--- schema_version: "1" id: 7c347a1451fd10736ab905f02e7f6b8670649ff643934b1ae582b7796ea68c6b title: Shopper Login (SLAS) Admin collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/references/generated-api-specs/auth-admin.md canonical_url: https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin source_site: developer.salesforce.com content_type: documentation content_hash: 801207c32a59892d49daf5680ce1e353d23558cc903b4abf5b259c4ebe888ba5 products: - B2C Commerce API - Salesforce APIs --- Shopper Login (SLAS) Admin # Shopper Login (SLAS) Admin [Download API specification](https://developer.salesforce.com/static/commercecloud/commerce-api/auth-admin/auth-admin-oas-v1-public.yaml) ## API Overview The SLAS Admin API is a companion to the main [Shopper Login and API Access Service](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=shopper-login:Summary) (SLAS), which enables secure access to Commerce Cloud’s Shopper APIs. The SLAS Admin API is only used for administration tasks, not for requesting access to the Shopper APIs. **Important:** Before using this API, follow the instructions in [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.html) from the Get Started guides. The guide provides a complete set of instructions for setting up a SLAS client. For more information, see the [SLAS guides](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html). ### Tenant Id In context of SLAS administration a tenant identifier is used instead of the organization identifier. A B2C Commerce instance is considered a “tenant” when it's associated with a supporting system, such as the Shopper Login and API Access Service (SLAS). A tenant ID begins with a four-character realm ID, followed by an underscore (`_`) and an instance ID. These are example tenant IDs for various types of instances: | Instance Type | Realm ID | Instance ID | Tenant ID | | --- | --- | --- | --- | | Staging | bcgl | stg | bcgl\_stg | | On-demand sandbox | zzte | 053 | zzte\_053 | | POD sandbox | zzrf | s01 | zzrf\_s01 | ### Response Details #### Timeouts Admin API requests must respond within 60 seconds. If a response exceeds this threshold, an HTTP 504 status code is returned. For details, see [Timeouts and Limits.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/timeouts-limits.html) #### Error Handling Error responses follow the [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail format. To trace errors, include a `correlation-id` header in your request — the response returns it as `x-correlation-id`. For details, see [HTTP Status Codes and Errors.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/error-response-codes.html) ### Related APIs * [Shopper Login (SLAS)](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth?meta=Summary) — Authenticate shoppers and obtain access tokens. **Version:** 1.19.1 ## Servers * `https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth-admin/v1` * `shortCode (default shortCode) An eight-character string assigned to a realm for routing purposes. See [Base URL and Request Formation.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html)` ## Security * `BearerToken` (http) A security scheme that supplements SLAS Administration APIs that are secured with an B2c Commerce Account Manager JWT. This security scheme expects a valid B2C Commerce Account Manager Bearer token passed in the Authorization header to permit API access. * HTTP scheme: bearer (JWT) ## Operations ### GET Retrieve a tenant by tenant ID. `GET /tenants/{tenantId}` Operation ID: `retrieveTenant`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Retrieve a tenant by tenant ID. #### Parameters * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **200** The tenant was retrieved successfully. Media type: `application/json`. Schema: `Tenant`. _Example: Tenant_ ``` { "createdBy": "slas", "modifiedBy": "slas", "createdTime": "2021-02-25T00:55:54.119+0000", "modifiedTime": "2021-02-25T00:55:54.119+0000", "tenantId": "slsa_dev", "merchantId": 2, "description": "SLAS Default Tenant Two", "contact": "Tenant Two", "emailAddress": "tenant2@slas.tst", "phoneNo": "111-222-4444", "tier": "S", "requestQuotaPerMinute": 8000, "isDeleted": false, "status": "CLEAR" } ``` * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantRequestException400_ ``` { "type": "TenantRequestException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantException401_ ``` { "type": "TenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantNotFoundException404_ ``` { "type": "TenantNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Tenant id Not Found" } ``` ### PUT Create or update a tenant. Use the request body to provide identification and contact information for the tenant and its associated merchant. `PUT /tenants/{tenantId}` Operation ID: `registerTenant`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). This API is used to create or update a tenant. The tenant ID is the unique identifier for the tenant and is used in all subsequent API calls. The tenant ID must be unique across all tenants in the system. #### Parameters * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Request body (required) Media type: `application/json`. Schema: `TenantDto`. _Example: TenantDto_ ``` { "tenantId": "slsa_dev", "merchantName": "Popular Merchant", "description": "Merchant Description", "contact": "Jerry Smith", "emailAddress": "jerry@merchant.com", "phoneNo": "801-555-1234" } ``` #### Responses * **200** The tenant was updated successfully. Media type: `application/json`. Schema: `Tenant`. _Example Tenant: same as GET /tenants/{tenantId} 200 response._ * **201** The tenant was created successfully. Media type: `application/json`. Schema: `Tenant`. _Example Tenant: same as GET /tenants/{tenantId} 200 response._ * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantUpdateException400_ ``` { "type": "TenantUpdateException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not updated" } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantUpdateException401_ ``` { "type": "TenantUpdateException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not updated" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantNotFoundException404_ ``` { "type": "TenantNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Tenant id Not