--- schema_version: "1" id: 23b52f52e865ca2fd24f6de7f36fc3c3e1d4dd4b962f4d25db106a3274931d70 title: Shopper Login (SLAS) collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/references/generated-api-specs/auth.md canonical_url: https://developer.salesforce.com/docs/commerce/commerce-api/references/auth source_site: developer.salesforce.com content_type: documentation content_hash: 4fec4e364feb233a75f5053bd703801895b8f0d85f702d08f1932bfe7a63ae4e products: - B2C Commerce API - Salesforce APIs --- Shopper Login (SLAS) # Shopper Login (SLAS) [Download API specification](https://developer.salesforce.com/static/commercecloud/commerce-api/auth/auth-oas-v1-public.yaml) ## API Overview The Shopper Login and API Access Service (SLAS) enables secure access to Commerce Cloud’s Shopper APIs for a wide range of headless commerce applications. **Important:** Before using this API, see [Authorization for Shopper APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-shopper-apis.html) in the Get Started guides and the more detailed [SLAS guides](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) for instructions on setting up a SLAS client, obtaining credentials, as well as flow and use case information. For load shedding and rate limiting information, see [Load Shedding and Rate Limiting.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/throttle-rates.html) **Version:** 1.50.0 ## Servers * `https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1` * `shortCode (default shortCode)` ## Security * `ShopperToken` (oauth2) ShopperToken authentication follows the authorization code grant flow, as defined by the OAuth 2.1 standard. Depending on the type of OAuth client (public or private), this authorization flow has further requirements. For a detailed description of the authorization flow, see the [SLAS overview](https://developer.salesforce.com/docs/commerce/commerce-api/references?meta=shopper-login:Summary). A shopper token allows you to access the Shopper API endpoints of both OCAPI and the B2C Commerce API. These endpoints can be used to build headless storefronts and other applications. The `ShopperToken` security scheme is a parent of other security schemes, such as `ShopperTokenTsob`. A Shopper API endpoint can require a specific child scheme (`ShopperTokenTsob`, for example) that cannot be accessed with a regular shopper token. * OAuth flow clientCredentials (tokenUrl: https://{shortCode}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/token) * Scope sfcc.pwdless\_login: Passwordless Login scope * Scope sfcc.session\_bridge: Session Bridge scope * Scope sfcc.ta\_ext\_on\_behalf\_of: Trusted Agent External On Behalf Of scope * Scope sfcc.ts\_ext\_on\_behalf\_of: Trusted System External On Behalf Of scope * OAuth flow authorizationCode (authorizationUrl: https://{short-code}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/authorize, tokenUrl: https://{short-code}.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/{organizationId}/oauth2/token) * Scope sfcc.pwdless\_login: Passwordless Login scope * Scope sfcc.session\_bridge: Session Bridge scope * Scope sfcc.ta\_ext\_on\_behalf\_of: Trusted Agent External On Behalf Of scope * Scope sfcc.ts\_ext\_on\_behalf\_of: Trusted System External On Behalf Of scope ## Operations ### POST Log in a shopper with credentials that are managed by a B2C Commerce instance (B2C Commerce). `POST /organizations/{organizationId}/oauth2/login` Operation ID: `authenticateCustomer`. This follows the authorization code grant flow as defined by the OAuth 2.1 standard. It also uses a proof key for code exchange (PKCE). For PKCE values: * The `code_verifier` string is a random string used for the `/token` endpoint request. * The `code_challenge` is an encoded version of the `code_verifier` string using an SHA-256 hash. The request must include a basic authorization header that contains a Base64 encoded version of the following string: `:`. Required parameters: `code_challenge`, `channel_id`, `client_id`, and `redirect_uri`. Optional parameters: `usid`. The SLAS `/login` endpoint redirects back to the redirect URI and returns an authorization code. Calls to `/login` made with the same loginId and tenantId within 1 second result in a conflict. