/commerce-api/guide/timeouts-limits.html).
- Prepared for infrastructure updates (Development and Sandbox instances only).

## 08/05/2026

### SLAS Release (US-East Region)

- Resolved an intermittent SLAS Admin UI login issue where some users encountered an HTTP 431 ("Request Header Fields Too Large").
- Improved profile linking for first-time LINE IDP sign-in: SLAS now matches an identifier returned by LINE against existing storefront profiles and links the sign-in to that profile, instead of creating a duplicate account for a shopper who already exists in your customer base. This change applies only to the first-time linking step. LINE token refresh behavior is unchanged, and linking for other identity providers (Apple, Azure, etc.) is unchanged.
- **SLAS JWT Updates**
  - The SLAS `id_token` includes a `ctg` claim.
  - The SLAS `access_token` includes a `CRM` claim.
- **Updated `aud` Claim Formatting**
  - We've updated the formatting of the OAuth token `aud` (audience) claim to use the Commerce Cloud tenant's globally unique identifier (GUID), when available, instead of the tenant ID.
  - As a best practice, applications should not validate or hardcode the specific value of the aud claim, as its format may change over time. Applications should rely on standard OAuth/OIDC token validation and use the `aud` claim only to verify that the token is intended for the receiving service, rather than matching a specific expected value.
  - **Action Required & Best Practices:** For most customers, no action is required. The addition of new JWT claims—and the reordering of existing ones—are considered non-breaking changes under our documented SLAS and SCAPI change policy. Future SLAS releases may introduce additional claims to both the `access_token` and `id_token`.
  - If your integration uses custom logic to parse the SLAS JWT, ensure your implementation follows these documented best practices:
    - Do not rely on claim ordering. As noted in SLAS documentation, integrations should not expect a fixed set or specific sequence of claims.
    - Handle new claims gracefully. Ensure your code does not throw errors when encountering new or previously undefined claims.

## 07/29/2026

### SCAPI Release

- Enable SCAPI Direct Routing grid wide. No customer impact is anticipated.

## 07/22/2026

### SLAS Release (EU, AP2, and AP3 Regions)

- Resolved an intermittent SLAS Admin UI login issue where some users encountered an HTTP 431 ("Request Header Fields Too Large").
- Improved profile linking for first-time LINE IDP sign-in: SLAS now matches an identifier returned by LINE against existing storefront profiles and links the sign-in to that profile, instead of creating a duplicate account for a shopper who already exists in your customer base. This change applies only to the first-time linking step. LINE token refresh behavior is unchanged, and linking for other identity providers (Apple, Azure, etc.) is unchanged.
- **SLAS JWT Updates**
  - The SLAS `id_token` includes a `ctg` claim.
  - The SLAS `access_token` includes a `CRM` claim.
  - Fixed a formatting issue with the existing `AUD` claim which uses the ECOM tenant Global Unique ID, when available, in place of the Tenant ID.
  - **Action Required & Best Practices:** For most customers, no action is required. The addition of new JWT claims—and the reordering of existing ones—are considered non-breaking changes under our documented SLAS and SCAPI [change policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy). Future SLAS releases may introduce additional claims to both the `access_token` and `id_token`.
  - If your integration uses custom logic to parse the SLAS JWT, ensure your implementation follows these documented best practices:
    - Do not rely on claim ordering. As noted in [SLAS documentation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens), integrations should not expect a fixed set or specific sequence of claims.
    - Handle new claims gracefully. Ensure your code does not throw errors when encountering new or previously undefined claims.

## 07/21/2026

### SCAPI Release

- [Metrics](https://developer.salesforce.com/docs/commerce/commerce-api/references/metrics?meta=Summary) 1.0.1
  - Added closed beta details to API Overview.
- [Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=Summary) 1.5.2
  - Added `POST /orders/{orderNo}/oms-status-events`.
- [Shopper Baskets V2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary) 2.11.1
  - Added extension hooks for promoting a temporary basket:
    - `sfcc.checkout.shopper-baskets.v2.baskets.basketId.actions.promote.beforePOST`
    - `sfcc.checkout.shopper-baskets.v2.baskets.basketId.actions.promote.afterPOST`
    - `sfcc.checkout.shopper-baskets.v2.baskets.basketId.actions.promote.modifyPOSTResponse`
  - Added the `expand=approaching_discounts` option on `getBasket`. This option returns the `approachingDiscounts` array (order- and shipping-level promotions) on the basket.
- [Shopper Delivery Estimates](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-delivery-estimates?meta=Summary) 1.1.0
  - Returns carrier-calculated delivery date ranges for a product at a destination postal code, enabling "Arrives by" messaging on product detail pages before checkout.
- [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.17.1
  - Guest shoppers can regain access to an order with a time-limited access code sent to the order's email address. They can then view the order and self-service their cancellations or returns without creating an account. The access code works alongside the existing `OrderViewCode`.
  - Unlike `OrderViewCode`, which grants view-only access to order details, the access code also authorizes guest cancel and return actions for the complete self-service flow.
  - New endpoint:
    - `POST /orders/{orderNo}/actions/request-access-code`
      - Generates a 6-digit access code when the supplied email matches the order. The code is valid for 15 minutes and locks after 3 failed attempts, with a cooldown before a new code can be requested. Guest orders only.
      - Code delivery uses the `sfcc.app.order.sendOrderAccessCode` hook, so you control the email template and branding.
  - These Shopper Orders endpoints accept the access code as an alternative access grant for guest orders:
    - `POST /orders/{orderNo}/lookup` — also accepts `OrderViewCode` (view-only).
    - `POST /orders/{orderNo}/actions/oms-cancel-order` — requires the access code.
    - `POST /orders/{orderNo}/actions/oms-return-order` — requires the access code.
- [Shopper Promotions](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-promotions?meta=Summary) 1.3.0
  - Added retrieval of multiple promotions by ID.
  - Added validation errors for unknown promotion IDs and invalid date ranges (start without end, end without start, end before start).
- [Sites](https://developer.salesforce.com/docs/commerce/commerce-api/references/sites?meta=Summary) 1.3.0
  - Added endpoints: `GET /sites/{siteId}/custom-cartridges` and `PUT /sites/{siteId}/custom-cartridges`.
- [Timeouts](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) 1.0.6
  - Documentation update.
- New `personalized` query parameter:
  - Controls whether personalization applies to the response. Set to `none` to opt out of personalized response handling and enable caching at the CDN layer.
  - APIs that support this parameter:
    - [Shopper SEO](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-seo?meta=Summary) 1.2.0
    - [Shopper Stores](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-stores?meta=Summary) 1.3.0
    - [Shopper Availability](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-availability?meta=Summary) 1.3.0
    - [Shopper Configurations](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-configurations?meta=Summary) 1.3.0
    - [Shopper Experience](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-experience?meta=Summary) 1.6.0
    - [Shopper Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) 1.11.1

## 07/14/2026

### SCAPI Release

- Provision dedicated short codes for on-demand sandboxes (ODS) to isolate API routing and resolve errors with the Shopper Login and API Access Service (SLAS). Previously, on-demand sandboxes shared a common short code (`kv7kzm78`). The shared short code continues to work. However, if you use SLAS hybrid authentication or encounter the error `Cannot construct SLAS session-bridge URL: no ACTIVE SCAPI short code found for this organization`, generate your dedicated short code to resolve the issue. For details, see [Base URL and Request Formation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#short-code) and [Generate a Short Code and Create an API Client ID](https://help.salesforce.com/s/articleView?id=cc.b2c_generate_a_shortcode_and_api_client_id.htm&type=5).
  - B2C Commerce is in the process of retrofitting existing on-demand sandboxes with dedicated short codes, but you can provision your own short code in the meantime.
  - See also: [Default Domain on On-Demand Sandboxes (ODS)](https://help.salesforce.com/s/articleView?id=cc.b2c_default_domain.htm&type=5).
- CORS preflight requests now contain an `Access-Control-Max-Age` header, set to 10 minutes. This prevents browsers from making unnecessary preflight requests. As a result, changes to a CORS configuration or endpoint can take up to 10 minutes to appear in preflight requests.
- Improved the resilience of the log distribution layer against automated bot attacks and extreme traffic anomalies. Previously, such incidents could exhaust your realm's Log Center quota, causing legitimate logs to become unavailable. With this update, excessive log events generated during such incidents are automatically detected and sampled down before reaching Log Center, preserving quota for meaningful log data.

## 07/07/2026

### SLAS Release

- Enhanced Passkey Management and Multi-Site Support
  - The [Get Passkey User API](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getPasskeyUserByLoginId) now includes passkey creation date, last-used timestamp, and usage count, making it easier to build enhanced passkey management experiences for shoppers.
  - Shoppers can now use a passkey registered on one storefront channel to authenticate to other channels within the same tenant, without needing to re-register their passkey.
- Enhanced Authentication Security with Verification Attempt Rate Limiting
  - Added per-shopper rate limiting for email one-time password (OTP) and passwordless authentication flows. After 6 invalid verification attempts within 10 minutes, further attempts are temporarily blocked to help protect shopper accounts from brute-force attacks.
- Corrected the `idp_access_token` returned by the `/token` endpoint for Hybrid Authentication flows to make sure that the expected identity provider access token is returned for new logins.

## 06/30/2026

### SCAPI Release

- [Metrics API](https://developer.salesforce.com/docs/commerce/commerce-api/references/metrics?meta=Summary)
  - For B2C Commerce version 26.7, this API is in closed beta and will be available on July 1, 2026.
  - Provides programmatic access to time-series operational metrics.
  - Exposes the same metrics available in the Log Center UI for ingestion by third-party monitoring tools such as Tableau and Grafana, and for observability workflows.
  - Metric category endpoints:
    - `GET /organizations/{organizationId}/metrics/overall`
      - Overall application performance metrics (platform requests, sessions, response time, emails sent, system workload).
    - `GET /organizations/{organizationId}/metrics/sales`
      - Sales and commerce metrics (orders, basket creations, and basket updates).
    - `GET /organizations/{organizationId}/metrics/ecdn`
      - eCDN performance and caching metrics (success/errors, cache hit percentage, requests, bandwidth, pageviews, and unique visitors).
    - `GET /organizations/{organizationId}/metrics/third-party`
      - Third-party service integration metrics (call counts, call duration p95, and remote exceptions).
      - Optional `thirdPartyServiceId` filter.
    - `GET /organizations/{organizationId}/metrics/scapi`
      - SCAPI request and performance metrics (request latency, response counts, and cache hit statistics).
      - Optional `apiFamily` and `apiName` filters.
    - `GET /organizations/{organizationId}/metrics/scapi-hooks`
      - SCAPI hooks execution metrics (hook execution times, hook errors).
    - `GET /organizations/{organizationId}/metrics/mrt`
      - Managed Runtime metrics (request counts, cache hit rates, error rates, Lambda invocations, and request times).
    - `GET /organizations/{organizationId}/metrics/controller`
      - Controller and pipeline metrics (total calls, average duration).
    - `GET /organizations/{organizationId}/metrics/ocapi`
      - OCAPI request and performance metrics (total calls, average duration, and total errors).
      - Optional `ocapiCategory` and `ocapiApi` filters.
  - Deployed internal routing bug fix on July 6, 2026.
- Shopper Baskets v2 2.9.0
  - These updates will be available on July 1, 2026.
  - `POST /checkout/shopper-baskets/v2/organizations/{organizationId}/baskets/{basketId}/actions/promote` promotes a temporary basket and clears its `isTemporary` flag.
  - To retrieve baskets with Salesforce Payments via PayPal, use `expand=payment_references`.
  - `PATCH /baskets/{bid}/payment-instruments/{pid}` now accepts `paymentReferenceRequest` in the request payload. This change is relevant only for Salesforce Payments.
- Stabilized and hardened internal APIs. No customer impact is anticipated.
- Prepared SCAPI to support services with a broader range of applicable tenant identifiers. No customer impact is anticipated.
- Prepared validation support in SCAPI admin use cases for merchant users, merchant agents, and custom Business Manager models. No customer impact is anticipated.

## 06/23/2026

### SCAPI Release

- [Custom Objects](https://developer.salesforce.com/docs/commerce/commerce-api/references/custom-objects?meta=Summary) 1.1.0
  - Added a search request example that demonstrates a `termQuery` on the `siteId` attribute to filter custom objects by site.
- [Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=Summary) and [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary)
  - When Salesforce Order Management (SOM) integration is enabled and the `expand=oms` parameter is requested, order detail and order lookup endpoints additionally return payment instrument data sourced from SOM.
  - Order Lookup: `GET /orders/{order_no}/lookup`
  - Shopper Orders: `GET /orders/{order_no}`
- [Shopper Auth](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=Summary) 1.50.0
  - The passwordless-token endpoint now documents Issuer Subject (`isb`) construction and its 256-character limit. Requests whose assembled `isb` exceeds 256 characters return `400 BAD_REQUEST` ("Issuer Subject length must be less than 256 characters"). For details, see [Shopper Login and API Access Service (SLAS) Overview](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
- [Shopper Experience](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-experience?meta=Summary) 1.5.2
  - New endpoint:
    - `GET /experience/shopper-experience/v1/organizations/{organizationId}/components/{componentId}`
      - Retrieve a single Page Designer component by ID.
- [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.15.0
  - New endpoints for order cancellation and returns:
    - `GET /orders/oms-meta-data`
      - Provides the cancel and return reason codes synchronized from Salesforce Order Management.
    - `POST /orders/{orderNo}/actions/oms-cancel-order`
      - Cancel an order.
    - `POST /orders/{orderNo}/actions/oms-return-order`
      - Specify items to return.
- [Shopper Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) 1.10.0
  - New endpoints:
    - `GET /product/shopper-products/v1/organizations/{organizationId}/products/{productId}/images`
      - Retrieve image data for a single product.
    - `GET /product/shopper-products/v1/organizations/{organizationId}/products/{productId}/prices`
      - Retrieve price details for a single product.
    - `GET /product/shopper-products/v1/organizations/{organizationId}/products/{productId}/promotions`
      - Retrieve active promotion details for a single product.
- [Shopper Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) 1.10.0
  - Page meta tags in search results now include a type field indicating how the storefront should render the tag: name, property, title, or jsonld. The field might not appear when the kind can't be determined.

## 06/17/2026

### SCAPI Release

- Completed Edge caching support preparation for SCAPI requests.
- SCAPI OAS specifications now allow parameter of type `header`.
- Enabled the first phase of SCAPI Direct Routing enablement for selected realms. No customer impact is anticipated.
- Fixed authentication failures for Custom APIs.

## 05/28/2026

### SCAPI Release

- [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.14.1
  - Documentation update
- [Shopper Availability](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-availability?meta=Summary)
  - `GET /product/shopper-availability/v1/organizations/{organizationId}/availability`
    - Added `sfcc.shopper-standard` scope to the endpoint.

## 05/27/2026

### SLAS Release

- SLAS OAuth2 endpoints now reject requests that contain a trailing slash or malformed path delimiters, such as `;`, `\`, or their URL-encoded equivalents, in the endpoint URL. Affected endpoints include `/oauth2/token`, `/oauth2/authorize`, and `/oauth2/login` under both `/organization/` and `/organizations/` path prefixes.
  - What to check: Make sure that your integration constructs OAuth 2.0 request URLs using the canonical path format with no trailing slash and no matrix-style path parameters. Requests using non-standard URL formats receive an HTTP `404` response.
  - Correct format example: `POST /organization/{organizationId}/oauth2/token`
- When a shopper account is deleted through SLAS, all associated passkey data — including registered passkey records and passkey credentials — is now automatically removed.
  - What this means for your integration: No action is required. Account deletion flows that call the SLAS user deletion API will now result in complete cleanup of all passkey-related data for that shopper. If your integration performs account deletion followed by re-registration flows, then passkey data is fully cleared before any new registration.
- Security and infrastructure updates. No customer impact is anticipated.

## 05/22/2026

### SCAPI Release

- [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.14.0
  - **important:** The endpoints in this section are available only on B2C Commerce instances that are integrated with Salesforce Order Management (OMS). On instances that are not integrated with OMS, calls to these endpoints return an error.
  - Added new endpoints that allow shoppers to cancel an order, request returns, and retrieve the reason codes used by both flows. All three endpoints require an authenticated shopper token.
    - `GET /orders/oms-meta-data`: Returns the cancellation and return reason codes that a storefront should present to the shopper, including the default selection for each list.
    - `POST /orders/{orderNo}/actions/oms-cancel-order`: Cancels an entire order. Partial cancellations are not supported.
    - `POST /orders/{orderNo}/actions/oms-return-order`: Requests a return for one or more product items on an order. Each requested item specifies an `itemId`, a quantity, and an optional reason.
  - Error responses for the new endpoints are served as `application/problem+json` (RFC 7807) and use typed schemas that describe the failure, for example, when a requested return quantity exceeds what is available, or when one of the supplied product item IDs is not part of the order.
  - The new endpoints support `before`, `after`, and `modifyResponse` hooks for the cancel and return operations, and a `modifyResponse` hook for the meta-data operation.