Found" } ``` * **409** Conflict Media type: `application/json`. Schema: `ErrorResponse`. _Example: TenantAlreadyExistsException409_ ``` { "type": "TenantAlreadyExistsException", "title": "Tenant[abcd_prd] already exists!", "detail": "Tenant already exists" } ``` ### POST Log out multiple shoppers in a single request by revoking active refresh and access tokens for each shopper and all their sessions. `POST /tenants/{tenantId}/batch-logout` Operation ID: `batchLogout`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). For each valid shopper in the request, this operation revokes the shopper's active refresh tokens and inactivates their active access tokens issued before the call, across all sessions. As a result, the shopper must log in again with their existing password (this action doesn't force a password change). For more information, see [Log Out Multiple Shoppers](https://developer.salesforce.com/docs/commerce/sfra/guide/slas-batch-logout.html). #### Parameters * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. * `channelId` (query, string, required) The identifier of the sales channel (site). Maximum length: 100. Example: `SiteGenesis`. #### Request body (required) Media type: `application/json`. Schema: `BatchLogoutRequest`. _Example: BatchLogoutRequest_ ``` { "loginIds": [ "user1@example.com", "user2@example.com" ] } ``` #### Responses * **200** The batch logout request was processed successfully. The detailed message in response body will indicate which shoppers were actually logged out and which ones failed and why. Media type: `application/json`. Schema: `BatchLogoutResponse`. _Example: BatchLogoutResponse_ ``` { "results": [ { "loginId": "user1@example.com", "status": "success" }, { "loginId": "user2@example.com", "status": "failure", "errorMessage": "User not found" } ], "totalProcessed": 2, "successCount": 1, "failureCount": 1 } ``` * **400** The request is badly formatted or constructed. If syntactically the request was correct but the loginIds provided did not result in shoppers getting logged out, the result will still be a 200 with details in the response body. Media type: `application/json`. Schema: `ErrorResponse`. _Example: BatchLogoutRequestException400_ ``` { "type": "BadRequestException", "title": "Unable to process resource because the request body was invalid", "detail": "Batch size 51 exceeds maximum allowed: 50" } ``` * **401** Incorrect Authorization provided. Media type: `application/json`. Schema: `ErrorResponse`. _Example: BatchLogoutTenantException401_ ``` { "type": "TenantException", "title": "Unable to process resource because the tenant id was invalid and/or does not match authorization", "detail": "Tenant id is invalid" } ``` ### GET Retrieve/Get all tenant clients. `GET /tenants/{tenantId}/clients` Operation ID: `retrieveClients`. Security: BearerToken (SLAS\_SERVICE\_ADMIN). Retrieve a list of SLAS clients associated with the tenant\_id. #### Parameters * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **200** All tenant clients retrieved successfully. Media type: `application/json`. Schema: `ClientListResponse`. _Example: ClientListResponse_ ``` { "data": [ { "clientId": "a462b606-317c-4a3c-90a7-4b0b938f3807", "secret": "", "name": "Shop Mart", "scopes": [ "sfcc.products sfcc.catalogs sfcc.products.ro" ], "redirectUri": "http://localhost:9010/callback", "callbackUri": "http://localhost:9010/pwd/reset/callback", "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false }, { "clientId": "726bde86-7b99-415d-98ec-9290bad18904", "secret": "", "name": "High Adventure Wear", "scopes": [ "sfcc.products sfcc.catalogs sfcc.products.ro" ], "redirectUri": "http://localhost:9010/callback", "callbackUri": "http://localhost:9010/pwd/reset/callback", "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false }, { "clientId": "slas-default-client-1", "secret": "", "name": "Shop Salesforce", "scopes": [ "sfcc.products.ro sfcc.catalogs.ro" ], "redirectUri": "http://localhost:9010/callback", "callbackUri": "http://localhost:9010/pwd/reset/callback", "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false } ] } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientNotFoundException404_ ``` { "type": "ClientNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Client Not Found" } ``` ### GET Retrieve a client. `GET /tenants/{tenantId}/clients/{clientId}` Operation ID: `retrieveClient`. Security: BearerToken (SLAS\_SERVICE\_ADMIN). Retrieve a client by client ID. The client ID is the unique identifier for the client and is used in all subsequent API calls. The client ID must be unique across all tenants in the system. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **200** The client was retrieved successfully. Media type: `application/json`. Schema: `Client`. _Example: Client_ ``` { "clientId": "client-id1", "name": "High Adventure Wear", "secret": "secret1234", "scopes": [ "sfcc.products sfcc.catalogs sfcc.customers:ro" ], "redirectUri": "http://localhost/callback", "callbackUri": "http://localhost:9010/pwd/reset/callback", "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false } ``` * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientRequestException400_ ``` { "type": "ClientRequestException", "title": "Unable to retrieve resource because the client id was invalid", "detail": "Client id is invalid" } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientNotFoundException404_ ``` { "type": "ClientNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Client Not Found" } ``` ### PUT Create or update a client. `PUT /tenants/{tenantId}/clients/{clientId}` Operation ID: `registerClient`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). It is strongly advised to refrain from using the “sfcc-shopper-context.rw” scope with a PUBLIC Client because it offers fewer protections and could potentially enable malicious actors to access Shopper Context enabled promotions. It is highly recommended to use “sfcc-shopper-context.rw” scope with a private client. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Request body (required) Media type: `application/json`. Schema: `ClientRequest`. _Example: ClientRequest_ ``` { "clientId": "client-id1", "secret": "secret12345", "name": "High Adventure Wear", "scopes": [ "sfcc.products", "sfcc.catalogs", "sfcc.products.ro" ], "redirectUri": [ "http://localhost:9010/callback" ], "callbackUri": [ "http://localhost:9010/pwd/reset/callback" ], "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false } ``` #### Responses * **200** The client was updated successfully. A secret is only returned when a secret was sent with the update request. Media type: `application/json`. Schema: `Client`. _Example: ClientRequest_ ``` { "clientId": "client-id1", "name": "High Adventure Wear", "secret": "secret12345", "scopes": [ "sfcc.products", "sfcc.catalogs", "sfcc.customers:ro" ], "redirectUri": "http://localhost:9010/callback", "callbackUri": "http://localhost:9010/pwd/reset/callback", "channels": [ "SiteGenesis", "OtherSite" ], "isPrivateClient": true, "loginEpRestrict": false, "isSixDigitOtp": false, "strictClientAuth": false } ``` * **201** The client was created successfully. This is the only time the secret is returned. Media type: `application/json`. Schema: `Client`. _Example ClientRequest: same as PUT /tenants/{tenantId}/clients/{clientId} 200 response._ * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientRequestException400_ ``` { "type": "ClientRequestException", "title": "Unable to retrieve resource because the client id was invalid", "detail": "Client id is invalid" } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientNotFoundException404_ ``` { "type": "ClientNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Client Not Found" } ``` * **409** Conflict Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientConflictException409_ ``` { "type": "ClientConflictException", "title": "Unable to create resource because a duplicate resource was found", "detail": "Client was not created. Duplicate resource was found." } ``` ### DELETE Delete a client. `DELETE /tenants/{tenantId}/clients/{clientId}` Operation ID: `deleteClient`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Delete a client by client ID. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **204** No content * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientRequestException400_ ``` { "type": "ClientRequestException", "title": "Unable to retrieve resource because the client id was invalid", "detail": "Client id is invalid" } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientNotFoundException404_ ``` { "type": "ClientNotFoundException", "title": "Unable to retrieve resource because no resource was found with that value", "detail": "Client Not Found" } ``` ### GET Retrieve/get a password action template. `GET /tenants/{tenantId}/clients/{clientId}/password-action-templates` Operation ID: `retrievePwdActionTemplate`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Retrieve a password action template by client ID. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. * `channelId` (query, string, required) The identifier of the sales channel (site). Maximum length: 100. Example: `SiteGenesis`. * `actionType` (query, string, required) The type of password action (reset or create). Describes the type of action that the password action template will be used for. Here are the actions that each enumerated string refers to: - `PWDLESS_LOGIN`: Passwordless login - `PWD_RESET_ACTION`: Password reset - `PWD_RESET_CROSS_DEVICE_ACTION`: Password reset for cross-device flow Allowed values: `PWDLESS_LOGIN`, `PWD_RESET_ACTION`, `PWD_RESET_CROSS_DEVICE_ACTION`. Maximum length: 36. Example: `PWDLESS_LOGIN`. * `templateType` (query, string, required) The type of email template. Allowed values: `EMAIL`, `SMS`. Maximum length: 8. Example: `EMAIL`. #### Responses * **200** The password action template was retrieved successfully. Media type: `application/json`. Schema: `PasswordActionTemplate`. _Example: PasswordActionTemplate_ ``` { "channelId": "SiteGenesis", "name": "Passwordless SMS Template", "subject": "Passwordless Token Request", "link": "This is your passwordless token: ${token}", "locale": "en-us", "actionType": "PWDLESS_LOGIN", "templateType": "SMS", "template": "Passwordless Login Token Request\n\nHello ${name},\nYou're receiving this because you requested a passwordless login token for your account.\n${link}" } ``` * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: BadRequestException400_ ``` { "type": "BadRequestException", "title": "Unable to update resource because the request body was invalid", "detail": "Request body is invalid." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: PasswordActionTemplateNotFoundException404_ ``` { "type": "PasswordActionTemplateNotFoundException", "title": "Template was not found", "detail": "Template was not found." } ``` ### PUT Create or update a password action template. `PUT /tenants/{tenantId}/clients/{clientId}/password-action-templates` Operation ID: `registerPwdActionTemplate`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Create or update a password action template by client ID. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Request body (required) Media type: `application/json`. Schema: `PasswordActionTemplate`. _Example: PasswordActionTemplateRequest_ ``` { "channelId": "SiteGenesis", "name": "Passwordless SMS Template", "subject": "Passwordless Token Request", "link": "This is your passwordless token: ${token}", "locale": "en-us", "actionType": "PWDLESS_LOGIN", "templateType": "SMS", "template": "Passwordless Login Token Request\nHello ${name},\nYou're receiving this because you requested a passwordless login token for your account.\n${link}" } ``` #### Responses * **200** The password action template was updated successfully. Media type: `application/json`. Schema: `PasswordActionTemplate`. _Example PasswordActionTemplate: same as GET /tenants/{tenantId}/clients/{clientId}/password-action-templates 200 response._ * **201** A password action template was created successfully. Media type: `application/json`. Schema: `PasswordActionTemplate`. _Example PasswordActionTemplate: same as GET /tenants/{tenantId}/clients/{clientId}/password-action-templates 200 response._ * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: PasswordActionTemplateCreateException400_ ``` { "type": "PasswordActionTemplateCreateException", "title": "Template was not created or updated", "detail": "Template was not created or updated." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: PasswordActionTemplateNotFoundException404_ ``` { "type": "PasswordActionTemplateNotFoundException", "title": "Template was not found", "detail": "Template was not found." } ``` ### DELETE Delete a password action template. `DELETE /tenants/{tenantId}/clients/{clientId}/password-action-templates` Operation ID: `deletePwdActionTemplate`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Delete a password action template. #### Parameters * `clientId` (path, string, required) The SLAS client identifier. Maximum length: 36. Example: `876aff68-6ee5-474f-932d-c90c1d79bcf7`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. * `channelId` (query, string, required) The identifier of the sales channel (site). Maximum length: 100. Example: `SiteGenesis`. * `actionType` (query, string, required) The type of password action (reset or create). Describes the type of action that the password action template will be used for. Here are the actions that each enumerated string refers to: - `PWDLESS_LOGIN`: Passwordless login - `PWD_RESET_ACTION`: Password reset - `PWD_RESET_CROSS_DEVICE_ACTION`: Password reset for cross-device flow Allowed values: `PWDLESS_LOGIN`, `PWD_RESET_ACTION`, `PWD_RESET_CROSS_DEVICE_ACTION`. Maximum length: 36. Example: `PWDLESS_LOGIN`. * `templateType` (query, string, required) The type of email template. Allowed values: `EMAIL`, `SMS`. Maximum length: 8. Example: `EMAIL`. * `locale` (query, string, required) A descriptor for a geographical region by both a language and country code. Pattern: ^\[a-z\]\[a-z\]-\[A-Z\]\[A-Z\]$. Example: `en-US`. #### Responses * **204** No content * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: PasswordActionTemplateDeleteException400_ ``` { "type": "PasswordActionTemplateDeleteException", "title": "Template was not deleted", "detail": "Template was not deleted." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: ClientTenantException401_ ``` { "type": "ClientTenantException", "title": "Unable to retrieve resource because the tenant id was invalid", "detail": "Tenant id was not found. Please check the tenant id." } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: PasswordActionTemplateNotFoundException404_ ``` { "type": "PasswordActionTemplateNotFoundException", "title": "Template was not found", "detail": "Template was not found." } ``` ### GET Retrieve/Get all tenant identity providers. `GET /tenants/{tenantId}/idps` Operation ID: `retrieveIdentityProviders`. Security: BearerToken (SLAS\_SERVICE\_ADMIN). Retrieve a list of SLAS identity providers associated with the tenant\_id. #### Parameters * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **200** All tenant identity providers retrieved successfully. Media type: `application/json`. Schema: `IdpListResponse`. _Example: IdpListResponse_ ``` { "data": [ { "name": "google", "clientId": "idp-client-id", "clientSecret": "idp-secret", "authUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "tokenInfoUrl": "https://oauth2.googleapis.com/tokeninfo", "userInfoUrl": "https://www.googleapis.com/oauth2/v3/userinfo", "redirectUrl": "http://localhost:9010/hydra/callback", "wellKnownUrl": "https://accounts.google.com/.well-known/openid-configuration", "scopes": [ "openid", "email", "profile" ], "isPreferred": true, "isClientCredsBody": false, "teamId": "appleTeamId", "keyId": "appleKeyId", "loginMergeClaims": [ "email" ], "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] }, { "name": "Facebook", "clientId": "idp-client-id", "clientSecret": "idp-secret", "authUrl": "https://www.facebook.com/v19.0/dialog/oauth", "tokenUrl": "https://graph.facebook.com/v19.0/oauth/access_token", "tokenInfoUrl": "https://graph.facebook.com/v19.0/debug_token", "userInfoUrl": "https://graph.facebook.com/v19.0/me", "redirectUrl": "http://my.host.com/api/v1/idp/callback/Facebook", "wellKnownUrl": "https://www.facebook.com/.well-known/openid-configuration", "scopes": [ "openid", "email", "profile" ], "isPreferred": true, "isClientCredsBody": false, "teamId": "appleTeamId", "keyId": "appleKeyId", "loginMergeClaims": [ "email" ], "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] } ] } ``` * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpRequestException400_ ``` { "type": "IdpRequestException", "title": "Unable to update resource because the request body was invalid", "detail": "Request body is invalid." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpTenantException401_ ``` { "type": "IdpTenantException", "title": "Unable to update resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpNotFoundException404_ ``` { "type": "IdpNotFoundException", "title": "Unable to update resource because no resource was found with that value", "detail": "Idp Not Found" } ``` ### GET Retrieve/Get a specific identity provider. `GET /tenants/{tenantId}/idps/{name}` Operation ID: `retrieveIdentityProvider`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Retrieve a specific identity provider by name. #### Parameters * `name` (path, string, required) The name of the identity provider. Maximum length: 256. Example: `Name`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **200** The identity provider was retrieved successfully. Media type: `application/json`. Schema: `IdentityProvider`. _Example: IdentityProvider_ ``` { "name": "google", "clientId": "idp-client-id", "clientSecret": "idp-secret", "authUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "tokenInfoUrl": "https://oauth2.googleapis.com/tokeninfo", "userInfoUrl": "https://www.googleapis.com/oauth2/v3/userinfo", "redirectUrl": "http://localhost:9010/hydra/callback", "wellKnownUrl": "https://accounts.google.com/.well-known/openid-configuration", "scopes": [ "openid", "email", "profile" ], "preferenceValue": true, "isClientCredsBody": false, "teamId": "appleTeamId", "keyId": "appleKeyId", "loginMergeClaims": [ "email" ], "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] } ``` * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpRequestException400_ ``` { "type": "IdpRequestException", "title": "Unable to update resource because the request body was invalid", "detail": "Request body is invalid." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpTenantException401_ ``` { "type": "IdpTenantException", "title": "Unable to update resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpNotFoundException404_ ``` { "type": "IdpNotFoundException", "title": "Unable to update resource because no resource was found with that value", "detail": "Idp Not Found" } ``` ### PUT Create or update an identity provider. `PUT /tenants/{tenantId}/idps/{name}` Operation ID: `registerIdentityProvider`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Create or update an identity provider by name. #### Parameters * `name` (path, string, required) The name of the identity provider. Maximum length: 256. Example: `Name`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Request body (required) Media type: `application/json`. Schema: `IdentityProvider`. _Example IdentityProvider: same as GET /tenants/{tenantId}/idps/{name} 200 response._ #### Responses * **200** The identity provider was updated successfully. Media type: `application/json`. Schema: `IdentityProviderResponse`. _Example: IdpProviderResponse_ ``` { "name": "google", "clientId": "idp-client-id", "clientSecret": "idp-secret", "authUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "tokenInfoUrl": "https://oauth2.googleapis.com/tokeninfo", "userInfoUrl": "https://www.googleapis.com/oauth2/v3/userinfo", "redirectUrl": "http://localhost:9010/hydra/callback", "wellKnownUrl": "https://accounts.google.com/.well-known/openid-configuration", "scopes": [ "openid", "email", "profile" ], "isPreferred": true, "isClientCredsBody": false, "teamId": "appleTeamId", "keyId": "appleKeyId", "loginMergeClaims": [ "email" ], "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] } ``` * **201** The identity provider was created successfully. Media type: `application/json`. Schema: `IdentityProviderResponse`. _Example IdpProviderResponse: same as PUT /tenants/{tenantId}/idps/{name} 200 response._ * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpRequestException400_ ``` { "type": "IdpRequestException", "title": "Unable to update resource because the request body was invalid", "detail": "Request body is invalid." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpTenantException401_ ``` { "type": "IdpTenantException", "title": "Unable to update resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpNotFoundException404_ ``` { "type": "IdpNotFoundException", "title": "Unable to update resource because no resource was found with that value", "detail": "Idp Not Found" } ``` * **409** Conflict. Duplicate Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpConflictException409_ ``` { "type": "IdpConflictException", "title": "Unable to create resource because a duplicate resource was found", "detail": "Idp was not created. Duplicate resource was found." } ``` ### DELETE Delete an identity provider. `DELETE /tenants/{tenantId}/idps/{name}` Operation ID: `deleteIdentityProvider`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Delete an identity provider by name. #### Parameters * `name` (path, string, required) The name of the identity provider. Maximum length: 256. Example: `Name`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. #### Responses * **204** No content * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpRequestException400_ ``` { "type": "IdpRequestException", "title": "Unable to update resource because the request body was invalid", "detail": "Request body is invalid." } ``` * **401** Unauthorized. Wrong tenant Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpTenantException401_ ``` { "type": "IdpTenantException", "title": "Unable to update resource because the tenant id was invalid", "detail": "Tenant id is invalid" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: IdpNotFoundException404_ ``` { "type": "IdpNotFoundException", "title": "Unable to update resource because no resource was found with that value", "detail": "Idp Not Found" } ``` ### DELETE Delete all shopper records associated with a shopper's customer ID. The email ID is used if it's passed as a query parameter. This conforms to the GDPR regulations. `DELETE /tenants/{tenantId}/customers/{customerId}` Operation ID: `deleteShopper`. Security: BearerToken (SLAS\_SERVICE\_ADMIN, SLAS\_ORGANIZATION\_ADMIN). Delete all shopper records associated with a shopper's customer ID. The email ID is used if it's passed as a query parameter. This conforms to the GDPR regulations. #### Parameters * `customerId` (path, string, required) The unique identifier of a customer. Maximum length: 28. Example: `bcJN7998472pLiZuyGabs8knlj`. * `tenantId` (path, string, required) The identifier of the SLAS tenant (format: realmId\_instanceId). Maximum length: 32. Example: `zzeu_001, bgvn_dev`. * `emailAddress` (query, string) The shoppers email address. Maximum length: 256. Example: `joe.shopper@foo.org`. #### Responses * **204** No content * **400** Bad request Media type: `application/json`. Schema: `ErrorResponse`. _Example: ShopperDeleteException_ ``` { "type": "ShopperDeleteException", "title": "Email address does not match stored email address", "detail": "Email address does not match stored email address" } ``` * **404** Not found Media type: `application/json`. Schema: `ErrorResponse`. _Example: ShopperNotFoundException_ ``` { "type": "ShopperNotFoundException", "title": "SLAS USER was not found by customer id", "detail": "SLAS USER was not found by customer id" } ``` ## Schemas ### Tenant Tenant * `tenantId` (_string_, required) Maximum length: 8. Example: `aaaa_prd`. * `merchantId` (_integer_, required) Minimum: 0. Example: `1`. * `description` (_string_, required) Maximum length: 256. Example: `SLAS Merchant Name`. * `contact` (_string_, required) Maximum length: 256. Example: `SLAS Tenant Contact`. * `emailAddress` (_string_, required) Maximum length: 200. Example: `tenant_contact@slas.tst`. * `phoneNo` (_string_, required) Maximum length: 50. Example: `000-000-0000`. * `isDeleted` (_boolean_, required) Maximum length: 1. Example: `false`. * `status` (_string_, required) Maximum length: 16. Example: `CLEAR`. * `tier` (_string_, required) This read only value relates to the B2C Comerce realm of the customer. * XS = Bronze and Bronze+ * S = Silver and Silver+ * M = Gold and Gold+ * L = Platinum and Platinum+ Allowed values: `XS`, `S`, `M`, `L`. Example: `L`. * `requestQuotaPerMinute` (_number_, required) This read only value shows the the number of requests that can be