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string, required) Base64-encoded username and password for HTTP basic authentication Example: `Basic `. * `x-slas-client-auth` (header, string) Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`). For example, `clientId:clientSecret`. Don't add the string `"Basic"`. The `x-slas-client-auth` header is supported for SLAS private clients. When strict client auth is enabled for the client, requests without this header are rejected with a 401. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `LoginRequest`. #### Responses * **303** The authorization code and usid were successfuly added to the location header and sent to the callback as query parameters. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `string`. Type: `string`. _Example: authenticateCustomerSuccess_ ``` { "location": "https://:/callback?usid=d11392ae-cbf0-4296-9723-8f9f0e49fd73&state=1728422547223&scope=openid%20offline_access&code=561X8NOKvoRezq2aucazwwkrevUoIP37YRTfsRHX8ow" } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InvalidBasicAuth401_ ``` { "error": "invalid_client", "error_description": "Basic Authorization failed." } ``` * **409** Conflict Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: ConflictingCalls409_ ``` { "error": "conflict", "error_description": "The same loginId and tenantId tried to login twice within 1 second." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Allow the customer to authenticate when their identity provider is down. `POST /organizations/{organizationId}/oauth2/passwordless/login` Operation ID: `authorizePasswordlessCustomer`. This endpoint allows customers to authenticate when their configured identity provider is inaccessible. It provides an alternative authentication path through passwordless login methods like email or SMS verification. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `register_customer` (query, string) When set to `true`, creates a new customer profile in B2C Commerce if one doesn't already exist. Requires `last_name` and `email` body parameters unless `user_id` is an email address. Optionally accepts `first_name` and `phone_number` body parameters. If the customer profile doesn't exist, it is created when the TOTP is validated via the `passwordless/token` endpoint. When set to `false` (or omitted), no customer profile is created in B2C Commerce. Maximum length: 5. * `strict_verify` (query, boolean) When set to `true`, blocks the passwordless login request and returns a `400` error if the shopper's email is not verified. Use this to enforce shopper email verification before allowing passwordless authentication. Available in B2C Commerce version 26.6 and later. Default: `false` Default: `false`. Example: `true`. * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), for example: `clientId:clientSecret` Maximum length: 4096. Example: `Basic `. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `PasswordlessLoginRequest`. #### Responses * **200** The customer authenticated successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `string`. Type: `string`. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` _Example: UnverifiedShopper400_ ``` { "error": "invalid_request", "error_description": "Email not verified." } ``` _Example: TooManyLoginRequests400_ This error is returned specifically when mode = email and the user has exceeded the maximum number of login attempts within the rate limit window. The client should implement exponential backoff and retry the request after the specified time period. ``` { "error": "invalid_request", "error_description": "Too many login requests were made. Please try again later." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **412** Precondition failure Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: DependentServiceUnavailable412_ ``` { "error": "precondition_failure", "error_description": "Dependent service is not available." } ``` ### GET Log out a shopper. `GET /organizations/{organizationId}/oauth2/logout` Operation ID: `logoutCustomer`. The shopper's access token and refresh token are revoked. If the shopper authenticated with a B2C Commerce (B2C Commerce) instance, the OCAPI JWT is also revoked. Call this endpoint for registered users that have logged in using SLAS. Do not use this endpoint for guest users. Required header: Authorization header bearer token of the Shopper access token to log out. Required parameters: `refresh token`, `channel_id`, and `client`. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `client_id` (query, string, required) The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required. Maximum length: 40. * `refresh_token` (query, string, required) Refresh token that was given during the access token request. * `channel_id` (query, string) The `channel_id` parameter must be provided if the shopper authenticated using the `login` endpoint with B2C Commerce. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `hint` (query, string) `hint=all-sessions` logs out all sessions and invalidates all refresh tokens for a shopper with the same SLAS user ID. This only works within the same session type. Sessions created through different authentication methods (/authorize vs. Trusted System On Behalf) are treated as separate sessions. To invalidate tokens with different SLAS User IDs, you must make explicit logout calls with each token. A shopper authenticated via both /authorize and TSOB has two separate sessions. You will need two logout calls (one per token) to fully log them out. If this query parameter is not provided, the default behavior is to log out only the current session that matches the refresh token in the request. If an incorrect value is provided for the hint other than `all-sessions`, the request fails. Allowed values: `all-sessions`. * `Authorization` (header, string, required) Shopper access token to be revoked Example: `Bearer eyJ2ZXIiOiIxLjAiLCJraWQiOiI0ZTQyNTFkOS0zM2Y2LTRjMTMtYjZmZC1mOWJkNTJmYTZhNDciLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4xLjAiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5wcm9kdWN0cy5ybyBzZmNjLmNhdGFsb2dzLnJvIHNmY2Muc2hvcHBlci5ydyIsInN1YiI6ImNjLXNsYXM6OnNsc2FfZGV2OjpzY2lkOjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3Yjo6dXNpZDoxY2E3OWZiNi0xYjIyLTRmOWItOGJiNi05YmU5NWNjMjA4NjMiLCJjdHgiOiJzbGFzLm5vdF9mb3JfZXh0ZXJuYWxfdXNlIiwiaXNzIjoic2xhcy9kZXYvc2xzYV9kZXYiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvZGV2L3Nsc2FfZGV2IiwibmJmIjoxNTk0NzY0MDgwLCJzdHkiOiJVc2VyIiwiaXNiIjoidWlkbzpzbGFzOjp1cG46R3Vlc3Q6OnVpZG46R3Vlc3QgVXNlciIsImV4cCI6MTU5NDc2NTkxMCwiaWF0IjoxNTk0NzY0MTEwLCJqdGkiOiJDMkMxNjM0NTE0NTEwLTE3MTQzMTg2NzY0MjcwNTcyNjQ2NTYxMzgifQ.UVYAsWXCn3hoUPy8vLlc7O96RZEHD3N3ZgdNH-ZVvJ1G-R6uJ2VPrYvwKmYXF41Ujm2bo83AYOHVqEEEPT8Kgw`. #### Responses * **200** Success Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example: logoutCustomerSuccess_ ``` { "access_token": "", "id_token": "null", "refresh_token": "", "expires_in": 0, "refresh_token_expires_in": 0, "token_type": "Bearer", "usid": "null", "customer_id": "null", "enc_user_id": "null", "idp_access_token": "", "idp_refresh_token": "null", "dnt": "null" } ``` * **303** The user has sent too many requests in a given amount of time, and rate limiting is in effect. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### GET Get an authorization code after authenticating a user against an identity provider (IDP). `GET /organizations/{organizationId}/oauth2/authorize` Operation ID: `authorizeCustomer`. This is the first step of the OAuth 2.1 authorization code flow, in which a user can log in via federation to the IDP configured for the client. After successfully logging in, the user gets an authorization code via a redirect URI. You can call this endpoint from the front channel (the browser). #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `redirect_uri` (query, string, required) The redirect for Account Manager to redirect to. A variety of URI formats and wildcard for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: * `http://localhost:3000/callback` * `https://example.com/callback` * `com.example.app:redirect_uri_path` * `*.subdomain.topleveldomain.com` Maximum length: 256. * `response_type` (query, string, required) Must be `code`. Indicates that the caller wants an authorization code. Response Type Allowed values: `code`. * `client_id` (query, string, required) The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required. Maximum length: 40. * `scope` (query, string) Allowed values: `openid`, `offline_access`, `email`. Maximum