## 05/20/2026

### SCAPI Release

- New SCAPI APIs and endpoints:
  - [Shopper Availability](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=shopper-availability:Summary)
    - `GET /product/shopper-availability/v1/organizations/{organizationId}/availability`
      - Retrieve availability data for one or more products with improved caching performance.
      - This new API deprecates the `expand=availability` parameter on the [Shopper Products API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) `getProduct` and `getProducts` endpoints.
  - [Shopper Product Images](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary)
    - `GET /product/shopper-products/v1/organizations/{organizationId}/products/{productId}/images`
      - Retrieve image data for a given product ID.
      - This new API adds a `viewTypeLimit` parameter and uses a dedicated images endpoint instead of the `expand=images` parameter on the [Shopper Products API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) `getProduct` endpoint.
  - [Preferences API](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=preferences:Summary)
    - `GET`/`PATCH` `/global-preference-groups/{groupId}/{instanceType}`
      - Get and update global preference groups.
    - `GET`/`PATCH` `/site-preference-groups/{groupId}/{instanceType}`
      - Get and update site preference groups.
    - `POST` `/site-preference-groups/{groupId}/{instanceType}/preference-search`
      - Search preferences.
    - `GET` `/site-preference-groups/{groupId}/{instanceType}/preferences/{preferenceId}`
      - Get and update preferences.
  - [Inventory Lists API](https://developer.salesforce.com/docs/commerce/commerce-api/references/inventory-lists?meta=Summary)
    - `GET`/`PUT`/`PATCH`/`DELETE` `/inventory-lists/{inventoryListId}`
      - CRUD operations for inventory lists.
  - [Experiences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/experiences?meta=Summary)
    - `GET` `/slots/{slotId}/{contextType}`
      - Get a slot.
    - `POST` `/slot-search`
      - Search for slots.
    - `GET`/`PUT`/`PATCH`/`DELETE` `/slots/{slotId}/slot-configurations/{configurationId}`
      - CRUD operations for slots.
  - [Custom Objects API](https://developer.salesforce.com/docs/commerce/commerce-api/references/custom-objects?meta=Summary)
    - `GET`/`PUT`/`PATCH`/`DELETE` `/custom-objects/{objectType}/{key}`
      - Object type key operations.
    - `POST` `/custom-objects-search/{objectType}`
      - Search custom objects by object type.
    - `GET`/`PUT`/`PATCH`/`DELETE` `/sites/{siteId}/custom-objects/{objectType}/{key}`
      - Site-specific object type key operations.
  - [Stores API](https://developer.salesforce.com/docs/commerce/commerce-api/references/stores?meta=Summary)
    - `DELETE`/`PATCH`/`PUT` `/stores/{id}`
      - Additional CRUD operations for stores.
- [Shopper Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary)
  - New query parameter `imgTypes` on `productSearch`:
    - Filters product images by type with optional per-type count limits, for example, `imgTypes=large:2,small:1`.
    - Requires `expand=images` and `allImages=true`.
  - `q` parameter: The `maxLength` increases from **50** to **500**. Lexical search queries remain limited to 50 characters.
  - `limit` parameter: Adds an explicit `minimum: 1` constraint in addition to the existing `maximum: 200` and the default of 25.
  - `allImages`: Updated the parameter description to clarify that it can be combined with `imgTypes` for filtered image responses.
  - The `OrganizationId` schema and `organizationId` path parameter now use a regex pattern (`^f_ecom_[a-z]{4}_(prd|stg|dev|s[0-9]{2}|[0-9]{3})$`) instead of `minLength`/`maxLength`, with a more descriptive description referencing realm and instance identifiers.
- Prepare for OCI migration to Hyperforce in AMER and EMEA. No customer impact is anticipated.

## 05/06/2026

### SCAPI Release

- Prepare for user authorization support in SCAPI Admin APIs via Business Manager. No customer impact is anticipated.
- Update SCAPI log center messages for customer relevance and readability.
- Prepare for OCI migration to Hyperforce in APAC. No customer impact is anticipated.

## 04/28/2026

### SLAS Release

- SLAS passwordless login (with email one-time password) now includes default support for [Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-email.html#2-configure-a-domain-identity).
- Private clients now support [Strict Client Auth](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-client.html#strict-client-auth) for enhanced security and protection.
- [SCAPI authorization scopes](https://developer.salesforce.com/docs/commerce/commerce-api/guide/auth-z-scope-catalog.html) now provide expanded options for finer-grained access control of Shopper and Admin APIs. Improve storefront security while simplifying integration with predefined permissions by using the [Standard Shopper Scope](https://developer.salesforce.com/docs/commerce/commerce-api/guide/standard-shopper-scope.html).
- Security and infrastructure updates
- **Upcoming SLAS JWT enhancements:** Starting April 28, 2026, the JSON Web Token (JWT) returned by SLAS includes several enhancements.
  - The JWT returned by SLAS includes the `ssc` claim to support short code functionality.
  - The SLAS `access_token` includes a `CRM` claim.
  - The SLAS `id_token` that’s returned in the token response includes these updates:
    - The user’s email and name are used in place of the `idp_origin`.
    - The `id_token` is signed with the same tenant key as the `access_token` so the `id_token` signature can be verified. Retrieve the public key by using the `/jwks` endpoint.
    - The header now includes a `typ` claim with a value of `JWT`.
    - An `isb` claim has been added.
    - The existing `AUD` claim uses the ECOM tenant Global Unique ID, when available, in place of the Tenant ID.
  - **Action Required & Best Practices:** For most customers, no action is required. The addition of new JWT claims—and the reordering of existing ones—are considered non-breaking changes under our documented SLAS and SCAPI [change policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy). Future SLAS releases may introduce additional claims to both the `access_token` and `id_token`.
  - If your integration uses custom logic to parse the SLAS JWT, ensure your implementation follows these documented best practices:
    - Do not rely on claim ordering. As noted in [SLAS documentation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens), integrations should not expect a fixed set or specific sequence of claims.
    - Handle new claims gracefully. Ensure your code does not throw errors when encountering new or previously undefined claims.

## 04/21/2026

### SCAPI Release

New APIs and endpoints:

- [Jobs API](https://developer.salesforce.com/docs/commerce/commerce-api/references/jobs?meta=Summary)
  - POST `/jobs/{jobId}/executions`
    - Create a job execution.
    - GET `/jobs/{jobId}/executions/{id}`
      - Retrieve job execution details.
    - DELETE `/jobs/{jobId}/executions/{id}`
      - Delete a job execution.
    - POST `/job-execution-search`
      - Search job executions.
- [Roles API](https://developer.salesforce.com/docs/commerce/commerce-api/references/roles?meta=Summary)
  - GET `/roles`
    - Retrieve role information.
  - GET/PUT/DELETE `/roles/{roleId}`
    - Get, create, or delete a role by ID.
  - GET/PUT `/roles/{roleId}/permissions`
    - Get and create role permissions.
  - GET `/roles/{roleId}/users`
    - Retrieve users assigned to a specified role.
  - PUT/DELETE `/roles/{roleId}/users/{login}`
    - Assign and unassign users to roles.
  - POST `/roles/{roleId}/user-search`
    - Search user roles by login credentials.
- [Scripts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/scripts?meta=Summary)
  - GET `/code-versions`
    - List code versions.
  - PUT/GET `/code-versions/{codeVersionId}`
    - Create/Get code version details.
  - PATCH `/code-versions/{codeVersionId}`
    - Activate a code version.
  - DELETE `/code-versions/{codeVersionId}`
    - Delete a code version.
- [Shopper Agents](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-agents?meta=Summary)
  - POST `/organizations/{organizationId}/session/init`
    - Initialize an Agentforce shopper session.
- [Sites API](https://developer.salesforce.com/docs/commerce/commerce-api/references/sites?meta=Summary)
  - GET `/sites`
    - Retrieve details for all sites.
  - GET `/sites/{siteId}` - Retrieve site details by ID.
    - POST `/site-search`
      - Search sites.
- [Users API](https://developer.salesforce.com/docs/commerce/commerce-api/references/users?meta=Summary)
  - GET `/users`
    - Retrieve user information.
  - GET/PUT/PATCH/DELETE `/users/{login}`
    - Create, retrieve, update, delete (CRUD) users using login credentials.

Updated APIs and endpoints:

- [Replications API](https://developer.salesforce.com/docs/commerce/commerce-api/references/replications?meta=Summary)
  - Added support for Page Designer (PD) pages: PD pages replicate as content assets, including all their components.
- [Shopper Customers API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary)
  - Added support for saving and deleting payment method references for Salesforce Payments
    - Payment Method Reference Setup (POST `/organizations/{organizationId}/customers/{customerId}/payment-method-references/actions/setup`) — Shoppers can now save a payment method for future use.
    - Delete Payment Method Reference (DELETE `/organizations/{organizationId}/customers/{customerId}/payment-method-references/{paymentMethodReferenceId}`) Shoppers can now delete a saved payment method reference.
- [Shopper Experience API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-experience?meta=Summary)
  - POST `/qualifiers/resolve`
    - Checks user qualification for customer groups, campaigns/promotions, and data binding contexts.

## 04/15/2026

### SLAS Release

- Security Updates. No customer impact is anticipated for these changes.

### SCAPI Release

- Security updates. No customer impact is anticipated for these changes.

## 04/08/2026

### SCAPI Release

- Enabled preference-based response timeout settings for all instances types. The [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) provides self-service timeout configuration.

## 04/06/2026

### SCAPI Release

- With B2C Commerce v26.4, Business Manager displays an option for HTTP cookies for Hybrid Auth. Until further notice is provided, leave the **HTTPOnly True** setting at the default value (disabled). We will provide additional information when this setting can be enabled. For details, see [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-authentication.html#step-1-set-up-your-storefront-with-hybrid-auth).

## 03/26/2026

### SCAPI Release

- No customer impact is anticipated for these changes:
  - Security and infrastructure updates.
  - Preparation for new, upcoming SCAPI timeout handling in production environments.
  - Hook transaction handling.

## 03/24/2026

New SCAPI APIs:

- [Object Definitions](https://developer.salesforce.com/docs/commerce/commerce-api/references/object-definitions?meta=Summary):
  - System Object Types
    - `GET /system/object-types`
      - Get system object types.
    - `POST /system/object-types-search`
      - Search system object types.
    - `GET /system/object-types/{objectType}`
      - Get system object type.
  - Attribute Definitions
    - `POST /system/object-types/{objectType}/attribute-definition-search`
      - Search attribute definitions.
    - `GET /system/object-types/{objectType}/attribute-definitions`
      - Get attribute definitions.
    - `GET/PUT/PATCH/DELETE /system/object-types/{objectType}/attribute-definitions/{id}`
      - Create, Read, Update, and Delete (CRUD) attribute definition.
  - Attribute Groups
    - `POST /system/object-types/{objectType}/attribute-group-search`
      - Search attribute groups.
    - `GET /system/object-types/{objectType}/attribute-groups`
      - Get attribute groups
    - `GET/PUT/PATCH/DELETE /system/object-types/{objectType}/attribute-groups/{id}`
      - CRUD an attribute group.
  - Attribute Group Assignments
    - `PUT/DELETE /system/object-types/{objectType}/attribute-groups/{groupId}/attribute-definitions/{defId}`
      - Assign/unassign attribute definition to a group.
- New [Experiences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/experiences?meta=Summary) endpoints:
  - Library Folders
    - `GET/PUT/PATCH/DELETE /libraries/{libraryId}/folders/{folderId}`
      - CRUD a content folder.
    - `GET /libraries/{libraryId}/folders/{folderId}/sub-folders`
      - Get sub-folders.
    - `GET /libraries/{libraryId}/folders/{folderId}/content`
      - Get content assets in a folder.
  - Library Content Assets
    - `GET/PUT/PATCH/DELETE /libraries/{libraryId}/content/{contentId}`
      - CRUD a content asset.
    - `GET /libraries/{libraryId}/content/{contentId}/folders`
      - Get folder information for a content asset.
  - Library Folder Assignments
    - `GET/PUT/PATCH/DELETE /libraries/{libraryId}/folder-assignments/{contentId}/{folderId}`
      - CRUD a folder assignment.
    - `DELETE /libraries/{libraryId}/folder-assignments/{contentId}/{folderId}`
      - Delete a folder assignment.
- [Inventory Impex (OCI)](https://developer.salesforce.com/docs/commerce/commerce-api/references/impex?meta=Summary) Updates:

  - Added the `fileFormat` field to the `submitEventsActivityExport` endpoint. Use this field to change the output format to CSV or JSON.

## 03/12/2026

### Explore SCAPI and Build Custom Endpoints with the B2C DX MCP Server (Developer Preview)

Use the B2C DX Model Context Protocol (MCP) to enhance your development workflow by connecting an AI assistant, such as Claude, Cursor, or GitHub Copilot, to your B2C Commerce environment. The new B2C DX MCP server is a unified MCP that is the starting point for various development tools and storefronts. The B2C DX MCP server provides your AI assistant with real-time access to B2C Commerce APIs (SCAPI), storefront development, cartridge deployment, and Managed Runtime (MRT) deployments. For example, you can use natural language prompts to list SCAPI schemas, create a custom SCAPI endpoint, and deploy a storefront to MRT, among other things, without leaving your IDE!

**important:** The [B2C DX MCP Server](https://salesforcecommercecloud.github.io/b2c-developer-tooling/mcp/) is available as a developer preview. The B2C DX MCP Server isn’t generally available unless or until Salesforce announces its general availability in documentation or in press releases or public statements. All commands, parameters, and other features are subject to change or deprecation at any time, with or without notice. Don't implement functionality in production with these commands or tools.

## 03/11/2026

SCAPI Release

- New [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) :
  - Provides self-service timeout configuration with preference-based response timeout settings for Sandbox and Development instances types.
- Hybrid Auth flow:
  - Now returns the correct HTTP 401 response code in cases where the login failed. Previously a HTTP 500 was returned.
  - Now properly includes trusted-system authentication requests. Previously, this endpoint was not supported by Hybrid Auth.
- The ETag response header was removed, as it wasn't relevant to SCAPI.

## 03/03/2026

### SLAS Release (Originally Scheduled for 02/25/26)

- The passwordless login flow for customer registration now supports an optional customer number (`customer_no`) request parameter. See [Authorize the Passwordless Customer with Registration](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-registration.html#1-authorize-the-passwordless-customer-with-registration).
- Callbacks with no matching trusted agent record now return `400` (Bad Request) instead of `502` (Bad Gateway) for more accurate error reporting.
- Security and infrastructure updates.
- **Upcoming SLAS JWT Enhancements:** Starting March 10, 2026, the JSON Web Token (JWT) returned by SLAS will include several enhancements. We’re proactively sharing this update to give customers using custom JWT parsing logic ample time to review and update their integrations.
  - **New JWT Claims:**
    - `ssc`: Added to support short code functionality.
    - `CRM`: Added as a new standard claim.
  - **Updates to the `id_token` from the SLAS token response:**
    - User information: The user’s email and name will now be used in place of the `idp_origin`.
    - Signature verification: The `id_token` is now signed with the same tenant key as the `access_token`, allowing its signature to be verified. The public key can be retrieved using the `/jwks` [endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getJwksUri).
    - Header update: A `typ` claim with the value `JWT` has been added to the header.
    - New claim: An `isb` claim has been added.
  - **Action Required & Best Practices:** For most customers, no action is required. The addition of new JWT claims—and the reordering of existing ones—are considered non-breaking changes under our documented SLAS and SCAPI [change policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy). Future SLAS releases can introduce additional claims to both the `access_token` and `id_token`.
  - If your integration uses custom logic to parse the SLAS JWT, ensure your implementation follows these documented best practices:
    - Do not rely on claim ordering. As noted in [SLAS documentation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens), integrations should not expect a fixed set or specific sequence of claims.
    - Handle new claims gracefully. Ensure your code does not throw errors when encountering new or previously undefined claims.