made per minute. Example: `8000`. ### ErrorResponse * `title` (_string_, required) A short, human-readable summary of the problem type. It will not change from occurrence to occurrence of the problem, except for purposes of localization Maximum length: 256. Example: `You do not have enough credit`. * `type` (_string_, required) A URI reference \[RFC3986\] that identifies the problem type. This specification encourages that, when dereferenced, it provide human-readable documentation for the problem type (e.g., using HTML \[W3C.REC-html5-20141028\]). When this member is not present, its value is assumed to be "about:blank". It accepts relative URIs; this means that they must be resolved relative to the document's base URI, as per \[RFC3986\], Section 5. Maximum length: 2048. Example: `NotEnoughMoney`. * `detail` (_string_, required) A human-readable explanation specific to this occurrence of the problem. Example: `Your current balance is 30, but that costs 50`. * `instance` (_string_) A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced. It accepts relative URIs; this means that they must be resolved relative to the document's base URI, as per \[RFC3986\], Section 5. Maximum length: 2048. Example: `/account/12345/msgs/abc`. ### TenantDto Create or update tenants * `tenantId` (_string_, required) Maximum length: 8. Example: `aaaa_prd`. * `merchantName` (_string_, required) Name of the merchant. Maximum length: 256. Example: `Merchant Name`. * `description` (_string_, required) Maximum length: 256. Example: `Additional information about the tenant.`. * `contact` (_string_, required) Maximum length: 256. Example: `Name of the merchant's designated contact.`. * `emailAddress` (_string_, required) Email address of the designated contact. Maximum length: 200. Example: `joe.shopper@foo.org`. * `phoneNo` (_string_, required) Phone number of the designated contact. Maximum length: 50. Example: `+1 000-000-0000`. ### BatchLogoutRequest * `loginIds` (_array of string_, required) The list of login IDs to log out. Duplicate login IDs are deduplicated before processing and marked `not_processed` in the response. Exceeding the maximum returns a 400. Items: Maximum length: 256. Example: `user1@example.com`. Minimum items: 1. Maximum items: 50. _Example_ ``` [ "user1@example.com", "user2@example.com" ] ``` ### BatchLogoutResponse * `results` (_array of LoginIdResult_, required) The per-loginId outcome of the batch logout, in the same order as the request. * `totalProcessed` (_integer_, required) The total number of login IDs processed. Example: `2`. * `successCount` (_integer_, required) The number of login IDs successfully logged out. Example: `2`. * `failureCount` (_integer_, required) The number of login IDs that failed to log out. Example: `0`. ### ClientListResponse * `data` (_array of Client_, required) An array of clients. ### Client * `clientId` (_string_, required) Client ID Maximum length: 100. Example: `fd0d4ab9-bb85-4c04-bebd-589bd74bdd75`. * `name` (_string_, required) Client Name Maximum length: 100. Example: `Client Name`. * `secret` (_string_, required) Client Secret. The secret will only display on create and if the secret was updated when updating the client. Maximum length: 256. Example: `client-secret`. * `scopes` (_array of string_, required) Merchant scopes. These scopes allows different permissions in SLAS and B2C commerce. Shopper Custom Objects additionally provides a way to do granular scoping besides the standard `sfcc.shopper-custom-objects` like `sfcc.shopper-custom-objects.xyz` SLAS is capable of handling a maximum of 20 Custom Object scopes. For B2C Commerce scope details, see the [Authorization Scopes Catalog](https://developer.salesforce.com/docs/commerce/commerce-api/guide/auth-z-scope-catalog.html)." Items: Maximum length: 100. Example: `sfcc.products sfcc.catalogs sfcc.customers:ro`. _Example_ ``` [ "sfcc.products", "sfcc.catalogs", "sfcc.customers:ro" ] ``` * `redirectUri` (_string_, required) An absolute URL, beginning with a protocol Maximum length: 2048. Example: `https://www.salesforce.com`. * `callbackUri` (_string_, required) An absolute URL, beginning with a protocol Maximum length: 2048. Example: `https://www.salesforce.com`. * `channels` (_array of string_, required) Client Channels Items: Maximum length: 1024. Example: `RefArch SiteGenesis`. _Example_ ``` [ "RefArch", "SiteGenensis" ] ``` * `isPrivateClient` (_boolean_) Private or Public Client Example: `true`. * `loginEpRestrict` (_boolean_) When enabling (true) this will restrict all calls to the `\login` endpoint for the Client Id. When calling the `\login` endpoint and `loginEpRestrict` is enabled a HTTP Status code of 403 will be returned. Maximum length: 1. Example: `false`. * `isSixDigitOtp` (_boolean_) If this attribute is set to true in the request for the clientId, a 6-digit OTP is generated during PasswordlessLogin, PasswordReset, and WebAuthn Authorization. If set to false or unspecified, an 8-digit OTP is generated by default for the aforementioned calls. Example: `false`. * `strictClientAuth` (_boolean_) When enabled, requests from this client to `/oauth2/login` and `/oauth2/authorize` are rejected with a 401 if the `x-slas-client-auth` header is missing. The `strictClientAuth` attribute applies only to private clients. The 'x-slas-client-auth' header is a Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`). For example, `clientId:clientSecret`. Don't add the string `"Basic"`. Example: `false`. ### ClientRequest Used to create and update a SLAS Client * `name` (_string_, required) Client Name Maximum length: 100. Example: `High Adventure Wear`. * `clientId` (_string_, required) SLAS client id. Must match the query parameter. Maximum length: 100. Example: `fd0d4ab9-bb85-4c04-bebd-589bd74bdd75`. * `secret` (_string_, required) SLAS client secret. On create if left blank then a secret will be generated. Maximum length: 256. Example: `client_secret`. * `scopes` (_array of string_, required) Merchant scopes. These scopes allows different permissions in SLAS and B2C commerce. Shopper Custom Objects additionally provides a way to do granular scoping besides the standard `sfcc.shopper-custom-objects` like `sfcc.shopper-custom-objects.xyz` SLAS is capable of handling a maximum of 20 Custom Object scopes." Items: Maximum length: 4096. Example: `sfcc.products sfcc.catalogs sfcc.customers:ro`. _Example_ ``` [ "sfcc.products", "sfcc.catalogs", "sfcc.customers:ro" ] ``` * `redirectUri` (_array of string_, required) Array of SLAS redirect URLs. Include protocol and domain name in each URL. Wildcards supported. Items: Maximum length: 2048. Example: `http://localhost:3000/callback`. _Example_ ``` [ "http://localhost:3000/callback", "https://*.example.com/callback" ] ``` * `callbackUri` (_array of string_) Array of SLAS callback URLs that will be used for passworless login and password reset when mode=callback. Include protocol and domain name in each URL. Wildcards are NOT supported. Items: Maximum length: 2048. Example: `localhost:3000/passwordless-login-callback`. _Example_ ``` [ "http://localhost:3000/password-reset-callback", "http://localhost:3000/passwordless-login-callback" ] ``` * `channels` (_array of string_, required) Client Channels Items: Maximum length: 1024. Example: `RefArch SiteGenesis`. _Example_ ``` [ "RefArch", "SiteGenensis" ] ``` * `isPrivateClient` (_boolean_, required) Private or Public Client. If left blank the client will default to private. Example: `true`. * `loginEpRestrict` (_boolean_) When enabling (true) this will restrict all calls to the `\login` endpoint for the Client Id. When calling the `\login` endpoint and `loginEpRestrict` is enabled a HTTP Status code of 403 will be returned. Example: `false`. * `isSixDigitOtp` (_boolean_) If this attribute is set to true in the request for the clientId, a 6-digit OTP is generated during PasswordlessLogin, PasswordReset, and WebAuthn Authorization. If set to false or unspecified, an 8-digit OTP is generated by default for the aforementioned calls. Example: `false`. * `strictClientAuth` (_boolean_) When enabled, requests from this client to `/oauth2/login` and `/oauth2/authorize` are rejected with a 401 if the `x-slas-client-auth` header is missing. The `strictClientAuth` attribute applies only to private clients. The 'x-slas-client-auth' header is a Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`). For example, `clientId:clientSecret`. Don't add the string `"Basic"`. Example: `false`. ### PasswordActionTemplate * `channelId` (_string_, required) Maximum length: 36. Example: `SiteGenesis`. * `name` (_string_, required) Maximum length: 128. Example: `Password Action Email Template`. * `subject` (_string_, required) Maximum length: 128. Example: `Password Action Token Request`. * `link` (_string_, required) Maximum length: 2048. Example: `This is your password action token: ${token}`. * `locale` (_string_, required) Identifies the locale of the template. Must be one of the [language tag strings supported by JDK 11](https://www.oracle.com/java/technologies/javase/jdk11-suported-locales.html). The string is stored in all lowercase. Maximum length: 16. Example: `en-us`. * `actionType` (_PasswordTemplateActionType_, required) * `templateType` (_PasswordTemplateType_, required) * `template` (_string_, required) Maximum length: 2048. Example: `Passwordless Login Token Request You're receiving this because you requested a passwordless login token for your account. ${link}`. ### IdpListResponse * `data` (_array of IdentityProviderResponse_, required) An array of identity providers. ### IdentityProvider Identity provider * `name` (_string_, required) Identity Provider Name Allowed values: `adfs`, `apple`, `auth0`, `azure`, `cognito`, `facebook`, `forgerock`, `gigya`, `gigya_social`, `google`, `okta`, `ping`, `salesforce`. Maximum length: 200. Example: `google`. * `authUrl` (_string_, required) IDP authorize URL Maximum length: 256. Example: `https://www.salesforce.com/authorize`. * `tokenUrl` (_string_, required) IDP token URL Maximum length: 256. Example: `https://www.salesforce.com/token`. * `tokenInfoUrl` (_string_, required) IDP token info URL Maximum length: 256. Example: `https://www.salesforce.com/introspect`. * `userInfoUrl` (_string_, required) IDP user info URL Maximum length: 256. Example: `https://www.salesforce.com/userinfo`. * `redirectUrl` (_string_, required) Redirect URL to go to after IDP flow is complete. This URL must be registered with the IDP. Maximum length: 256. Example: `https://www.salesforce.com/idp/callback`. * `wellKnownUrl` (_string_, required) IDP URL to get OIDC configuration. Maximum length: 256. Example: `https://www.salesforce.com/.well-known/openid-configuration`. * `clientId` (_string_, required) Client Id of the third party IDP. Maximum length: 128. Example: `934277749308-02dg4398n3s31ofge8cot46jirn3kpkf.apps.googleusercontent.com`. * `clientSecret` (_string_, required) Client Secret of the third party IDP. For Apple copy the contents from the .p8 file that was downloaded from Apple between -_\----BEGIN PRIVATE KEY-----_ and -_\---END PRIVATE KEY-----_ markers. Maximum length: 512. Example: `aKZM1xEnZopNP2bm2gc3GKex`. * `preferenceValue` (_boolean_) Set the IDP configuration as the Preferred SLAS IDP. Default value is `false`. Maximum length: 1. Example: `true`. * `isClientCredsBody` (_boolean_, required) Default is to place the client credentials in a basic authorization header for the call to the IDP. If true, the client credentials are placed in the POST body to the IDP. Maximum length: 1. Example: `false`. * `useWellKnown` (_boolean_) If set to `true`, SLAS uses the `wellKnowUrl` value to populate the `authUrl`, `tokenUrl`, `userInfoUrl`, and `scopes` values from the identity provider. Default value is `false`. Maximum length: 1. Example: `false`. * `scopes` (_array of string_, required) IDP Scopes Items: Maximum length: 8192. Example: `openid email profile`. _Example_ ``` [ "oidc", "email", "profile" ] ``` * `teamId` (_string_) Apple Team Id. Used primarily for Sign with Apple in generating the client secret. Maximum length: 32. Example: `appleTeamId`. * `keyId` (_string_) Apple key id. This is the Key ID that was obtained from Apple when the the private key for client authentication was created. Used primarily for Sign with Apple in generating the client secret. Maximum length: 32. Example: `appleKeyId`. * `loginMergeClaims` (_array of string_) List of user info claims that can be used as identifiers to look up and merge with an existing B2C Commerce profile for a registered shopper or an existing B2C