length: 256. * `state` (query, string) Value to send the client to determine the state between the authorization request and the server response. Optional, but strongly recommended. Maximum length: 512. * `usid` (query, string) A unique shopper identifier (USID). If not provided, a new USID is generated. Maximum length: 256. * `hint` (query, string) Name of an identity provider (IDP) to optionally redirect to, thereby skipping the IDP selection step. To use a public client, set `hint` to `guest` and use a public client ID to get an authorization code. If no `hint` is provided, the preferred IDP of the tenant is used by default. For session bridge authorization the `hint` should be set to `sb-user` for a registered customer and to `sb-guest` for a guest. For session bridge authorization the SLAS Client `sfcc.session_bridge` scope. Maximum length: 256. * `channel_id` (query, string) The channel that this request is for. For a B2C Commerce request, this is angalous to the site ID. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `code_challenge` (query, string) PKCE code challenge. Created by the caller. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The _`code_challenge` and 'code\_verifier'_ are required if a using SLAS public `client_id`. Minimum length: 43. Maximum length: 128. * `ui_locales` (query, string) End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 \[RFC5646\] language tag values, ordered by preference. For example, the value `fr-CA fr en` represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). In most cases the IDP supports one language tag and has a default language set on the server. SLAS will support the space-separated list and pass them to the IDP. Maximum length: 256. * `x-slas-client-auth` (header, string) Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`). For example, `clientId:clientSecret`. Don't add the string `"Basic"`. The `x-slas-client-auth` header is supported for SLAS private clients. When strict client auth is enabled for the client, requests without this header are rejected with a 401. #### Responses * **303** The authorization code was successfully added to the `redirect_uri`. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `string`. Type: `string`. _Example: authorizeCustomerSuccess_ ``` { "authorizationCode": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiS", "usid": "156c4e69-e89b-406b-a4b7-576980bb234e" } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InvalidBasicAuth401_ ``` { "error": "invalid_client", "error_description": "Basic Authorization failed." } ``` * **500** Internal Server Error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Get the shopper or guest JWT access token and a refresh token. `POST /organizations/{organizationId}/oauth2/token` Operation ID: `getAccessToken`. This is the second step of the OAuth 2.1 authorization code flow. For a private client, an application is able to get an access token for the shopper through the back channel (a trusted server) by passing in the client credentials and the authorization code retrieved from the `authorize` endpoint. For a guest user, get the shopper JWT access token and a refresh token. This is where a client application is able to get an access token for the guest user through the back channel (a trusted server) by passing in the client credentials. For a public client using PKCE, an application passes a PKCE `code_verifier` that matches the `code_challenge` that was used to `authorize` the customer along with the authorization code. When refreshing the access token with a private client ID and client secret, the refresh token is _not_ regenerated. However, when refreshing the access token with a public client ID, the refresh token is _always_ regenerated. The old refresh token is voided with every refresh call, so the refresh token on the client must be replaced to always store the new refresh token. See the Body section for required parameters, including `grant_type` and others that depend on the value of `grant_type`. **Important**: As of July 31, 2024\*\*, SLAS requires the `channel_id` query parameter in token requests. * * * ## Token Issuer Subject Construction & Constraints The Issuer Subject (`isb`) claim of the issued JWT is a composite