## 02/25/2026

### SCAPI Release

- New APIs:
  - [Stores](https://developer.salesforce.com/docs/commerce/commerce-api/references/stores?meta=Summary)
    - `GET /stores`
      - Retrieve a list of all stores in an organization.
    - `GET /stores/{id}`
      - Retrieve information for a specific store by ID.
    - `POST /store-search`
      - Search for stores.
  - [Store Redirect Mappings](https://developer.salesforce.com/docs/commerce/commerce-api/references/store-redirect-mappings?meta=Summary)
    - `GET /store-redirect-mappings`
      - Get all store redirect mappings.
    - `POST /store-redirect-mappings/actions/bulk`
      - Create or update store redirect mappings.
    - `POST /store-redirect-mappings/actions/bulk-delete`
      - Delete store redirect mappings (batch).
    - `GET /store-redirect-mappings/{sourceStoreId}`
      - Get a specific store redirect mapping.
- API updates - [Shopper Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) - Added a new `processedQuery` field to the `productSearch` endpoint. This field lists the `appliedProcessors` used on the search phrase. Currently, this only includes Attribute Aware Search for detecting price filters. If Attribute Aware Search is enabled and executes, the `processedQuery` field is added to the response.
- Updates for which no customer impact is anticipated:
  - Reliability enhancements for internal configuration handling
  - Security infrastructure updates

## 02/24/2026

### SCAPI Release

- Starting with B2C Commerce version 26.3:
  - For the [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) and [Shopper Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary) APIs, added Salesforce Order Management (OMS) support:
    - Added expand support to allow Salesforce Order Management (OMS) data to be returned if available. If the instance isn't integrated with OMS, the `expand=oms` command is disregarded. OMS data is preferred, but B2C Commerce data is returned if an order hasn't been sent to OMS.
    - OMS data for Product Items, including the `status` and `quantityAvailableToCancel` properties, is displayed for the product items in the order.
    - OMS data for Order, including the `status` and `shipments`.
    - Shopper Orders additionally supports `expand=oms,oms_shipments` to include detailed shipment data:
      - Status
      - Provider
      - Tracking Number
      - Tracking URL
      - Expected Delivery Date
      - Actual Delivery Date
      - Shipment Items
        - Product Item ID (reference to the product item)
        - Quantity (quantity shipped for the referenced product item)
- [Shopper Payments API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-payments?meta=Summary) 1.4.0:
  - Added Adyen payment method configuration support. If an Adyen account is onboarded to Salesforce Payments, the API now returns configuration settings for Adyen based on payment methods enabled in the merchant's payment zone site.
  - Added a new, optional amount query parameter. Some payment gateways, such as Adyen, qualify or disqualify payment methods based on the transaction amount.
- [Shopper Orders API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) 1.12.0 documentation update
- Resolved an issue where custom logic utilizing the `dw.order.calculateShipping` and `dw.order.calculateTax` hooks was unintentionally bypassed or ignored during site requests.
- Fixed an issue where the SCAPI CORS configuration on production instances was overwritten with the STG configuration with a replication of domain preference.

## 02/16/2026

### SLAS Release

- **Upcoming SLAS JWT Enhancements**: As part of an upcoming SLAS update, the JSON Web Token (JWT) returned by SLAS includes the `ssc` claim to support short code functionality.
  - Future SLAS releases can introduce additional claims in the JWT, including the `access_token` and `id_token`.
  - To provide customers with ample time to review and update their integrations if needed, the changes will be enabled starting March 10, 2026.
  - The addition of new JWT claims—and reordering of existing claims—are considered non-breaking changes under our documented SLAS and SCAPI [change policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy). As noted in the [SLAS documentation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens), the JWT returned by SLAS can evolve over time, and integrations must not rely on a fixed set or order of claims. While no action is required for most customers, we're proactively sharing this update to help teams that implement custom JWT parsing logic prepare accordingly.
  - We recommend following the below best practices in your custom implementation as per our documentation. If your integration uses custom logic to parse the SLAS JWT:
    - Don't rely on claim ordering.
    - Ensure your implementation gracefully handles the presence of new or previously undefined claims without errors.

## 02/11/2026

### SCAPI Release

- [Schema API](https://developer.salesforce.com/docs/commerce/commerce-api/references/scapi-schemas?meta=Summary) bug fix. Correct API names consistent with the URL schema are now returned for these APIs:
  - `cdn-api-process-apis`: `zones`
  - `cors-preferences`: `cors`
  - `shopper-login`: `auth`
  - `slas-admin`: `auth-admin`
- Requests executed in verbose mode, for example, requests including the `sfdc_verbose` header, create `scapi-http` log entries in Log Center for all responses, while only error logs are available for non-verbose requests.

## 01/28/2026

### SCAPI Release

- New APIs and endpoints:
  - New [Inventory Lists API](https://developer.salesforce.com/docs/commerce/commerce-api/references/inventory-lists) that provides comprehensive management capabilities for product inventory records within inventory lists:
    - `GET inventory-lists/{inventoryListId}/product-inventory-records/{productId}`
      - Retrieve a product inventory record.
    - `PUT inventory-lists/{inventoryListId}/product-inventory-records/{productId}`
      - Create a product inventory record using the information provided.
    - `PATCH inventory-lists/{inventoryListId}/product-inventory-records/{productId}`
      - Update a product inventory record with the specified information.
    - `DELETE inventory-lists/{inventoryListId}/product-inventory-records/{productId}`
      - Delete a product inventory record by ID.
  - New [Experiences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/experiences) for creating and updating Page Designer pages for headless and PWA storefront management outside of Business Manager:
    - `PUT /pages/{pageId}`
      - Create or update a Page Designer page.
    - `POST slot-configurations-search`
      - Search for slot configurations.
- Bug fix for [Custom APIs](https://developer.salesforce.com/docs/commerce/commerce-api/references/custom-apis?meta=Summary) timeouts for shopper use cases. Documented [timeouts](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-apis.html#shopper-and-admin-api-endpoints) have been re-enforced.
- Updates for which no customer impact is anticipated:
  - Reliability enhancements for internal configuration handling.
  - Cleaned up obsolete feature switches and infrastructure updates.
  - Prepared for an upcoming feature to support User Authorization for SCAPI Admin APIs.
  - Security updates.
  - Prepared for routing OCI to Hyperforce.
  - Geolocation information will be set to rest session.

## 01/27/2026

### SCAPI Release

- Starting with B2C Commerce version 26.2:
  - Enhanced SCAPI verbose logging in LogCenter when `sfdc_verbose` is enabled.
    - Logged information now includes request latency for Custom APIs along with existing details.
    - Added service runtimes with request latency for granular performance tracking.
  - Checkout API updates:
    - [Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=Summary) \- 1.4.13 documentation update
    - [Shopper Basket V1](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=Summary) \- 1.9.2 documentation update
    - [Shopper Basket V2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary) \- 2.3.3
      - Added the new query parameter `populateCustomerDetails` to the `createBasket` and `transferBasket` endpoints.
      - Added fields in the `/baskets/{}/paymentInstruments` POST request for SalesforcePayments.
      - Added fields in the Basket schema for Salesforce Payments ( Basket → PaymentInstrument).
    - [Shopper Payments](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-payments?meta=Summary) \- 1.2.1 documentation update
    - [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary) \- 1.9.0
      - Added a fail order endpoint: `/orders/{}/actions/fail`
      - Added fields in the Order schema response for SalesforcePayments (Order → PaymentInstrument).
      - Added fields in the `/orders/{}/paymentInstruments` PATCH request for SalesforcePayments.
      - Added the `expand = oms` and `oms` fields.
- Starting with B2C Commerce version 26.1, Agent/OOBO is supported out of the box in Hybrid Auth with PWA Kit when using the Customer Service Center in Business Manager. See [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-authentication.html#hybrid-auth-feature-support-matrix).

## 01/21/2026 (Originally Scheduled for 01/14/2026)

### SLAS Release

- The JSON Web Token (JWT) returned by SLAS now includes an `ssc` claim for short code support.
  - The addition of new JWT claims—and reordering of existing claims—are considered non-breaking changes under our documented SLAS and SCAPI [change policy](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-get-started.html#change-policy).
  - As noted in [SLAS documentation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens), the JWT returned by SLAS may evolve over time, and integrations shouldn't rely on a fixed set or order of claims. While no action is required for most customers, we're proactively sharing this update to help teams that implement custom JWT parsing logic prepare accordingly.
  - If your integration uses custom logic to parse the SLAS JWT:
    - Don't rely on claim ordering.
    - Ensure your implementation gracefully handles the presence of new or previously undefined claims without errors.
- Use SLAS to send a registered shopper a one-time password (OTP) through email. No third-party integration is required. Email OTP support in SLAS makes it easy for shoppers to register and log in without requiring password. For details, see [Passwordless Login with Email](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-email.html) or [Implement Passwordless Login](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guides/passwordless-login.html) in the _Composable Storefront Developer Guide_.
  - You can now configure OTP size to 6 or 8 digits (8 digit is default).
- Use SLAS to authenticate shoppers securely with passkeys. Passkeys are a next-generation login experience which significantly enhance protection against fraud and unauthorized access. Passkey-based authentication methods leverage WebAuthn standards with biometrics and hardware tokens. For details, see [Passwordless Login with Passkeys](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-login-passkey.html).
- Starting with B2C Commerce version 26.1, Agent/OOBO is supported out of the box in Hybrid Auth with PWA Kit when using the Customer Service Center in Business Manager. See [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-authentication.html#hybrid-auth-feature-support-matrix).
- Updated authentication responses so that requests for locked or disabled customer accounts now return a 401 (Unauthorized) instead of a 502 error, providing clearer and more accurate error signaling.
- To enhance security and align with **OAuth 2.1 specifications,** the SLAS public client `refresh token` issued is required to be one time use only. For public clients, reuse of the same `refresh_token` is now prohibited. You must use the NEW refresh token that SLAS issues on each `/token` call following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - [Here](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025) is the original notification from early May 2025. All Production (PRD) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
- The `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
  - [Here](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#03182025) is the original notification from March 2025.

## 01/14/2026

### SCAPI Release

- Process optimization to improve performance of non-cacheable APIs.

## 01/07/2026

### SLAS Relesae

- To enhance security and align with **OAuth 2.1 specifications,** the SLAS public client `refresh token` issued is required to be one time use only. For public clients, reuse of the same `refresh_token` is now prohibited. You must use the NEW refresh token that SLAS issues on each `/token` call following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - [Here](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025) is the original notification from early May 2025. Starting Jan 8th 2026, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
- Security and infrastructure updates. No customer impact is anticipated.

## 12/4/2025

### SCAPI Release

With B2C Commerce version 26.1:

- Added Custom APIs to the [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary). This allows configuration of request timeouts for Custom API requests up to a maximum of 120 seconds.
- New SCAPI APIs and endpoints:
  - [Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references/customers?meta=Summary)
    - `PUT customer-groups/{customerGroupId}/members`
      - Adds multiple customers to a customer group by their customer numbers in a single batch operation.
    - `DELETE customer-groups/{customerGroupId}/members`
      - Removes multiple customers from a customer group by their customer numbers in a single batch operation.
    - `GET /customer-groups`
      - Retrieves customer groups with support for pagination (offset/limit) and field selection via the select parameter.
  - [Price Books](https://developer.salesforce.com/docs/commerce/commerce-api/references/price-books?meta=Summary)
    - `POST /price-book-search`
      - Searches for price books using query-based criteria, enabling discovery and filtering of price book configurations.
  - [Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/products?meta=Summary)
    - `POST /unassigned-product-search`
      - Searches for products that aren't assigned to any catalog.
  - [SCAPI Schemas](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-schema-api.html)
    - `GET /schemas`
      - Retrieves a list of available SCAPI OAS schemas.
    - `GET /schemas/{apiFamily}/{apiName}/{apiVersion}`
      - Retrieves the OAS schema identified by API family, name, and version.
  - [Shopper Experience](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-experience?meta=Summary)
    - `GET /contents/{id}`
      - Retrieves a single content asset by ID with optional locale parameter for localized content.
    - `GET /contents`
      - Retrieves multiple content assets by their IDs in a single batch request, supporting locale-based content retrieval.
    - `GET /folders/{id}`
      - Retrieves a content folder by ID with support for hierarchical navigation via the `levels` parameter and optional locale.
    - `GET /folders`
      - Retrieves multiple content folders by their IDs in batch, with support for hierarchical levels and localization.
    - `GET content-search`
      - Searches content assets using query parameters with support for sorting, pagination (offset/limit), refinements, and locale-specific results.
  - [Shopper Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary)
    - `GET /product-lists/{listId}/items`
      - Retrieves all items in a product list, for example: wish list and gift registry, with support for expansion parameters to include product details, availability, images, and prices.
  - [Shopper Payments](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-payments?meta=Summary)
  - [Shopper Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products)
    - New expansion `shipping_methods` for `/products` and `/products/{id}`. Adds shipping method information to product responses, allowing clients to retrieve available shipping options for products.
    - New expansion `set_products` and `bundled_products` for `/products`. Enables retrieval of product set members and bundled product details within product responses.
  - [Sites](https://developer.salesforce.com/docs/commerce/commerce-api/references/sites?meta=Summary)
    - `POST /site-search`
      - Searches for sites using a query-based search with configurable search criteria in the request body.

## 11/5/2025

### SCAPI Release

- Updated non-customer-facing infrastructure to support a future move of the OCI service to Hyperforce. No customer impact is anticipated.

## 10/29/2025

### SCAPI Release

- Updated non-customer-facing infrastructure to support a future move of the OCI service to Hyperforce. No customer impact is anticipated.
- Improved Hybrid login support for the `SameSite` cookie parameter:
  - Consistently verifies that the `SameSite` attribute for the `dwsid` cookie returned during token calls for Hybrid Auth matches the `SameSite` attribute for `dwsid` cookies set in Controller calls.

## 10/22/2025

### SCAPI Release

- SCAPI Direct Routing, [originally enabled on 10/01/2025](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#10012025), has been disabled grid-wide. No customer impact is anticipated.

## 10/21/2025

### SCAPI Release

- With B2C Commerce version 25.10, you can use the [Replications API](https://developer.salesforce.com/docs/commerce/commerce-api/references/replications?meta=Summary) to publish a product, price table, and content asset. Publishing an item is only available from STG to PRD and isn't testable on sandboxes. You will be able to use this API when B2C Commerce version 25.10 is rolled out on PIG instances.

### SLAS Release

- Strengthened SLAS Resilience and Scale for holiday season preparation.
- To enhance security and align with **OAuth 2.1 specifications,** the issued SLAS public client refresh token is required to be one-time use only, and reuse of the same `refresh_token` is now prohibited. You must make sure to use the NEW refresh token that SLAS issues on each `/token` call using the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).

  - [The original notification was provided in early May](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give additional time for customers to make changes to their implementation, we extended the due date:
    - Starting Sep 9th 2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens receive a 400 invalid refresh token error.

## 10/01/2025

### SCAPI Release

- Internal logging improvements as part of holiday season preparation.
- Added preference-based response timeout settings for Sandbox instances types:
  - A new [Timeouts API](https://developer.salesforce.com/docs/commerce/commerce-api/references/timeouts?meta=Summary) provides customer self-service timeout configuration.
    **note:** This is only available for B2C Commerce Sandbox instances, but will be rolled out to all instance types in the future.
    **note:** Custom APIs are currently not supported.
- Grid-wide enablement of SCAPI Direct Routing. No customer impact is anticipated.
- Improved internal SCAPI configuration update resiliency. No customer impact is anticipated.

### SLAS Release

- Strengthened SLAS Resilience and Scale for holiday season preparation.
- Enhanced validation for passwordless login to ensure the provided login ID matches the one used for time-based one-time password (TOTP).
- Fixed an issue where a request to `/idp/callback` without an `idpName` returned a 500 error. It now correctly returns a 404.
- To enhance security and align with **OAuth 2.1 specifications,** the issued SLAS public client refresh token is required to be one-time use only, and reuse of the same `refresh_token` is now prohibited. You must make sure to use the NEW refresh token that SLAS issues on each `/token` call using the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - [The original notification was provided in early May](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025): - To give additional time for customers to make changes to their implementation, we are extending the due date: - Starting Sep 9th 2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
- Added support for OpenID Connect (OIDC) private key JWT authentication. For details, see [Configure Client Authentication with Private Key JWT](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-key-jwt.html).

## 09/25/2025

### SCAPI Release

- The SCAPI geolocation service does not support Anycast-related IP addresses. Anycast allows the same IP in multiple locations, and, therefore, can't resolve to one single location. For geolocation details, see [Shopper Geolocation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/shopper-context-geolocation.html) and [Geolocation Lookup for IP Addresses in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_geolocation_lookup_for_ip_addresses.htm&type=5).