Commerce profile created via federated login with an external Identity Provider with the same merge claim as this one. If multiple matching B2C Commerce shopper (customer) profiles are found, the external profile is merged with the most recently created shopper (customer) profile. Refer to the Merge Shopper Profiles user guide for more details. Note: When configuring an Apple IDP, 'email' and 'sub' are the only supported merge claims. Items: Maximum length: 256. Example: `email`. _Example_ ``` [ "email", "phone" ] ``` * `oidcClaimMapper` (_array of string_) Mapping from the identity provider’s token claims for SLAS to get user information values when the user successfully authenticates. The values in this array should be setup using the following `key=value` pair pattern. The key part is the SLAS key with the value part being the OIDC claim key. Items: Maximum length: 1024. Example: `accessToken=access_token efreshToken=refresh_token accessTokenTTL=expires_in idToken=id_token subject=sub email=email userId=sub familyName=family_name givenName=given_name name=name`. _Example_ ``` [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] ``` ### IdentityProviderResponse Identity provider Response * `name` (_string_, required) Identity Provider Name Maximum length: 200. Example: `google`. * `authUrl` (_string_, required) IDP authorization URL Maximum length: 256. Example: `https://www.salesforce.com/authorize`. * `tokenUrl` (_string_, required) IDP token URL Maximum length: 256. Example: `https://www.salesforce.com/token`. * `tokenInfoUrl` (_string_, required) IDP token info URL Maximum length: 256. Example: `https://www.salesforce.com/inspect`. * `userInfoUrl` (_string_, required) IDP user info URL Maximum length: 256. Example: `https://www.salesforce.com/userinfo`. * `redirectUrl` (_string_, required) Redirect URL to go to after IDP flow is complete. This URL must be registered with the IDP. Maximum length: 256. Example: `https://www.salesforce.com/idp/callback`. * `wellKnownUrl` (_string_) IDP to get OIDC configuration. Maximum length: 256. Example: `https://www.salesforce.com/.well-known/openid-configuration`. * `clientId` (_string_, required) Client Id of the third party IDP. Maximum length: 128. Example: `934277749308-02dg4398n3s31ofge8cot46jirn3kpkf.apps.googleusercontent.com`. * `clientSecret` (_string_, required) Client Secret of the third party IDP. For Apple copy the contents from the .p8 file that was downloaded from Apple between -_\----BEGIN PRIVATE KEY-----_ and -_\---END PRIVATE KEY-----_ markers. Maximum length: 512. Example: `aKZM1xEnZopNP2bm2gc3GKex`. * `isPreferred` (_boolean_, required) Indicates if the IDP configuration is the Preferred SLAS IDP for the Tenant Id. Maximum length: 1. Example: `true`. * `isClientCredsBody` (_boolean_, required) Default is to place the client credentials in a basic authorization header for the call to the IDP. If true, the client credentials are placed in the POST body to the IDP. Maximum length: 1. Example: `false`. * `scopes` (_array of string_, required) Scopes needed by the IDP. Items: Maximum length: 8192. Example: `openid email profile`. _Example_ ``` [ "oidc", "email", "profile" ] ``` * `teamId` (_string_) Apple Team ID. Used primarily for Sign with Apple in generating the client secret. Maximum length: 32. Example: `appleTeamId`. * `keyId` (_string_) Apple key ID. This is the Key ID that was obtained from Apple when the the private key for client authentication was created. Used primarily for Sign with Apple in generating the client secret. Maximum length: 8192. Example: `appleKeyId`. * `loginMergeClaims` (_array of string_) List of user info claims that can be used as identifiers to look up and merge with an existing B2C Commerce profile for a registered shopper or an existing B2C Commerce profile created via federated login with an external Identity Provider with the same merge claim as this one. If multiple matching B2C Commerce shopper (customer) profiles are found, the external profile is merged with the most recently created shopper (customer) profile. Refer to the Merge Shopper Profiles user guide for more details. Note: When configuring an Apple IDP, 'email' and 'sub' are the only supported merge claims. Items: Maximum length: 256. Example: `email`. _Example_ ``` [ "email", "phone" ] ``` * `oidcClaimMapper` (_array of string_) Mapping from the identity provider’s token claims for SLAS to get user information values when the user successfully authenticates. The values in this array should be setup using the following `key=value` pair pattern. The key part is the SLAS key with the value part being the OIDC claim key. Items: Maximum length: 1024. Example: `accessToken=access refresh_token accessTokenTTL=expires_in idToken=id_token subject=sub email=email userId=sub familyName=family_name givenName=given_name name=name`. _Example_ ``` [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "email=email", "userId=sub", "familyName=family_name", "givenName=given_name", "name=name" ] ``` ### LoginIdResult * `loginId` (_string_, required) Maximum length: 256. Example: `user1@example.com`. * `status` (_string_, required) The outcome of the logout for this login ID: * `success`: Logout succeeded. * `failure`: Logout failed. See `errorMessage` for details. * `not_processed`: Skipped as a duplicate of another login ID in the request. Allowed values: `success`, `failure`, `not_processed`. Example: `success`. * `errorMessage` (_string_) The reason the logout failed. Only present when `status` is `failure` or `not_processed`. Maximum length: 512. Example: `User not found`. ### PasswordTemplateActionType Describes the type of action that the password action template will be used for. Here are the actions that each enumerated string refers to: * `PWDLESS_LOGIN`: Passwordless login * `PWD_RESET_ACTION`: Password reset * `PWD_RESET_CROSS_DEVICE_ACTION`: Password reset for cross-device flow * `WEBAUTHN_AUTHORIZE_USER`: WebAuthn authorize user Type: `string`. Allowed values: `PWDLESS_LOGIN`, `PWD_RESET_ACTION`, `PWD_RESET_CROSS_DEVICE_ACTION`, `WEBAUTHN_AUTHORIZE_USER`. Example: `PWDLESS_LOGIN`. ### PasswordTemplateType Identifies the type of mode that the password action template will be used for. Type: `string`. Allowed values: `SMS`, `EMAIL`. Example: `EMAIL`.