## 09/24/2025

### SCAPI Release

- Updated non-customer facing infrastructure to support a future move of the OCI service to Hyperforce. No customer impact is anticipated.

## 09/22/2025

### SCAPI Release

With B2C Commerce version 25.10:

- The [CORS configuration API](https://developer.salesforce.com/docs/commerce/commerce-api/references/cors?meta=Summary) now supports the configuration of allowed origins with schemes other than HTTP and HTTPS.
- New Shopper Configuration API:
  - A read-only API that returns merchant-configured instance and site-specific property details including, but not limited to, site ID, name, status, locales , currencies, timezone, and certain enabled features, such as Salesforce Payments.
  - Each configuration value contains a configuration type detailing if it's global- or site-specific.
  - As B2C Commerce evolves, additional instance- and site-specific configuration details will be added to this API.
- Updated [Shopper Customers API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary):
  - Added an optional parameter for making a default customer payment instrument during creation.
  - Now returns the default flag when retrieving payment instruments using the `get /customer` and `get/customer/payment-instrument/{id}` endpoints.
- For the [Shopper Search API `productSearch` endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch), updated the `select` parameter documentation, including the example.
- Added a new, read-only Custom API status report endpoint that provides:
  - Registration status of your Custom APIs. When you activate a code version containing Custom APIs, this endpoint generates a report that contains comprehensive details about each endpoint's registration outcome, including status, configuration details, and error diagnostics when registration fails.
  - Real-time endpoint monitoring: Get immediate feedback on whether your Custom API endpoints successfully registered as `ACTIVE` or failed with `NOT_REGISTERED` status, eliminating the need to manually search through logs for troubleshooting.
  - Comprehensive endpoint details: Each endpoint response includes complete metadata, such as API name and version, cartridge name, HTTP method, implementation script, OpenAPI schema file, site ID, security scheme, and detailed error information for failed registrations.
  - Flexible filtering capabilities: Query all endpoints or filter by registration status to focus on problematic endpoints, with support for organization-level visibility across all sites and cartridges in your B2C Commerce instance.
- Introduced the new `dw.order.mergeBasket hook` to standardize and simplify basket merging customization. We recommend this method for merging. You can invoke this hook using the `transferBasket` endpoint with the new`merge=true` parameter. This ensures that the same merge script can be used consistently across all relevant functionalities, unifying the previous discrepancies between controller and REST API merging strategies.
- Added a download link for each SCAPI OAS specification on the respective API summary page.

### SLAS Release

- Use OpenID Connect (OIDC) private key JWT authentication. See [Configure Client Authentication with Private Key JWT](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-private-key-jwt.html).
<!-- You can now simultaneously maintain two active secrets, a primary and a secondary, and rotate them without service interruption. See [Client Secret Management and Rotation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.html#client-secret-management-and-rotation). -->

## 09/17/2025

### SCAPI Release

- Added a download capability for SCAPI OAS specifications in the summary section of every API.
- Added the new `dw.order.mergeBasket` hook to standardize and simplify basket merging customization. You can invoke this hook using the `transferBasket` endpoint with the new merge=true parameter. This ensures that the same merge script can be used consistently across all relevant functionalities, unifying the previous discrepancies between controller and REST API merging strategies. We recommend this method for merging, because other merging methods are now deprecated.
  - `https://{shortCode}.api.commercecloud.salesforce.com/checkout/shopper-baskets/v2/organizations/{organizationId}/baskets/actions/transfer`
- With the Custom API endpoint, you can now list your custom APIs on an instance via a user-friendly and secure approach and obtain real-time feedback on endpoint registration status, including successful registrations and failed attempts with error codes.
  - `https://{shortCode}.api.commercecloud.salesforce.com/dx/custom-apis/v1/organizations/{organizationId}/endpoints`
- Added the Granular Replication API for publishing a product, price table, and content asset. Publishing an item is only available from STG to PRD and is not testable on sandboxes. This will be available for use when 25.10 is rolled out on PIG instances.
  - `https://{shortCode}.api.commercecloud.salesforce.com/operation/replications/v1/organizations/{organizationId}/granular-processes`
- Updated non-customer-facing infrastructure to support a future move of the OCI service to Hyperforce. No customer impact is anticipated.
- Updated internal routing configuration to easier onboard pilot customers. No customer impact is anticipated.

## 09/16/2025

### SLAS Release

- Strengthening SLAS resilience and scale for holiday readiness
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was originally published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Starting September 9th, 2025, all Production (PRD) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.

## 09/08/2025

### SLAS Release

- SLAS security & infrastructure updates
- SLAS resilience improvements for holiday readiness
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was originally published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Starting September 9th, 2025, all Production (PRD) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.

## 09/03/2025

### SLAS Release

- SLAS resilience improvements
- Improved Apple IDP login with external profile fallback and default name generation for uninterrupted sign-in
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was originally published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Starting September 9th, 2025, all Production (PRD) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.

## 08/27/2025

### SCAPI Release

- Preparation for new, upcoming SCAPI routing functionalities. No customer impact is anticipated.

## 08/26/2025

### SLAS Release

- Security & compliance updates
- Enhanced support for the Sectigo certificate
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).

  - This requirement was originally published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Starting September 9th, 2025, all Production (PRD) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.

## 08/19/2025

### SCAPI Release

- For [Shopper Baskets v1](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=Summary), [Shopper Baskets v2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary), [Shopper Customers](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary), and [Shopper Orders](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=Summary), a new, optional field `qualifyingProductItemId` has been added to the `ProductItem` schema to help you reference the specific product that qualified the bonus promotion.
- Enhanced the Shopper Search API to support custom attribute retrieval for product search and search suggestions:
  - [Product Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch): Use the new query parameter `includedCustomVariationProperties` to specify up to 5 custom properties to return with product search results.
  - [Get Search Suggestions](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=getSearchSuggestions): Use the new query parameters `expand` and `includedCustomProductProperties` to specify up to 5 custom properties to return with product suggestions.
- Added support for Einstein suggestions in the Shopper Search [getSearchSuggestions](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=getSearchSuggestions) endpoint.
- The refine parameter on the Shopper Search [productSearch](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch) endpoint now supports refining by multiple promotions. For example: refine=pmid=20-off-clothes|15-off-shoes.
- Fixed an issue with the `request.getGeoLocation()` Script API when the `geoLocation` couldn’t be created during a REST session (OCAPI and SCAPI).

## 08/13/2025

### SCAPI Release

- Cleaned up non-customer-facing, obsolete SCAPI code and configuration. No customer impact is anticipated.

### SLAS Release

- SLAS resilience improvements
- Security library updates
- Enhanced support for the Sectigo CA certificate.
- Fixed an issue where the SLAS `/logout` and `/session-bridge/token` endpoints failed for customers with names containing specific international characters.
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was originally published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Starting August 13th, 2025, Sandbox, Staging (STG) and Development (DEV) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.
    - Starting September 9th, 2025, all Production (PRD) `tenant_id`s that reuse old refresh tokens receive a 400 invalid refresh token error.
    - This is the final extension. Please make the changes as soon as possible.

## 07/30/2025

### SCAPI Release

- Fixed an issue on production systems when hybrid customers using the `plugin_slas` and `shopper-experience` APIs experienced invalid redirects. The `plugin_slas` `onSession` hook was unintentionally triggered when the `shopper-experience` API was called.
- Enabled system quotas based on the SCAPI `ActivityType` as performance guardrails on production systems. Violation of system quotas can lead to quota exceptions.
- Fixed an issue on production systems when the requested locale-based customer group membership was not applied during on-request calls, which led to incorrect personalized SCAPI response caches.
- Enabled corrected behavior with the Script API `Request.getHttpRemoteAddress()` to get the true client IP from `shopper-context` on DEV and SBX environments. PROD and STG shopper context-based true client IPs are still disabled and will be enabled in a later release.

## 07/16/2025

### SCAPI Release

- Enabled on all instances, including Production (PRD): API path and parameter validation based on the OAS standard.

### SLAS Release

- Improved login experience by addressing a case sensitivity issue with shopper credentials.
- SLAS scale and performance improvements.
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was orignially published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Beginning July 14th, 2025, Sandbox, Staging (STG) and Development (DEV) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning August 4th 2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - This is the final extension. Please make the changes as soon as possible.

## 07/09/2025 (Originally scheduled for 06/24/2025)

### SLAS Release

- [Hybrid Auth](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-authentication.html): Support added for SLAS public clients and SFRA Storefront Protection.
- To enhance security and align with OAuth 2.1 specifications, reuse of the same `refresh_token` for public clients is now prohibited. Implement one-time usage for the `refresh_token`, using the new `refresh_token` issued by SLAS on each `/token` call. For details, see [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens).
  - This requirement was orignially published in the [05/06/2025 release notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#05062025). To give SLAS customers additional time to make the necessary changes, we are extending the enforcement timeline as follows:
    - Beginning July 14th, 2025, Sandbox, Staging (STG) and Development (DEV) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning August 4th 2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - This is the final extension. Please make the changes as soon as possible.

## 07/02/2025

### SCAPI Release

- You can now more conveniently grant client applications access to multiple sandboxes. This speeds up the provisioning of development environments.
- Enabled on Sandbox, Staging (STG) and Development (DEV): API contract validation based on the OAS standard.

## 06/27/2025

### SCAPI Release

- Enabled on Sandbox and Development instances: ActivityTypeEnablement for quotas. No customer impact is anticipated.

## 06/26/2025

### SCAPI Release

- Enabled on ODS instances only: Custom OnRequest and OnSession hooks are no longer executed for the SCAPI `/shopper-experience` APIs. Make sure you validate your SCAPI `/shopper-experience` API calls.

## 06/25/2025

### SCAPI Release

- Enabled on Sandbox instances only: API contract validation based on OAS standard.

## 06/19/2025

### SCAPI Release

- On selected sandboxes, enabled OAS-based SCAPI request validation for parameters, authN / authZ, and request path.
- Updated non-customer-facing infrastructure to support a future move of the OCI service to Hyperforce. No customer impact is anticipated.
- Cleaned up non-customer-facing, deprecated SCAPI code and configuration. No customer impact is anticipated.

## 06/12/2025

### SCAPI Release

- Converted SCAPI RAML specifications to OpenAPI Specification (OAS) format. With this specification format change, a future developer experience feature will offer several key benefits:

  - Improved tooling support: Widespread OAS tooling aids in generating client libraries, API validation, and interactive documentation.
  - Better integration: OAS is the industry standard, ensuring seamless integration with existing systems and tools.
  - Streamlined development: OAS features help developers design, test, and document APIs more efficiently, leading to faster development cycles and higher quality APIs.

## 06/11/2025

### SLAS Release

- For AP2 and AP3 regions:
  - For public clients, reuse of the same `refresh_token` is now prohibited. You must rotate the refresh token following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). Visit [Salesforce Commerce Cloud GitHub Repositories and Access](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-github-repo-access.html) for information about how to get access to the Commerce Cloud repositories. For customers using the plugin-slas cartridge, upgrade to [Plugin SLAS v7.4.1](https://github.com/SalesforceCommerceCloud/plugin_slas/releases/tag/v7.4.1). To give SLAS customers time to make the necessary changes, we are strictly enforcing this restriction according to the following schedule:
    - Beginning May 20th, 2025, Sandbox, Staging (STG), and Development (DEV) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning June 24th 2025, all Production (PRD) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
- Scale and performance improvements

## 06/09/2025

### SLAS Release

- For US and EU regions:
  - For public clients, reuse of the same `refresh_token` is now prohibited. You must rotate the refresh token following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). Visit [Salesforce Commerce Cloud GitHub Repositories and Access](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-github-repo-access.html) for information about how to get access to the Commerce Cloud repositories. For customers using the plugin-slas cartridge, upgrade to [Plugin SLAS v7.4.1](https://github.com/SalesforceCommerceCloud/plugin_slas/releases/tag/v7.4.1). To give SLAS customers time to make the necessary changes, we are strictly enforcing this restriction according to the following schedule:
    - Beginning May 20th, 2025, Sandbox, Staging (STG), and Development (DEV) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning June 24th 2025, all Production (PRD) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
- Scale and performance improvements

## 06/04/2025

### SCAPI Release

- Non customer-facing infrastructure updates to better support more granular SCAPI log message forwarding to Log Center. No customer impact is anticipated.
- Non customer-facing “log-only“ validation update for future OAS spec updates. No customer impact is anticipated.

### SLAS Release

- AP2 and AP3 Regions:
  - Scale and performance improvements.
  - Minor infrastructure updates.
  - For public clients, reuse of the same `refresh_token` is now prohibited. You must rotate the refresh token following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). Visit [Salesforce Commerce Cloud GitHub Repositories and Access](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-github-repo-access.html) for information about how to get access to the Commerce Cloud repositories. For customers using the plugin-slas cartridge, upgrade to [Plugin SLAS v7.4.1](https://github.com/SalesforceCommerceCloud/plugin_slas/releases/tag/v7.4.1). To give SLAS customers time to make the necessary changes, we are strictly enforcing this restriction according to the following schedule:
    - Beginning May 20th, 2025, Sandbox, Staging (STG), and Development (DEV) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning June 24th 2025, all Production (PRD) tenant_ids that reuse old refresh tokens will receive a 400 invalid refresh token error.

## 06/02/2025

### SLAS Release

- EU and US-East Regions:
  - SLAS now supports LINE as 3rd party IDP.
  - SLAS scale and performance improvements.
  - SLAS minor infrastructure updates.
  - SLAS [/password/action](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=resetPassword) endpoint now returns `locale` in the response.
  - Improved SLAS log integration with the Log Center.
  - Fixed an issue in the SLAS Admin client configuration (UI and API) to allow selection of the `sfcc.orders` scope.
  - Fixed a bug related to SLAS token management with the Do Not Track (DNT) setting.
  - For public clients, reuse of the same `refresh_token` is now prohibited. You must rotate the refresh token following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). To give SLAS customers time to make the necessary changes, we are strictly enforcing this restriction according to the following schedule:
    - For customers using the plugin-slas cartridge, upgrade to [Plugin SLAS v7.4.1](https://github.com/SalesforceCommerceCloud/plugin_slas/releases/tag/v7.4.1).
    - Beginning May 20th, 2025, Sandbox, Staging (STG), and Development (DEV) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
    - Beginning June 24th 2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.

## 05/21/2025

### SCAPI Release

- Completed rollout of stricter realm short code validation for SCAPI requests. Make sure you validate your used short codes in Business Manager: **Administration > Site Development > Salesforce Commerce API Settings**.
- Fully removed the deprecated `x-correlation-id` response header from all instance types. The header is replaced by the `sfdc_correlation_id` response header.
- Non customer-facing infrastructure updates for SCAPI Metrics in Log Center. No customer impact is anticipated.
- Added read-only mode system monitoring for internal SCAPI request validation to support upcoming OAS API definitions. No changes are made as a result of the request validation.
- Updated the summary documentation for multiple APIs to ensure consistency and enhance clarity.

## 05/20/2025

### OCAPI Release

- With B2C Commerce version 25.6:
  - Enhanced the [Get customers list Data API](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/ocapi-data-customer-lists?meta=Get%2Bcustomer%2Blist) to allow developers to retrieve customer configuration preferences. Developers can use this API to retrieve information that was previously only part of the header data in [Customer Lists export](https://help.salesforce.com/s/articleView?id=cc.b2c_customer_list_object_import_export.htm&type=5).

## 05/13/2025

### SLAS Release

- Rollout for AP3, EU, and US regions begins 05/13/2025 through 05/15/2025.

## 05/06/2025

### SLAS Release

- Completed SLAS scale and performance improvements. No customer impact anticipated.
- SLAS /password/action endpoint now returns `locale` in the response.
- Made improvements in the SLAS Logs integration with the Log Center.
- Fixed an issue in the SLAS Admin client configuration (UI and API) to allow selection of the `sfcc.orders` scope.
- Fixed a bug related to SLAS token management with the Do Not Track (DNT) setting.
- For public clients, reuse of the same `refresh_token` is now prohibited. You must rotate the refresh token following the process outlined in [Access Tokens and Refresh Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). To give SLAS customers time to make the necessary changes, we are strictly enforcing this restriction according to the following schedule:
  - For customers using the plugin-slas cartridge, upgrade to [Plugin SLAS v7.4.1](https://github.com/SalesforceCommerceCloud/plugin_slas/releases/tag/v7.4.1).
  - Beginning 05/20/2025, Sandbox, Staging (STG) and Development (DEV) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.
  - Beginning 06/24/2025, all Production (PRD) `tenant_ids` that reuse old refresh tokens will receive a 400 invalid refresh token error.

## 04/23/2025

### SCAPI Release

- SCAPI support for the custom [Client IP Header](https://developer.salesforce.com/docs/commerce/commerce-api/guide/client-ip-forwarding.html) and [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-auth.html?q=hybrid#hybrid-auth-overview) is now enabled on all instances.
- Performance improvements in API validation. No customer impact is anticipated.
- Bug fixed for `OPTIONS` requests that previously failed with and HTTP 500 error response.

## 04/16/2025

### SCAPI Release

SCAPI support for the custom [Client IP Header](https://developer.salesforce.com/docs/commerce/commerce-api/guide/client-ip-forwarding.html) and [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-auth.html?q=hybrid#hybrid-auth-overview) is now enabled on Sandbox and Development instances. Enablement on Staging and Production instances is being planned.

## 04/09/2025

### SCAPI Release

- Stricter realm validation for SCAPI requests:
  - For additional security, SCAPI request realm IDs are now verified for correct short code assignment. If the realm ID does not match the short code, an HTTP error status code 404 is returned. You can use Business Manager to find the assigned short code for a realm.
  - As of 04/09/2025, stricter realm validation is enabled on all instance types, including Staging and Production. Make sure you validate your used short codes in Business Manager: **Administration > Site Development > Salesforce Commerce API Settings**.
- Media type validation of SCAPI requests is enabled on all instance types.
- SCAPI support for the custom Client IP Header and Hybrid Authentication is now enabled on Sandbox instances. Enablement on Development, Staging, and Production instances is being planned.

## 04/08/2025

### SLAS Release

- Performed required database updates. No customer impact is anticipated.
- The Hybrid Authentication (Hybrid Auth) feature becomes available on customer environments according to the following deployment schedule. Hybrid Auth must be enabled by Salesforce on a given environment and configured in Business Manager for your site to receive the `dwsid` cookie from SLAS `getAccessToken` endpoint responses.

  - ODS: 04/09/2025
  - Development instances: 04/16/2025
  - All remaining instances, including Production: 04/23/2025

## 04/03/2025

### SCAPI Release

- You can now view HTTP log entries with status codes 5xx in the Log Center, and filter them with the service type `scapi`.

## 03/27/2025

### SCAPI Release

- Stricter realm validation for SCAPI requests:
  - For additional security, SCAPI request realm IDs are now verified for correct short code assignment. If the realm ID does not match the short code, an HTTP error status code 404 is returned. You can use Business Manager to find the assigned short code for a realm.
  - As of 03/27/2025, stricter realm validation is only enabled for Sandboxes and Development instances. Make sure you validate your used short codes on your Sandbox and Development instances in Business Manager: **Administration > Site Development > Salesforce Commerce API Settings**.
  - Rollout to Staging and Production instances is being planned.
- Media type validation of SCAPI requests is enabled for Sandbox and Development instances. Rollout to Staging and Production instances is planned as the next enablement step.

## 03/25/2025

### SLAS Release

- SLAS Infrastructure Deployment:
  - During the deployment of required database updates, shoppers might experience elevated response times for less than one minute. Our internal simulations of production peak traffic resulted in several seconds of performance degradation.

## 03/20/2025

### SCAPI Release

- B2C Commerce version 25.3:
  - Fixed a bug for `ProductListID`, which was missing in the Shopper Customers API [`getPublicProductListsBySearchTerm`](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=getPublicProductListsBySearchTerm) endpoint.
- B2C Commerce version 25.4:
  - The SCAPI Shopper Products GET [`/product/shopper-products/v1/organizations/{organizationId}/products/{id}?expand=promotions`](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getProducts) endpoint and the OCAPI GET [`/products/{id}/promotions`](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/ocapi-shop-products?meta=Get%2Bproduct%2Bpromotions) endpoint now return promotions with the same sort criteria as the Script API default:
    - Exclusivity: `GLOBAL` exclusive promotions are considered first, followed by `CLASS` exclusive promotions, and `NO` exclusive promotions are considered last.
    - Rank: Sorted ascending
    - Promotion Class: `PRODUCT` promotions are considered first, followed by `ORDER` promotions, and `SHIPPING` promotions are considered last.
    - Discount type: Fixed price promotions are considered first, followed by free, amount-off, and percentage-off. Bonus product promotions are considered last.
    - Best discount: Sorted in descending order. For example, 30% off is considered before 20% off.
    - ID: Alphanumeric ascending.
- B2C Commerce version 25.5:
  - Fixed a bug with SCAPI `sfdc_verbose` mode. With this fix, no exception occurs if a SCAPI hook script doesn’t return a status code.
- Stricter realm validation for SCAPI requests:
  - For additional security, SCAPI request realm IDs are now verified for correct short code assignment. If the realm ID doesn't match the short code, an HTTP error status code 404 is returned. You can use Business Manager to find the assigned short code for a realm.
  - As of 03/19/2025, stricter realm validation is currently in preview and is only enabled for Sandboxes. Make sure you validate your used short codes on your Sandbox instances in Business Manager: **Administration > Site Development > Salesforce Commerce API Settings**.
  - Rollout to Development, Staging, and Production instances is being planned.
- Custom APIs are now aligned with SCAPI Admin API endpoints with the following constraints:
  - The default timeout limit has been increased from 10 seconds to 60 seconds.
  - The maximum request body size has been increased from 5 MB to 20 MB.
  - Business Manager quota limits apply.
  - A SCAPI Admin API request is defined by the absence of the `siteId` query parameter. These requests must use `AmOAuth2` as the security scheme.
- System monitoring is performed in read-only mode for media type validation of SCAPI requests, but media type validation is not enforced.

## 03/18/2025

### SLAS Release

- Improved the SLAS Admin UI design and user experience.
- The SLAS Admin UI now displays the login page after 15 minutes of user inactivity.
- SLAS 404 and 5xx error logs are now available in the Log Center.
- The `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id parameter` in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
  - The original schedule was 09/01/2024 for all sandbox tenants and 10/01/2024 for all other non-production tenants. We implemented this change for all non-production tenants starting February 10th, 2025. We have started enforcing the change for all production tenants effective 3/25/25.

## 03/11/2025

### SCAPI Release

- With B2C Commerce version 25.3, hybrid authentication (Hybrid Auth) replaces Plugin SLAS. Hybrid Auth improves the performance and stability of hybrid storefronts by moving the feature directly into the B2C Commerce platform. For details, see [Hybrid Authentication](https://developer.salesforce.com/docs/commerce/commerce-api/guide/hybrid-auth.html).

## 03/05/2025

### SLAS Release

- The `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
  - The original schedule was 09/01/2024 for all sandbox tenants and 10/01/2024 for all other non-production tenants. We implemented this change for all non-production tenants starting 02/10/2025. We are going to strictly enforce the change for all production tenants starting 03/25/20.

## 02/19/2025

### SCAPI Release

- Runtime version update for internal SCAPI supporting applications. No customer impact is anticipated.

## 02/18/2025

### SLAS Release

- Fixed a bug related to the [Trusted System On Behalf (TSOB)](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getTrustedSystemAccessToken) endpoint returning an incorrect Customer ID when different client IDs are used.
- SLAS `[/authorize](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizeCustomer)` endpoint now supports custom query parameters for 3rd party IDP consumption. For details, see [SLAS Identity Providers](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-identity-providers.html).
- The `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id parameter` in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
  - The original schedule was 09/01/2024 for all sandbox tenants and 10/01/2024 for all other non-production tenants. We implemented this change for all non-production tenants starting 02/10/2025.
- In preparation for the removal of the Account Manager SLAS_ORGANIZATION_ADMIN (Account Manager API Client) and SLAS_TRUSTED_AGENT_READ_ONLY & SLAS_TRUSTED_AGENT_READ_WRITE (Account Manager User) roles, these roles were removed from the SLAS code base. Because these roles were never made available for SLAS production use, no customer impact is anticipated.

## 02/05/2025

### SCAPI Release

- API request path validation now identifies empty path segments and handles them consistently across various components.
- Support added for CORS headers with ports.
- Update to the 01/07/2025 correlation ID header announcement: The new `sfdc_correlation_id` response header for the SCAPI Correlation ID is now fully enabled for SCAPI on all instances:
  - On sandbox and development instances, the deprecated `x-correlation-id` response header is no longer returned.
  - On staging and production instances, the deprecated `x-correlation-id` response header is still available, but is subject to removal in a future release.
- Security updates. No customer impact is anticipated.

## 02/03/2025

### SCAPI Release

- With B2C Commerce version 25.2:
  - The [Shopper Search](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) and [Shopper Products](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=Summary) APIs now support Page Meta Tag Rules. You can create Page Meta Tags in Business Manager (Merchant Tools > SEO > Page Meta Tag Rules) using a rule-based approach to enhance storefront pages with unique meta tag content and increase the SEO value across Product List Pages (PLPs) and Product Detail Pages (PDPs). A new optional `page_meta_tags` expansion, which controls the inclusion of page meta tags rules, has been added to `/product-search` and `/products`.

### OCAPI Release

- With B2C Commerce version 25.2:
  - Fixed an issue with the [createScapiRemoteInclude()](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/current/scriptapi/html/index.html?target=class_dw_system_RemoteInclude.html) script functionality when used in combination with a Shopper API. As an example, this led to a 500 exception during the use of the Shopper Baskets API.

### SLAS Release

- [SLAS 4xx Logs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#view-slas-error-logs-in-log-center) are now available in Log Center. Log information includes the `correlationID`, which you can use for end-to-end request tracking.
- SLAS now supports custom query parameters for the [/login](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authenticateCustomer) endpoint.
- SLAS now supports merging claims for [Azure IDP](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-identity-providers.html#supported-identity-providers).
- The SLAS [PasswordReset](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-password-reset.html#slas-password-reset-flow) flow no longer requires PKCE. You can now make password reset requests using the new, optional `hint` query parameter instead of a Proof Key for Code Exchange (PKCE) `code_challenge` and `code_verifier`. For details, see [Password Reset](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-password-reset.html).
- Fixed a `/userinfo` endpoint bug related to using a Google IDP.
- Fixed a bug related to password reset support across different devices.
- Improved error handling and validation to return more meaningful error messages for [Auth0 IDP](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-identity-providers.html#supported-identity-providers).
- The `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change enhances security by preventing unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
  - The original schedule was 09/01/2024 for all sandbox tenants and 10/01/2024 for all other non-production tenants. We will now implement this change for all non-production tenants starting 02/10/2025.
- As of 02/10/25, we are now strictly enforcing the [documented rate limit](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#slas-rate-limits) of 25 requests per minute (RPM) for the [/jwks endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getJwksUri).
- In preparation for the removal of the SLAS_ORGANIZATION_ADMIN (Account Manager API-Client) and SLAS_TRUSTED_AGENT_READ_ONLY (Account Manager User) Account Manager roles, these roles were removed from the SLAS code base. Because these roles were never made available for SLAS production use, no customer impact is anticipated.
- Additional performance improvements included.

## 01/22/2025

### SCAPI Release

- API request path validation now identifies invalid path segments.
- Support added for CORS headers with ports.
- Update to the 01/07/2025 correlation ID header announcement: The `sfdc_correlation_id` response header for the SCAPI Correlation ID is now fully enabled for SCAPI on all instances:
  - On sandbox and development instances, the deprecated `x-correlation-id` RESPONSE header is no longer returned.
  - On staging and production instances, the deprecated `x-correlation-id` RESPONSE header is still available, but is subject to removal in a future release.
- Security updates. No customer impact is anticipated.

## 01/20/2025

### SCAPI Release

- Security updates. No customer impact is anticipated.

## 01/07/2025

### SCAPI Release

- With B2C Commerce version 25.1:
  - SCAPI/OCAPI Coupons API update:
    - Retrieved coupons are now sorted by `couponId` if no (optional) sorting order was passed. Previously, the sort order of retrieved coupons wasn't deterministic.
    - Retrieved coupons in the existing Coupons APIs:
      - OCAPI: https://developer.salesforce.com/docs/commerce/b2c-commerce/references/ocapi-data-coupons?meta=Get%2BCoupons and
      - SCAPI: https://developer.salesforce.com/docs/commerce/commerce-api/references/coupons?meta=couponsSearch
  - Remote Includes: You can now add multiple remote includes from different sources in the array and create complex and powerful responses. For details, see [Remote Includes](https://developer.salesforce.com/docs/commerce/commerce-api/guide/remote-includes.html).
  - The `x-correlation-id` response header is deprecated for some instances and is replaced by the `correlation-id` `RESPONSE` header:
    - For B2C Commerce SBX and DEV instance requests, the removal of the deprecated `x-correlation-id` `RESPONSE` header is included in this release.
    - for B2C Commerce STG and PRD instance requests, the removal of the deprecated `x-correlation-id` `RESPONSE` header is not included in this release.
    - For details, see [Investigate by Correlation ID](/docs/commerce/commerce-api/guide/scapi-logs-request-tracking.md#investigate-by-correlation-id).

### SLAS Release

- As of July 31 2024, to enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id parameter` in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

## 2024

### 10/23/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is now enabled for a select few realms in which it was previously disabled. For the list of cached APIs and other details, see [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).
- Upgraded security infrastructure. No customer impact anticipated.

#### SLAS Release

- SLAS 4xx error logs are available in Log Center, which provides multiple benefits, including a single URL for all realms, up to 14 days of log data, and improved search capabilities. For details, see Shopper Login and API Access Service(SLAS) Overview.
- Resolved a bug in the `/login` process when registered shoppers change their email and/or login ID multiple times. In this case, SLAS no longer triggers a 500 error.
- SLAS Service Protection: As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
  - A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same Unique Shopper ID (USID)) within a short span of time. This returns a 409 HTTP response.
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

### 10/16/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is now enabled for a select few realms in which it was previously disabled. For the list of cached APIs and other details, see [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).

#### SLAS Release

- With B2C Commerce version 24.10, the SLAS 4xx error logs are available in Log Center, which provides multiple benefits, including a single URL for all realms, up to 14 days of log data, and improved search capabilities. For details, see [View SLAS Error Logs in Log Center](https://developer.salesforce.com/docs/commerce/commerce-api/guides/slas.md#view-slas-error-logs-in-log-center).
- By default, shopper tracking preferences are disabled for [Trusted Agent on Behalf (TAOB)](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-trusted-agent.html) authorization, which means the Do Not Track `dnt` parameter is set to `true`. This differs from other SLAS token requests, for which the default `dnt` value is `false`.
- SLAS Service Protection: As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
  - A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same Unique Shopper ID (USID)) within a short span of time. This returns a 409 HTTP response.
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

### 10/08/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is now enabled for a select few realms in which it was previously disabled. For the list of cached APIs and other details, see [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).

#### SLAS Release

- [Trusted Agent on Behalf (TAOB) authorization](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-trusted-agent.html) now allows an agent to perform actions on behalf of guest shoppers.
- Refined documentation, including best practices and sample code for [validating SLAS JWTs with JWKS](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-validate-jwt-with-jwks.html), to simplify key management and enhance security.
- SLAS Service Protection: As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
  - A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same Unique Shopper ID (USID)) within a short span of time. This returns a 409 HTTP response.
  - SLAS Trusted System on Behalf (TSOB) logins will have the SAME service protection window of 3 seconds across all regions.
    - Beginning 10/02/2024 in the AP-Northeast-1 region and 10/09/2024 in the US-East-1 region, customers attempting to log in more than once through TSOB during a period of 3 seconds will receive a 409 HTTP error. No customer impact is anticipated. If you see an increase in 409 HTTP errors, open a support case.
    - No change for the SLAS AP-Southeast-2 and EU-Central-1 regions, which utilize the existing protection window of 3 seconds.
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

### 10/02/2024

#### SLAS Release

- Enhanced error handling for the `/passwordless/login` endpoint. The endpoint now returns a 404 error instead of a 502 error when no shopper is found.
- SLAS Service Protection: As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
  - A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same Unique Shopper ID (USID)) within a short span of time. This returns a 409 HTTP response.
  - SLAS Trusted System on Behalf (TSOB) logins will have the SAME service protection window of 3 seconds across all regions.
    - Beginning 10/02/2024 in the AP-Northeast-1 region and 10/09/2024 in the US-East-1 region, customers attempting to log in more than once through TSOB during a period of 3 seconds will receive a 409 HTTP error. No customer impact is anticipated. If you see an increase in 409 HTTP errors, open a support case.
    - No change for the SLAS AP-Southeast-2 and EU-Central-1 regions, which utilize the existing protection window of 3 seconds.
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

#### SLAS Fixes

- Fixed a SLAS Admin UI bug to ensure the `UserInfo` URL value is not auto-populated with token information.

### 10/01/2024

#### SCAPI Release

- With B2C Commerce version 24.10, added performance and stability improvements in SCAPI caching, specifically for price/promotion calculations. No customer impact is anticipated.
- Stability and visibility enhancements. No customer impact is anticipated.

### 09/24/2024

#### SLAS Release

- SLAS Service Protection: As part of our bot mitigation strategy for the upcoming holiday season, we are introducing additional service protection:
  - A SLAS service protection mechanism to restrict bad actors or BOTs calling the same SLAS endpoint repeatedly using the same USID (Unique Shopper ID) within a short span of time. This returns a 409 HTTP response.
  - SLAS Trusted System on Behalf (TSOB) logins will have a service protection window of 3 seconds.
    - Beginning 10/02/2024 in the AP-Northeast-1 region and 10/09/2024 in the US-East-1 region, customers attempting to log in more than once through TSOB during a period of 3 seconds will receive a 409 HTTP error. No customer impact is anticipated. If you see an increase in 409 HTTP errors, open a support case.
    - No change is planned for the SLAS AP-Southeast-2 and EU-Central-1 regions, which are configured for 3 seconds.
- To help you verify the authenticity of callback requests, SLAS provides a `SlasCallbackToken` (JWT) for each passwordless login and password reset callback that SLAS sends. For more details, see [Verify the SLAS Password Action Callback](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.md#verify-the-slas-password-action-callback).
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

#### SLAS Fixes

- Fixed a JWT validation issue when special characters, especially colons(:) were used in the first name or last name.

### 09/04/2024

#### SLAS Release

- Updated SLAS Infrastructure for holiday readiness.
- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id parameter` in the client credential call in guest flows using the schedule in [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).

#### SCAPI Fixes

- CORS: Header `Access-Control-Allow-Methods` are no longer returned in SCAPI responses, but are returned for `OPTIONS` requests per HTTP specifications. No customer impact anticipated.
- Security: Added the `strict-transport-security` header with a one year expiration. No customer impact anticipated.

### 08/27/2024

#### SCAPI Release

With B2C Commerce version 24.9.1, added a read-only, optional `hashedLogin` field in the response as applicable for the following [Shopper Customers API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary) endpoints:

- `PATCH /customers/{customerId} (updateCustomer)`
- `GET /customers/{customerId} (getCustomer)`
- `POST /customers (registerCustomer)`

#### SLAS Release

- Updated SLAS third-party library information for holiday readiness.
- Addressed a limitation in the SLAS refresh token flow. If a public client logs in and then a private client logs in with the same USID, the public client refresh_token is now deleted and replaced.
- Fixed a SLAS bug in the registered user third-party IDP login flow. When a guest USID is used and the login process does not complete, the access token now remains as a guest token until a successful registered user 3rd party IDP login occurs.
- Improved Error Handling:
  - Refactored the idp/callback 503 error when the state is null to no longer return a 503 error. A 400 bad request error is now returned.
- Updated the SLAS Admin UI to allow customers to access the UI through their short-code.
- Fixed a rare and intermittent spike in SLAS response times.

### 08/22/2024

#### SCAPI Release

- For SCAPI calls using a SLAS JWT, added the `Disable the Modification of the Issuer Date` toggle to invalidate a [customer JWT](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/%3Chttps://developer.salesforce.com/docs/commerce/b2c-commerce/references/ocapi-shop-customers?meta=Get%2Bor%2Brefresh%2Bcustomer%2BJWT%2B(JSON%2BWeb%2BToken)>) after a password change. When the toggle is set, a 401 `InvalidAccessTokenException` response code is returned when trying to use an existing request token after a password change. When the toggle is not set, the error response is only thrown if the time between the token issuer date and the password modification date exceeds 30 seconds.

### 08/21/2024

#### SCAPI Release

- Added infrastructure enhancements for new installation configurations. No customer impact anticipated.
- In preparation for the holiday season, enabled cache infrastructure enhancements.
- Upgraded security infrastructure. No customer impact anticipated.

### 08/14/2024

#### SCAPI Release

- Added response timeout handling for all instance types:
  - In preparation for the holiday season, documented timeouts are enforced on all instance types, including Production instances. Shopper APIs and Custom APIs must respond within 10 seconds, and Admin API requests must respond within 60 seconds. If a response to a SCAPI request exceeds the specified threshold, an HTTP 504 status code is returned. For details, see [Error Response Codes](https://developer.salesforce.com/docs/commerce/commerce-api/guide/error-response-codes.html#504-gateway-timeout).
  - See the [Added response timeout handling for Sandbox instances](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html#03112024) release note for more details.
- With B2C Commerce 24.8, you can set cache expiration for objects with a Validity Period for the Shopper Products [getProduct](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getProduct) and [getCategory](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getCategory) endpoints and the Campaigns [getCampaign](https://developer.salesforce.com/docs/commerce/commerce-api/references/campaigns?meta=getCampaign) endpoint. For details, see [Cache Expiration for Objects with a Validity Period](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html#cache-expiration-for-objects-with-a-validity-period).

#### SCAPI Fixes

- HTTP2 protocol issues fixed when using CORS.

### 08/07/2024

#### SCAPI Release

- With B2C Commerce version 24.8:
  - Added support for Cross-Origin Resource Sharing (CORS). For details, see [CORS in SCAPI](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-cors.html) and the [CORS API](https://developer.salesforce.com/docs/commerce/commerce-api/references/cors?meta=Summary).
  - For the Shopper Products [getProduct](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getProduct) and [getCategory](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getCategory) endpoints and the Campaigns [getCampaign](https://developer.salesforce.com/docs/commerce/commerce-api/references/campaigns?meta=getCampaign) endpoint, you can now set a time window, called the Validity Period. The validity period is used for server-side cache expiration to prevent serving stale content. For additional details, see “Cache Expiration for Objects with a Validity Period” in [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).

### 07/31/2024

#### SLAS Release

- To enhance security for the Shopper Login API Access Service (SLAS), a `channel_id` (site) parameter is now required when requesting a guest access token with a `grant_type` of `client_credentials`. This change prevents unauthorized access across different storefronts. Existing customers must update their implementation to include the `channel_id` parameter in the client credential call in guest flows by 7/31/2024. For details, see [Guest Tokens](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#guest-tokens).
- The total number of scopes is now limited to 85 entries, which is enforced in both the SLAS API and SLAS Admin UI.
- Added client credentials to the POST body when refreshing an `access_token` from IDP. You can control this using a flag in the SLAS-IDP configuration. For details, refer to the documentation for the SLAS Admin [IdentityProvider](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=type%3AIdentityProvider) endpoint.

### 07/15/2024

#### SCAPI Release

With B2C Commerce version 24.7.2:

- [Preferences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/preferences?meta=Summary)
  - Returns the value of the most recent custom preference ID version if the preference ID definition is changed.

#### SLAS Release

- SLAS infrastructure updated in preparation for the holiday season.

### 07/10/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is automatically turned on for:
  - SBX and ODS instances
  - PRD instances that don't use use hooks in [Shopper Search API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) `productSearch` and `getSearchSuggestions` endpoints. For details, see: [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).
- Internal infrastructure upgrades. No customer impact is anticipated.

### 06/26/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is automatically turned on for all instances that don't use [Shopper Search API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary) `productSearch` and `getSearchSuggestions` endpoints on their PRD instances. For details, see [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).

### 06/20/2024

#### SCAPI Release

With B2C Commerce version 24.7:

- [Collect Request Details](https://developer.salesforce.com/docs/commerce/commerce-api/guide/scapi-logs-request-tracking.md#collect-detailed-request-information) for SCAPI requests by using the HTTP request header `sfdc_verbose: true`.
- Merchants and developers can update the status of redeemed coupons using the new [Coupons API](https://developer.salesforce.com/docs/commerce/commerce-api/references/coupons?meta=Summary) `redeemCoupon` endpoint.
- Use the [SEO API](https://developer.salesforce.com/docs/commerce/commerce-api/references/seo?meta=Summary) to upload a custom sitemap and trigger the sitemap generation process. You can now combine your external routes with those in B2C Commerce in a single sitemap.
- [Shopper Context API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-context?meta=Summary)
  - Now provides geolocation capabilities. For details, see [Shopper Geolocation](https://developer.salesforce.com/docs/commerce/commerce-api/guide/shopper-context-geolocation.html).
- Checkout APIs
  - For Shopper Baskets [v1](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=Summary) and [v2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary) `createBasket` and `updateBasket` endpoints, the product line item quantity limit is now set to the API quota [`api.basket.productLineItemQuantity`](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/upcoming/quota/html/API_Quotas.html#category_Basket) of 1000, and the API no longer returns a 400 Bad Request for values greater than 999.
  - In addition, the 999 product line item quantity limit on [createOrders](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=createOrders) is removed, and the quantity set by this endpoint is now unlimited.

With B2C Commerce version 24.7.1:

- [Shopper Context API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-context?meta=Summary)
  - Now requires a `siteId` to be passed. For details, see the [Shopper Context Guide](https://developer.salesforce.com/docs/commerce/commerce-api/guide/shopper-context-api.html#constraints).
  - Constraints have been relaxed, and all SCAPI and OCAPI endpoints are now fully compatible with Shopper Context. For details, see [Shopper Context Constraints](https://developer.salesforce.com/docs/commerce/commerce-api/guide/shopper-context-api.html#constraints).
- The [Shopper Customers API](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-customers?meta=Summary) `updateCustomer` endpoint allows `loginId` to be updated if a valid current password is provided for the shopper.
- [Preferences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/preferences?meta=Summary)
  - When retrieving site and global preferences, the Preferences API first checks for custom settings, and if no custom settings exist, now instead returns the default settings in Business Manager.

### 06/18/2024

#### SLAS Release

- SLAS Admin: Added validation for SLAS Client callback URLs to prevent the use of localhost or loopback addresses as host names in production environments.
- Added SLAS resilience improvements for holiday readiness.

### 06/12/2024

#### SCAPI Release

- Server-Side Web-Tier Caching is enabled for all SCAPI customers who aren’t currently using the cached APIs and haven’t made production requests to any cached APIs in the last seven days. For the list of cached APIs and other details, see [Server-Side Web-Tier Caching](https://developer.salesforce.com/docs/commerce/commerce-api/guide/server-side-web-tier-caching.html).

### 06/11/2024

#### SCAPI Release

- The `siteId` query parameter is no longer mandatory for custom API calls. If a site is not provided, the default site is the Business Manager site. For details, see [Custom APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-apis.html).
- With B2C Commerce version 24.5, the Shopper endpoint constraint for supporting trusted agent tokens on a specific subset of Shopper endpoints has been removed. For details, see [Trusted Agent Authorization.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-trusted-agent.html#constraints)
- Internal infrastructure change: additional internal header introduced. No customer impact is anticipated.

### 06/04/2024

#### SCAPI Release

- The Shopper Context API now requires a `siteId` for new customers. For details, see the [Shopper Context Guide](https://developer.salesforce.com/docs/commerce/commerce-api/guide/shopper-context-api.html#constraints).
- The following Script API methods are available to support SCAPI external taxation APIs with hooks:
  - [dw.order.LineItemCtnr#isExternallyTaxed](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/current/scriptapi/html/api/class_dw_order_LineItemCtnr.html#dw_order_LineItemCtnr_isExternallyTaxed_DetailAnchor): Returns true if the basket was created with taxMode = external.
  - [dw.order.TaxMgr#applyExternalTax](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/current/scriptapi/html/api/class_dw_order_TaxMgr.html#dw_order_TaxMgr_applyExternalTax_Basket_DetailAnchor): Applies externally set tax rates to the given basket. Use when `dw.order.LineItemCtnr#isExternallyTaxed` returns true.
    For details, see [Extensibility via Hooks](https://developer.salesforce.com/docs/commerce/commerce-api/guide/extensibility_via_hooks.html#taxes-apis-and-hooks) and [updateItemsinBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=updateItemsInBasket).

#### SCAPI Fixes

- With B2C Commerce version 24.6, the [mergeBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=mergeBasket) endpoint now merges the guest shopper’s `shippingAddress` and `shippingMethod` into the registered basket when the registered basket does not contain `shippingAddress` or `shippingMethod`.

### 05/29/2024

#### SCAPI Release

- The new [Preferences API](https://developer.salesforce.com/docs/commerce/commerce-api/references/preferences?meta=Summary) allows you to retrieve Site and Global preferences.
- The Shopper Products API [getCategories](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-products?meta=getCategories) endpoint now provides the `onlineSubCategoriesCount` property.
- Internal infrastructure upgrade and security updates. No customer impact is anticipated.

#### SLAS Release

- SLAS now allows shoppers to have multiple clients and authenticate on the same device with a single USID, provided the clients use their respective `refresh_tokens` to refresh their sessions.
- SLAS IDP integration has enhanced error handling to return more meaningful error messages to the caller. No change in error code information.
- The refined error message: “The Account is disabled” is returned for any user account disabled in B2C Commerce. No change in the error code.
- [Shopper Custom Object](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-custom-objects?meta=Summary) API scopes are now limited to 20 entries. This is now enforced in both SLAS API and SLAS Admin UI.
- Enhanced SLAS internal error handling and log messages.

### 05/13/2024

#### SCAPI Release

- With B2C Commerce version 24.5, the Shopper Baskets API supports patching variations within product bundles in a single call. This enhancement provides:

  - More efficient and streamlined product bundle management, making it easier to update multiple variations within a bundle without the need for multiple API calls.
  - Increased productivity for developers managing complex product bundles.

  For details, see [updateItemInBasket.](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=updateItemInBasket)

### 05/07/2024

#### SLAS Release

- SLAS database performance improvements. No customer impact is anticipated.
- SLAS internal infrastructure optimization. No customer impact is anticipated.

### 05/02/2024

#### Deprecation Notification

- The following Shopper Baskets (v1 and v2) endpoints are deprecated and are no longer supported:
  - [addPriceBooksToBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=addPriceBooksToBasket)
  - [getPriceBooksForBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=getPriceBooksForBasket)

#### Maintenance Notification

- Internal infrastructure change for SCAPI contract validation. No customer impact is anticipated.
- Removed obsolete code modules related to encoding issues. For encoding details, see [URL Encoding of Special Characters.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/url-encode.html)

### 04/25/2024

#### SCAPI Features

With B2C Commerce 24.5, You can use external taxation mode with the Shopper Baskets API when hooks are enabled. For details, see [External Taxation Documentation.](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=Summary#:~:text=the%20line%20totals.-,External%20Taxation,-The%20B2C%20Commerce)

### 04/23/2024

#### SCAPI Features

- You can now use the Script API response object to set custom response headers. For details, see [Custom Headers.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/extensibility_via_hooks.html?q=c_#custom-headers)
- Update on encoding handling for special characters. For details, see [URL Encoding of Special Characters.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/url-encode.html)

### 04/10/2024

#### Maintenance Notification

- Optimization performed in internal infrastructure routing. No customer impact anticipated.

### 04/09/2024

#### SCAPI New Features

- SLAS now supports [merging user profile attributes](https://developer.salesforce.com/docs/commerce/commerce-api/guide/merge-shopper-profiles.html) for the Apple IDP.

### 03/27/2024

#### SCAPI New Features

With B2C Commerce 24.4:

- Added the Shopper Custom Objects API for retrieving Custom Objects. For details, see [Shopper Custom Objects.](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-custom-objects)
- Added support for additional HTTP methods for Custom APIs. For details, see [Custom APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-apis.html).

#### Maintenance Notification

- SCAPI: Routine maintenance of infrastructure. No customer impact is anticipated.
- SLAS: Database and infrastructure updates. During the deployment period, shoppers might experience elevated response times for less than a minute.

### 03/18/2024

#### SCAPI Maintenance Notification

- Routine maintenance of infrastructure. No customer impact is anticipated.

### 03/11/2024

#### SCAPI New Features

- Added response timeout handling for Sandbox instances:
  - If responding to a SCAPI request takes too long (60 seconds for Data API requests), an HTTP 504 status code is returned.
  - This is only enforced for requests to Sandbox instances, but will be rolled out to all instance types in the future.
  - For more information see [Error Response Codes](https://developer.salesforce.com/docs/commerce/commerce-api/guide/error-response-codes.html#504-gateway-timeout).
- With B2C Commerce 24.3, updated the Orders API [updateOrderStatus endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=updateOrderStatus) to support a new update status `failed_with_reopen`:
  - When an order is updated with the `failed_with_reopen` status, the order status is set to `failed`.
  - If the basket can be reopened, the API returns response code 201 with the reopened basket URL in the location header.
  - If the basket cannot be reopened, the API returns response code 204 with an empty location header.
- With B2C Commerce 24.3, expanded the Shopper Search API [productSearch endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch) to include additional parameters: `productPromotions`, `imageGroups`, `priceRanges`, and `variants`:
  - The corresponding expansion and query parameters are required in order to get the additional product data in the response. For details and best practices, refer to the [Shopper Search API documentation](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=Summary).
- Added the Customer API [searchCustomerGroup endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/customers?meta=searchCustomerGroup), which searches for customer groups for the siteId.

#### SCAPI Maintenance Notification

- Routine maintenance of infrastructure. No customer impact is anticipated.

### 03/05/2024

#### SLAS: Maintenance Notification

- During the maintenance window, shoppers might experience elevated response times.
- For the latest B2C Commerce service status and deployment information, subscribe to [Trust Center notifications.](https://status.salesforce.com/instances/COMMERCECLOUDSERVICESUS)

### 2/29/2024

#### SCAPI - Shopper SEO

- This feature is generally available from B2C Commerce 24.2:

  - Updated [getUrlMapping](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-seo?meta=getUrlMapping)'s response to include the optional property `resourceSubType`, which indicates whether the resolved object is a Page Designer content asset or a Content Slot asset. For more information, see the [UrlMapping type reference](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-seo?meta=type%3AUrlMapping).

- These features are generally available from B2C Commerce 24.3:

  - Updated getUrlMapping to support [URL redirects](https://help.salesforce.com/s/articleView?id=cc.b2c_url_redirects.htm&language=en_US&type=5). For more information, see the [URL Resolution guide](https://developer.salesforce.com/docs/commerce/commerce-api/guide/url-resolution.html).

  - Updated getUrlMapping to support these hooks: `dw.shop.seo.url_mapping.beforeGET` and `dw.shop.seo.url_mapping.modifyGETResponse`.

### 02/28/2024

#### SCAPI New Features

- Custom Request Headers
  - Developers can send custom request headers that are passed and made available in server-side custom implementations.
  - The required pattern is: `c\_{yourHeader}`.
- [Update order](https://developer.salesforce.com/docs/commerce/commerce-api/references/orders?meta=updateOrder) now supports the [ShopperTokenTsob](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=security%3AShopperTokenTsob) security scheme.
- Shopper Baskets v2 available with B2C Commerce 24.1
  - Provides support for temporary baskets. Temporary baskets can perform calculations to generate totals, line items, promotions, and item availability without affecting the shopper’s storefront cart. You can use these calculations for temporary basket checkout.
  - New Shopper Basket v2 response fields:
    - `groupedTaxItems`
    - `taxRoundedAtGroup`
    - `temporaryBasket`
  - Temporary basket use cases include:
    - A shopper wants to purchase an item without affecting their existing shopping cart, which contains items for an unrelated purchase:
      - A shopper selects an Apple Pay button for a product.
      - A shopper selects a reorder button for a product on an order history page.
      - A shopper selects an order button on a wish list page to purchase one or more items.
    - A merchant shares a link through social channels to purchase promotional items.
    - A customer support agent sends a **Buy Now** link with pre-set products to a shopper for self-checkout (no passing of payment details to support).
  - For additional details, see [Shopper Baskets V2](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets-v2?meta=Summary).

**note:** The `dw.ocapi.shop.basket.beforePOST` hook is no longer supported in Shopper Baskets V2 and is replaced by the `dw.ocapi.shop.basket.beforePOST_v2` hook.

#### SCAPI Fixes

- Stricter request header filtering is performed. Custom code must use custom request headers.
- Identical `CorrelationId` information is no longer returned for independent requests.
- Correct 503 status code is now returned during a site maintenance window.

### 2/22/2024

#### SLAS: Maintenance Notification

- During the maintenance window, shoppers might experience elevated response times.
- For the latest B2C Commerce service status and deployment information, subscribe to [Trust Center notifications.](https://status.salesforce.com/instances/COMMERCECLOUDSERVICESUS)

### 2/14/2024

#### SCAPI Load Shedding

- Introduced new load shedding functionality that:
  - If the system reaches a load threshold, an HTTP 503 response is returned for a subset of API families.
  - Covers APIs not covered by rate limits that are considered non-critical, for example: endpoints related to search, products, and authentication. Load shedding is not used for checkout-related endpoints, such as Shopper Baskets and Shopper Orders, to ensure that shoppers can complete an in-progress checkout.
  - Includes additional HTTP response headers that allow you to understand the current system load: `sfdc_load`, which represents a load percentage with higher percentages indicating higher loads, and `sfdc_load_status`, which is a enum `WARN|THROTTLE` that helps you understand the relative health of the system.

#### SCAPI Maintenance Release

- Routing for `/shopper-experience` requests resulting in HTTP 500 errors.
- Cleanup of deprecated infrastructure and configuration.

### 2/13/2024

#### SLAS

- SLAS Admin UI: Added client name to the client list and detail pages.
- SLAS API: Added support for the `DoNotTrack` (DNT) query parameter in token calls for headless customers. This is in preparation for a future SCAPI B2C Commerce rollout. Additional documentation will be provided.
- SLAS to B2C Commerce Data consistency: Addressed a limitation around customer records synchronization between B2C Commerce and SLAS.
- SLAS third-party IDP configuration is tolerant of missing `idToken` when refreshing third-party IDPs.
- Security updates.

### 2/8/2024

#### SCAPI - Shopper Search

These features are generally available with B2C Commerce 24.3:

- The `select` query parameter in the [Product Search API endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch) filters the response payload by a specified field or set of fields. This allows you to focus on the data that's important to you and improve page loading speed.
- Save time and improve product listing page (PLP) performance by using the enhanced [Product Search API endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch). Use the new optional expansion on the Product Search API endpoint to retrieve product metadata and avoid the use of additional API calls to Get Products. Use these features to provide the additional information needed to render your PLP:
  - **Allowable value:** `promotions` value in the `expand` query parameter
  - **Query parameters:** `perPricebook`, `allImages`, and `allVariationProperties`
  - **Responses:** `productPromotions`, `imageGroups`, `priceRanges`, `tieredPrices`, `variants`, and `variationGroups`

### 2/06/2024

#### SCAPI - Custom APIs Generally Available with B2C Commerce 24.2

Salesforce now provides a new framework that enables you to write custom B2C commerce script code, such as controllers, and expose this functionality as a custom REST API endpoint under the SCAPI framework. Those custom API endpoints accept the same AuthN/AuthZ model as our Shopper and Admin APIs.

With the transition from Beta to General Availability (GA), future changes to B2C Commerce Custom APIs will follow our [change policy.](https://developer.salesforce.com/docs/commerce/commerce-api/guide#change-policy)

If you are new to Custom APIs, see [Custom APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-apis.html) as a starting point.

- New features (non-breaking changes) not included in the Beta:
  - Added the [RestResponseMgr Script API class](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/upcoming/scriptapi/html/api/class_dw_system_RESTResponseMgr.html) to simplify writing custom APIs.
  - Added support for local references of [shared objects](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-api-components-references.html) in the API contract.
  - Added support for the `AmOauth2` method for Admin APIs. For details, see [Custom API Authentication and Authorization.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-api-authentication.html)
- If you particpated in the Custom APIs Beta, the transition to General Availability causes the following BREAKING changes. Review and update your code as needed:
  - Custom endpoints now require custom scopes. For details, see [Scopes.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-api-authentication.html)
  - Storefront quota limits are now enforced. Review these limits and fix any errors. For details, see [API Quotas.](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/current/quota/html/API_Quotas.html) The quota limits relevant for Custom APIs are the ones marked as `Storefront Limit`.
  - We've added Circuit Breaker functionality that is similar to what exists for hooks to Custom APIs. This is a protective measure that blocks API requests when the error rate is too high. For details, see [Circuit Breaker.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/custom-api-circuit-breaker.html)
    B2C Commerce Custom APIs support HTTP GET requests as well as DELETE, HEAD, and OPTIONS. Future transaction support with POST, PUT, PATCH is being planned.

#### Replace Firewall Rules with New Custom Rules

- Custom rules allow you to control incoming traffic by setting up firewall policies based on various request parameters. These API endpoints expand on the existing functionality of firewall rules. With custom rules, you have complete control over the rule expression. We’ve also extended the list of allowed request field types and rule actions, which offer increased flexibility and allow you to create expressions that match your specific traffic needs.
- B2C Commerce has migrated all existing firewall rules to a new custom rules CDN-API endpoint. All customers are directed to transition to using custom rules in place of firewall rules. The firewall rules are scheduled for deprecation. Complete the transition to custom firewall rules in place of firewall rules before February 1, 2024.
- For additional details, see: [eCDN Custom Rules](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-custom-rules.html)

### 1/31/2024

#### SCAPI Maintenance Release

- Cleanup of deprecated SCAPI migration code and configuration. These are nonbehavioral changes.

### 1/18/2024

#### SCAPI Maintenance Release

- Resilience improvements for the SCAPI CDN layer

### 1/17/2024

#### SLAS

- Improved error handling for TSOB(Trusted system on Behalf) for "customer not found" user scenarios.
- Support added for using SAP Customer Data Cloud [socialize REST endpoints](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4176c45f70b21014bbc5a10ce4041860.html).
- IDP configuration now allows the IDP client credentials to be added to the POST body.
  - SLAS now supports OIDC client_secret_basic and client_secret_post for client authentication.
- Updated the `/introspect` endpoint to include a “sub” claim in the [response](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=introspectToken).
- Improved validation in Session Bridge(SESB) flow by checking for the `customer_id` and failing the request if the customer is already registered.
- Includes SLAS Admin UI and API fix to address the cache synchronization issue when a client is edited or deleted.

### 1/4/2024

#### SCAPI Maintenance Release

- Minor fixes
- Added new `sfdc_maintenance` header in SCAPI responses during maintenance windows

## 2023

### 11/07/2023

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Resilience improvements for the SCAPI CDN layer
- Update on encoding handling for special characters

### 11/02/2023

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Holiday preparation: Improve visibility and stability
  - Improve header handling for resiliency

### 10/31/2023

#### Shopper Login (SLAS)

- Enhanced error handling for SLAS TSOB (Trusted System on Behalf) when IDP is B2C Commerce. For the first time call with a non-existing shopper ID, error code 400 is returned in place of the incorrect 409 error code. This change is specific to B2C IDP and does not impact TSOB using Okta or any other 3rd-party IDPs.
- Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.
- In view of Salesforce wide Holiday moratorium, no planned SLAS releases during 11/6/2023 and 1/2/2024.
- **Deprecation Notice**: After January 31st, 2024, merchants will no longer be able to use the DWSID parameter and `loginId=guest` on the `/session-bridge/token`. Beyond this timeline, accessing this API returns a 404 error and prevents your guest shoppers access to your storefront. For more information, see [Shopper Login and API Access Service(SLAS) Session Bridge DWSID GUEST Deprecation](https://help.salesforce.com/s/articleView?id=000396631&type=1).

### 10/27/2023

#### SCAPI - Shopper SEO

- The Get URL Mapping API endpoint allows headless storefronts to support localized, user-friendly URLs based on URL rules set up in [Business Manager](https://help.salesforce.com/s/articleView?id=cc.b2c_using_url_rules_for_seo.htm&type=5). This endpoint helps you to increase your site traffic and improve site navigation. Get URL Mapping is in a new API named Shopper SEO. For more information, see [URL Resolution](https://developer.salesforce.com/docs/commerce/commerce-api/guides/url-resolution.md) and the [Shopper SEO API reference](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-seo/shopper-seo.raml).

### 10/26/2023

#### SCAPI - Shopper Stores

- Use the Shopper Stores API to find details about stores. Shoppers can locate nearby stores for delivery or offline shopping. See the [Shopper Stores API reference](/docs/commerce/commerce-api/references/shopper-stores?meta=Summary).

### 10/25/2023

#### Shopper Login (SLAS)

- **Deprecation Notice**: After January 31st, 2024, merchants will no longer be able to use the DWSID parameter and `loginId=guest` on the `/session-bridge/token`. Beyond this timeline, accessing this API returns a 404 error and prevents your guest shoppers access to your storefront. For more information, see [Shopper Login and API Access Service(SLAS) Session Bridge DWSID GUEST Deprecation](https://help.salesforce.com/s/articleView?id=000396631&type=1).
- In view of Salesforce wide Holiday moratorium, no planned SLAS releases during 11/6/2023 and 1/2/2024.
- Addressed a bug in SLAS Session Bridge (SESB) functionality when a guest user transitions to registered user with the authorize (/authorize) flow.
- SLAS Admin UI validation and messaging for Shopper context API public client customers.
- SLAS Monitoring enhancements as part of Holiday readiness.
- SLAS now supports Last Name(family_name claim) as optional for Google IDP client.

#### SCAPI

#### Shopper Orders

- Shopper Orders Guest Order Lookup secured by SLAS Trusted System On Behalf Token is available now.
- The Order response document now contains an order view code that can be used to retrieve guest orders securely using the Guest Order Lookup endpoint. The order view code contains only URL-safe characters.

  **Warning**: Do not expose the order view code in the URL. The order view code can only be displayed to the shopper or sent as an email. Do not log the order view code in the code.

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Request header size optimizations
- Bugfix for shopper-search refinement parameter encoding

### 10/18/2023

#### Shopper Login (SLAS)

- **Deprecation Notice**: After January 31st, 2024, merchants will no longer be able to use the DWSID parameter and `loginId=guest` on the `/session-bridge/token`. Beyond this timeline, accessing this API returns a 404 error and prevents your guest shoppers access to your storefront. For more information, see [Shopper Login and API Access Service(SLAS) Session Bridge DWSID GUEST Deprecation](https://help.salesforce.com/s/articleView?id=000396631&type=1).
- In view of Salesforce wide Holiday moratorium, there will not be any planned SLAS releases during 11/6/2023 and 1/2/2024.
- SLAS Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.
- Fixed a bug related to Cache synchronization across SLAS PODs.
- Security library updates

#### SCAPI - Shopper Context

- `CustomerGroupIds` is now supported in Shopper Context API.

### 10/11/2023

#### Shopper Login (SLAS)

- **Deprecation Notice**: After January 31st, 2024, merchants will no longer be able to use the DWSID parameter and `loginId=guest` on the `/session-bridge/token`. Beyond this timeline, accessing this API returns a 404 error and prevents your guest shoppers access to your storefront. For more information, see [Shopper Login and API Access Service(SLAS) Session Bridge DWSID GUEST Deprecation](https://help.salesforce.com/s/articleView?id=000396631&type=1).
- Aligning with the Salesforce-wide Holiday moratorium, there are no planned SLAS releases between 11/6/2023 and 1/2/2024.
- SLAS now supports OIDC locales parameter on [/authorize endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authorizeCustomer).
- Security Bug fixes

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Holiday preparation: Improve performance, visibility, and stability
  - Following the preview release from 08/30/2023 we are now releasing this feature and iinfrastructure update to production environments.
  - Affected PODs are all PODs that were not listed in the two releases from 09/27/2023 and 09/21/2023.
  - Updated infrastructure layers and routing rules for SCAPI requests to use fewer hops in the network.
  - Introduction of new custom query parameters: `c\_<yourparameter>`` can now be defined on SCAPI requests and is be routed end to end, Parameters are available in hooks for custom control logic.

### 10/05/2023

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Holiday preparation: Improve visibility and stability
  - Updated infrastructure layers for SCAPI requests

### 10/03/2023

#### Shopper Login (SLAS)

- SLAS Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.

### 09/28/2023

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Holiday preparation: Improve performance by enabling of caching
  - Affected PODs are: POD94, POD112, POD122, POD159, POD162, POD173, POD192, POD194, POD198, POD204, POD226

### 09/27/2023

#### SCAPI Maintenance and PIG Feature Release (holiday preparation)

- Holiday preparation: Improve performance, visibility, and stability
  - Following the preview release from 08/30/2023 we are now releasing this feature update to production environments.
  - Affected PODs are: POD114, POD136, POD149, POD173, POD174, POD210, POD229, POD250, POD253, POD260
  - Updated infrastructure layers and routing rules for SCAPI requests to use fewer hops in the network.
  - Introduction of new custom query parameters: `c_<yourparameter>` can now be defined on SCAPI requests and is routed end to end. Parameters are available in hooks for custom control logic.
  - CORS headers handling, ALL customers.
  - CORS headers like _Origin_ are NOT interpreted any longer, to avoid CORS errors.
  - SCAPI currently does not support CORS.

### 09/26/2023

#### Shopper Login (SLAS)

- SLAS Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.
- SLAS IDP authorize now enables merge shopper profile capability. We've extended [`registerIdentityProvider`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=registerIdentityProvider) to support a new parameter `loginMergeClaims`. This parameter allows you to specify whether shopper accounts created via this IDP should be merged with existing accounts using one of those parameter values, preserving order history (amongst other things). Refer to the [Merge Shopper Profiles User Guide](https://developer.salesforce.com/docs/commerce/commerce-api/guide/merge-shopper-profiles.html) and [`registerIdentityProvider`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=registerIdentityProvider).

### 09/21/2023

#### SCAPI Maintenance and PIG Feature Release (Holiday Preparation)

- Following the preview release from 08/30/2023 we are now releasing this feature update to production environments.
- Affected PODs are: POD94, POD112, POD122, POD136, POD159, POD162, POD173, POD192, POD194, POD198, POD204, POD226, POD240, POD248, and POD253
- Holiday preparation: Improve performance, visibility, and stability
- Updated infrastructure layers and routing rules for SCAPI requests to use fewer hops in the network
- New custom query parameters: `c_<yourparameter>` can now be defined on SCAPI requests and will be routed end to end. Parameters are available in hooks for custom control logic.

### 09/19/2023

#### Shopper Login (SLAS)

- Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season
- SLAS Admin UI: Default IDP claims removed from UI map if they are not a Generic IDP
- Addressed a bug related to 3rd party logout on ECOM during SLAS /logout endpoint call https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=logoutCustomer

#### SCAPI Maintenance Release

- Security Updates

### 09/18/2023

#### SCAPI Maintenance Release

- Log Improvements

### 08/30/2023

#### SCAPI Maintenance and SIG Feature Release (Holiday Preparation)

- Preview release to sandboxes only (SIG and ODS).
- Holiday preparation: Improve performance, visibility, and stability.
- Updated infrastructure layers and routing rules for SCAPI requests to use fewer hops in the network.
- Introduction of **new custom query parameters**: `c\_<yourparameter>` can now be defined on SCAPI requests and are routed end to end, and therefore available in hooks for custom control logic.

  **note:** We'd like all customers to verify your existing SCAPI implementation on sandboxes and report any issues back.

### 08/29/2023

#### Shopper Login (SLAS)

- **Trust Notification**
  - SLAS Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.
  - Improvements to Trusted System on Behalf (TSOB) flow to be able to better handle simultaneous requests.
  - As part of our efforts to scale the SLAS service for the upcoming holiday volume, temporarily, starting the week of August 7, registered shopper refresh tokens (existing and new) are valid for only 45 days, instead of the earlier validity of 90 days. This applies to shopping apps integrated with SLAS, and to shoppers who have not returned to the shopping app at least once in the last 45 days need to relogin. This temporary state ends on September 15. After September 15, registered shopper refresh tokens will resume their full 90 day, standard duration. Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.

### 08/28/2023

#### Shopper Search

- [productSearch](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch) now correctly handles storefront search filters and refinement values with the `&` character, and considers all terms in the refinement attribute before and after the `&`. Previously, the search filter and refinement parameter was incorrectly truncated, and requested refinements with the `&` character in the attribute name did not match the configured refinements in Business Manager.

### 08/24/2023

#### SCAPI Maintenance Release

- Security updates

### 08/22/2023

#### Shopper Login (SLAS)

- SLAS Infrastructure and scale improvements to handle higher transaction volume for the upcoming holiday season.
- Addressed a limitation in SLAS Session Bridge (SESB) functionality when a guest user creates a cart, add products to the cart, and then login as a registered user WITH trusted system (TSOB) to merge the cart and it fails.
- Addressed a bug related to case sensitive `login_id` comparison for Session Bridge (SESB) token requests, where the casing of the `login_id` passed to `getSessionBridgeAccessToken` was different from the casing of the `login_id` in B2C Commerce.
- As part of our efforts to scale the SLAS service for the upcoming holiday volume, temporarily, starting the week of August 7, registered shopper refresh tokens (existing and new) are valid for only 45 days, instead of the earlier validity of 90 days. This applies to shopping apps integrated with SLAS, and to shoppers who have not returned to the shopping app at least once in the last 45 days need to relogin. This temporary state ends on September 15. After September 15, registered shopper refresh tokens will resume their full 90 day, standard duration. Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.

### 08/16/2023

#### SCAPI Maintenance Release

- Security Updates

### 08/15/2023

#### Shopper Login (SLAS)

- Addressed a limitation in `plugin_slas` integration with SLAS around Merge Cart for Guest to Registered flow.
- For the `getSessionBridgeAccessToken` endpoint, the returned `TokenResponse` now correctly includes the `enc_user_id attribute`.
- As part of our efforts to scale the SLAS service for the upcoming holiday volume, temporarily, starting the week of August 7, registered shopper refresh tokens (existing and new) are valid for only 45 days, instead of the earlier validity of 90 days. This applies to shopping apps integrated with SLAS, and to shoppers who have not returned to the shopping app at least once in the last 45 days need to relogin. This temporary state ends on September 15. After September 15, registered shopper refresh tokens will resume their full 90 day, standard duration. Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.

### 08/11/2023

#### SCAPI Maintenance Release

- Security Updates

### 08/10/2023

#### SCAPI - Products

- Increased timeout from 10 seconds to 25 seconds for incoming requests to Products data endpoints.

### 08/08/2023

#### Shopper Login (SLAS)

- Default IDP configuration allows for SSO/OIDC configuration with other IDPs outside the list of SLAS supported IDPs. Configuration can be performed via the Admin API or Admin UI. For more information, see [Configure a Default IDP](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-default-idp.html).
- Preferred IDP configuration cleanup and functionality added to Admin UI.
- As part of our efforts to scale the SLAS service for the upcoming holiday volume, temporarily, starting the week of August 7, registered shopper refresh tokens (existing and new) are valid for only 45 days, instead of the earlier validity of 90 days. This applies to shopping apps integrated with SLAS, and to shoppers who have not returned to the shopping app at least once in the last 45 days need to relogin. This temporary state ends on September 15. After September 15, registered shopper refresh tokens will resume their full 90 day, standard duration. Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.
  Ideally, customers should be Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.

### 08/07/2023

#### SCAPI

Certificate rotation for SCAPI logging and metrics infrastructure.

- One certificate pair per region: EUC1, USE1, APS2, and APN1

### 08/03/2023

#### SCAPI Maintenance Release

- Security Updates

### 07/31/2023

#### SCAPI Maintenance Release

- Logging Optimizations
- Security Updates

### 07/18/2023

#### Shopper Login (SLAS)

- SLAS Infrastructure and scale improvements.
- SLAS Admin UI improvements related to user search and get user statistics.
- Fixed logout implementation. SLAS to OCAPI calls no longer fail throwing [ClientAccessForbiddenException](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=logoutCustomer).
- As part of our efforts to scale the SLAS service for the upcoming holiday volume, temporarily, starting the week of August 7, registered shopper refresh tokens (existing and new) are valid for only 45 days, instead of the earlier validity of 90 days. This applies to shopping apps integrated with SLAS, and to shoppers who have not returned to the shopping app at least once in the last 45 days need to relogin. This temporary state ends on September 15. After September 15, registered shopper refresh tokens will resume their full 90 day, standard duration. Shopper Guest sessions and B2C Commerce basket retention is not affected in any way.

### 07/17/2023

#### SCAPI Maintenance Release

- Performance optimizations

### 07/14/2023

#### Shopper Baskets and Shopper Orders

- Optional query parameter `locale`, is now supported for [mergeBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=mergeBasket), [transferBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=transferBasket) and all delete endpoints in Shopper Orders and Shopper Baskets, with the exception of [deleteBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=deleteBasket).
- [PaymentCardSpec](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=type%3APaymentCardSpec) includes a new field `securityCodeLength`. This is available in the response for Shopper [baskets - getPaymentMethodsForBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=getPaymentMethodsForBasket) and [Shopper Orders- getPaymentMethodsForOrder](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=getPaymentMethodsForOrder) endpoints.
- Coming soon: [mergeBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=mergeBasket) and [transferBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=transferBasket) response will no longer include the property `notes`. Previously, this property was sent with an empty value in the response.
- Fix coming soon: [mergeBasket](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets?meta=mergeBasket) will return an HTTP 409 error response `no-source-basket-exception` if the guest's basket has already been ordered. _Previously, the ordered guest basket was merged with the new basket._

### 07/12/2023

#### SCAPI Maintenance Release

- Performance optimizations

### 07/11/2023

#### Shopper Login (SLAS)

- SLAS Infrastructure and scale improvements to handle higher transaction volume.

### 07/10/2023

#### Shopper Search

- [productSearch](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-search?meta=productSearch) now correctly handles storefront search queries with the `&` character and considers all terms before and after the `&`. Previously, the search query was incorrectly truncated before the `&` character and subsequent terms were missing in the query.

### 06/27/2023

#### Shopper Login (SLAS)

- SLAS `/token` endpoint includes refresh token time to live (TTL) claim, and the value is in seconds to be consistent with `expires_in` for the `access_token` TTL. For more information, see [`getAccessToken`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getAccessToken).

- Improved error handling to send clear 4xx messages on `/revoke` endpoint if a null token is provided. For more information, see [`revokeToken`](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=revokeToken).

- SLAS Admin has enhanced validation in place to help customers create tenants in the correct region.

#### SCAPI Maintenance Release

- Performance optimizations

### 06/21/2023

#### SCAPI Maintenance Release

- Performance optimizations

### 06/15/2023

- Shopper Customers API and Customers API security updates.

### 06/14/2023

#### SCAPI Maintenance Release

- Updated configuration handling to improve performance.
- Update on metrics and logging to improve supportability.

### 06/13/2023

#### Shopper Login (SLAS)

- [introspectToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=introspectToken) returns more specific error messages on failures.
- [authenticateCustomer](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=authenticateCustomer) and other endpoints which result in calls to a B2C Commerce instance return more specific error messages when that instance is down.
- To support native mobile apps, added support for custom scheme redirects.

#### Salesforce Commerce API

- Updated routing and mapping policies to prepare for future functionality.
- Security updates.

### 05/30/2023

#### Shopper Login (SLAS)

- Updated [TokenResponse](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=type%3ATokenResponse), extending the maximum size of `idp_access_token` to 8k bytes.
- [getSessionBridgeAccessToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getSessionBridgeAccessToken) supports a new optional parameter `dwsgst`. Its value is a guest session signature created from Script API's `Session.generateGuestSessionSignature()`. Passing this parameter improves the performance of this API.
- [Guest refresh tokens are now valid for 30 days](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html#access-tokens-and-refresh-tokens). _Previously, they were valid for 90 days._

### 05/17/2023

#### Shopper Login (SLAS)

- Updated the [getTrustedAgentAccessToken](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getTrustedAgentAccessToken) endpoint to make the `agent_id` parameter _optional_.
- Updated the SLAS Admin UI with specific error messaging for issues with logging into Account Manager.
- Private clients now support `grant_type=authorization_code` in addition to `grant_type=authorization_code_pkce`.
- Removals of customer records in B2C Commerce are now synchronized with SLAS. If a customer record is deleted in B2C Commerce, this change is recognized by SLAS.

### 04/25/2023

#### Shopper Login (SLAS)

- **NEW** SLAS-Agentforce Marketing SMS for Passwordless login is ready! See [Passwordless Login with SMS](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-passwordless-sms.html) to get started.
- [resetPassword](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=resetPassword) rejects weak passwords with an HTTP 400 error.
- [getUserInfo](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getUserInfo) supports names with special characters.
- [getUserInfo](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=getUserInfo) supports Trusted System on Behalf of tokens.
- Credential Quality APIs deprecated and removed.
- Improved Guest Shopper validation to allow B2C Commerce IDP origin for session bridge.
- Session Bridge: fixed 500 server error on incorrect hint.
- SLAS Admin UI: Fixed issues related to Tenant ID format check at browser level.

### 04/06/2023

- Shopper Baskets now supports the following SLAS _Trusted-Agent-On-Behalf_-only endpoints:
  - PUT `/baskets/{basketId}/agent`
  - PUT `/baskets/{basketId}/storefront`
  - POST `baskets/{basketId}/price-adjustments`
  - DELETE `baskets/{basketId}/price-adjustments/{priceAdjustmentId}`
  - PATCH `baskets/{basketId}/price-adjustments/{priceAdjustmentId}`
- The following new channel types are supported by Baskets and Orders apps: TikTok, SnapChat, Google, WhatsApp, and YouTube

### 03/29/2023

- BOT Mitigation improvements: Reduced the time window from 2 seconds to 1 second for the same user login that returns Error 409.
- Fixed the issue around deletion of a user with different loginID and IDP, when the tenant and customerID remains the same.
- SLAS Tenant creation improvements to include region validation.
- SLAS Service Introducing Rate Limit of 25 TPM per tenant for JWKs and well-known endpoints.
- SLAS service redirect to customer’s registered callback URL on IDP errors and return Error 412 for refresh token calls.

### 03/14/2023

- Trusted agent on behalf (TAOB): Client ID present check fix on `/auth` rather than `/token`.
- Guest SESB refresh bug fix.
- Improved IDP message errors back from third-party IDP.

### 03/09/2023

- [Shopper Context API](/docs/commerce/commerce-api/references/shopper-context) update.

### 02/22/2023

#### Shopper Login (SLAS)

- Increase shopper authorization code size to accommodate larger code sent from Identity Providers.
- SLAS Admin UI fixes for tenant display post deletion and faster IDP creation.
- SLAS Admin: Client scope update fix.
- Trusted agent on behalf: additional redirect URI parameters for authorize are separated properly.

### 02/09/2023

- Shopper-Experience API global rollout.

### 02/01/2023

#### Shopper Login (SLAS)

- Bug fixes:
  - Admin UI, client create claims fix
  - SESB fix for OCAPI calls
- Features:
  - Support for Active Directory Federated Service IDP

### 01/23/2023

- The [Shopper Context API](/docs/commerce/commerce-api/references/shopper-context) is now generally available!
- Rate limit update to the rules endpoint in the Catalogs API.

### 01/16/2023

- Update TrustedAgentOnBehalf support for Shopper Token policy.

### 01/12/2023

#### Shopper Login (SLAS)

- Support for Forgerock IDP.
- Trusted agent on behalf (TAOB) now supports Private ClientID flow. Changed the TAOB JWT token expiry from 30 to 15 minutes for PCI compliance.
- `/jwks` endpoint now returns 3 key IDs (past, current, and future KeyID).
- Reduced the Passwordless OTP - token length from 20 to 8 characters.
- Enhanced BOT mitigation strategy within SLAS.
- Fixed inconsistencies related to failed tokens.
- Session Bridge: Improved error messaging & guest support.
- SLAS no longer calls ecom, when a shopper account is locked.
- User cache refinements & Fixed cache inconsistencies after tenant key rotation.
- Addressed login ID inconsistencies for passwordless login.
- Fixed AppleIDP issue related to middle name.

## 2022

### 11/03/2022

#### Shopper Customers

- Rate limit increase for `GET /customers/*(Shopper-Customers)`. <!-- see [Rate Limits](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html). -->

### 11/01/2022

#### Shopper Customers

- Rate limit increase for `GET /products-lists/{id}(Shopper-Customers)`. <!-- see [Rate Limits](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html).  -->

### 10/27/2022

#### Orders

- Rate limit increase for `Orders` API. <!-- see [Rate Limits](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html). -->
- Rate limit updates: API families have either a 5s tier or a 60s tier. <!-- see [Rate Limits](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html). -->

#### Shopper Products

- Response compression has been introduced.
- The `expand` query parameter has been added for `getProducts`.

### 10/24/2022

- Added support for `correlation-id` and `x-correlation-id` headers.

### 09/14/2022

The scheduled deactivation of `/customers/actions/login`, `/trusted-system/actions/login`, and other related endpoints has been extended from mid-2022 to March 31st, 2023 for existing customers. These endpoints are still not available to new customers, and we still discourage existing customers from using them. Instead, we strongly recommend that you use the [Shopper Login and API Access Service](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) (SLAS) because it meets a higher standard for security and availability.

### 09/13/2022

- Increased performance and response times through caching on the edge layer.
- Resources affected: `/product`, `/category`, and `/product_search`.
- Updates to the personalization handling ensure that personalized content is cached correctly.
- No action is required by developers to take advantage of this update.

#### Shopper Login (SLAS)

- Replace `SlasJWT-BearerSecurityScheme.BearerToken` security scheme with `CommerceCloudStandards.ShopperToken`.