string that identifies the shopper session. It concatenates the identity origin (`uido`), login ID (`upn`), display name (`uidn`), guest customer ID (`gcid`, 26 chars), registered customer ID (`rcid`, 26 chars, when applicable), channel ID (`chid`), and any flow-specific values (`tsob`, `taob`, `agent`, `login`, `sesb`) as `key:value` pairs separated by `::`. **Constraint:** the assembled `isb` must not exceed **256 characters**. Exceeding this returns `400 BAD_REQUEST` with _"Issuer Subject length must be less than 256 characters"_. **Length calculation breakdown** (with `gcid`\=26, `rcid`\=26, `chid`≤100). Overhead = key chars + each key's trailing `:` + `::` separators between pairs. | Shape | Overhead | Fixed values | Remaining budget | | --- | --- | --- | --- | | Guest | 32 | gcid 26 + chid 100 = 126 | 98 | | Registered | 39 | gcid 26 + rcid 26 + chid 100 = 152 | 65 | | TSOB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(tsob) | | TSOB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(tsob) | | Pwdless | 47 | gcid 26 + rcid 26 + chid 100 = 152 | 57 - len(login) | | SESB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(sesb) | | SESB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(sesb) | | TAOB guest | 47 | gcid 26 + chid 100 = 126 | 83 - len(taob + agent) | | TAOB registered | 54 | gcid 26 + rcid 26 + chid 100 = 152 | 50 - len(taob + agent) | **Worst case (TAOB registered):** ``` 256 total - 54 overhead - 26 gcid - 26 rcid - 100 chid (allowed max) ---- 50 Then if taob = ta_ext_on_behalf_of: 50 - 19 = 31 Meaning only 31 characters remain for uido + upn + uidn + agent. ``` **Practical caps per variable sub-claim:** | Sub-claim | Description | Max length | | --- | --- | --- | | `uido` | Identity origin | ~20 | | `upn` | Login ID / email | ~80 | | `uidn` | Display name (after `%3A` escaping) | ~60 | | `tsob` / `taob` | Trusted-system / trusted-agent hint | ~21 | | `agent` | Agent ID | ~32 | | `login` | Passwordless literal (e.g. `pwdless`) | short | | `sesb` | Session-bridge hint | short | | `chid` | Channel ID | 100 | **Notes:** * **Identity Origin Variance** — `uido` is a static IDP-configuration string (e.g. `ecom`, `google`, `Link_Brand_Production`). A longer origin reduces the budget available for user-supplied inputs. * **Double-Count Fallback** — if a shopper registers without a first and last name, `uidn` is generated from the email (prefix as first name, domain as last name), so the email is effectively counted **twice** (once as `upn`, once as `uidn`). Long emails are the most common cause of overflow. * Colons inside `uidn` are URL-encoded as `%3A`, which can further inflate its length. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), for example: `clientId:clientSecret`. Not required if the grant type is `authorization_code_pkce` or `refresh_token`. Example: `Basic `. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `TokenRequest`. #### Responses * **200** the shopper or guest JWT access token and a refresh token were retrieved successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example: getAccessTokenSuccess_ ``` { "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg", "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w", "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU", "expires_in": 900, "refresh_token_expires_in": 7776000, "token_type": "Bearer", "usid": "18cda486-fe32-4e27-888b-6e4f89938e67", "customer_id": "1000005", "enc_user_id": "45D39A8499A95288F82855427EBA99B5", "idp_access_token": "eyJraWQiOiJYS21HbHVuSm0zSlBTMHNjQXZXV19XQlYtRi1wMkxLSDR0V05UMHVVSjVJIiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULjFMY0xxTWhqM2t0N1FKeFhxQ0VtdGZOOVV2eUcweW1meDFxZG9BdzF1NWMub2FyeXhveHF0QUtxaVFMbkM1ZDYiLCJpc3MiOiJodHRwczovL2Rldi05NTY1MjM2Lm9rdGEuY29tIiwiYXVkIjoiaHR0cHM6Ly9kZXYtOTU2NTIzNi5va3RhLmNvbSIsInN1YiI6Im9rdGEuc2xhcy50ZXN0IiwiaWF0IjoxNjc5Njk4MzA4LCJleHAiOjE2Nzk3MDE5MDgsImNpZCI6IjBvYTJrNXNma0JXZ0poTEVHNWQ2IiwidWlkIjoiMDB1MzhxZGpuU2NMT0IxbXE1ZDYiLCJzY3AiOlsib2ZmbGluZV9hY2Nlc3MiLCJvcGVuaWQiLCJlbWFpbCIsInByb2ZpbGUiXSwiYXV0aF90aW1lIjoxNjc5Njk4MzA2fQ.FDbGsnZGwTYVKGSlAo6jqcjG2HQ_BqQKRk72M5h69DRHyOM4wngsEELN_Wtgj3E77sP7IOmIKjiK5SFP17ADMbKZptVr2pqaMVF3PuU3Cbl_MgXZValfT-z12jHRq9sHMfsdTjY2RnvG44ZDFKc2no8mdL6IJ1MfCaZT5Tql5Ktq_UgudaWFsYqad3ETcmp5Y8ivz1bFnqud0sO9D9JzYOtfd9h71JKcsSC2rXc_Si-INPKKaGl8CDgaLXxu_Am9twJpUenHLpy0BerhcVvdFz7_611E53xOT_Esrc1pe-XAZtlYsJFnhxTBDT342ukiSWk2m6juVappv1GsRfUf2g" } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InvalidBasicAuth401_ ``` { "error": "invalid_client", "error_description": "Basic Authorization failed." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Get a shopper JWT access token for a customer using session bridging. `POST /organizations/{organizationId}/oauth2/session-bridge/token` Operation ID: `getSessionBridgeAccessToken`. For public client ID requests, you must set the grant\_type to `session_bridge`. For private client\_id and secret, you must set the grant\_type to `client_credentials` along with a basic authorization header. **DEPRECATED** - As of January 31, 2024, SLAS no longer supports the SESB `dwsid` parameter for `guest` users for `session-bridge/token` calls. We recommended you transition to using a SESB `dwsgst` token. The `dwsid` is still needed for `registered` user `session-bridge/token` calls. **NOTE:** The registered customer Json Web Token (JWT) is available in B2C Commerce versions 25.4 and later. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `SessionBridgeTokenRequest`. #### Responses * **200** The shopper JWT access token was retrieved successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example: getSessionBridgeAccessTokenSuccess_ ``` { "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg", "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w", "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU", "expires_in": 900, "refresh_token_expires_in": 7776000, "token_type": "Bearer", "usid": "18cda486-fe32-4e27-888b-6e4f89938e67", "customer_id": "1000005", "enc_user_id": "45D39A8499A95288F82855427EBA99B5", "idp_access_token": "" } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **503** Gateway error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: GatewayError503_ ``` { "error": "gateway_server_error", "error_description": "A service that the server relies on is down or is having difficulty." } ``` ### POST Get a shopper JWT access token for a registered customer whose credentials are stored using a third party. `POST /organizations/{organizationId}/oauth2/trusted-system/token` Operation ID: `getTrustedSystemAccessToken`. The SLAS client must have the `sfcc.ts_ext_on_behalf_of` scope to access this endpoint. For trusted-system requests, you can use a basic authorization header that includes a SLAS private client ID and SLAS private client secret instead of the bearer token. For trusted-system requests, you cannot use SLAS public client\_ids. * * * ## Token Issuer Subject Construction & Constraints The Issuer Subject (`isb`) claim of the issued JWT is a composite string that identifies the shopper session. It concatenates the identity origin (`uido`), login ID (`upn`), display name (`uidn`), guest customer ID (`gcid`, 26 chars), registered customer ID (`rcid`, 26 chars, when applicable), channel ID (`chid`), and any flow-specific values (`tsob`, `taob`, `agent`, `login`, `sesb`) as `key:value` pairs separated by `::`. **Constraint:** the assembled `isb` must not exceed **256 characters**. Exceeding this returns `400 BAD_REQUEST` with _"Issuer Subject length must be less than 256 characters"_. **Length calculation breakdown** (with `gcid`\=26, `rcid`\=26, `chid`≤100). Overhead = key chars + each key's trailing `:` + `::` separators between pairs. | Shape | Overhead | Fixed values | Remaining budget | | --- | --- | --- | --- | | Guest | 32 | gcid 26 + chid 100 = 126 | 98 | | Registered | 39 | gcid 26 + rcid 26 + chid 100 = 152 | 65 | | TSOB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(tsob) | | TSOB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(tsob) | | Pwdless | 47 | gcid 26 + rcid 26 + chid 100 = 152 | 57 - len(login) | | SESB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(sesb) | | SESB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(sesb) | | TAOB guest | 47 | gcid 26 + chid 100 = 126 | 83 - len(taob + agent) | | TAOB registered | 54 | gcid 26 + rcid 26 + chid 100 = 152 | 50 - len(taob + agent) | **Worst case (TAOB registered):** ``` 256 total - 54 overhead - 26 gcid - 26 rcid - 100 chid (allowed max) ---- 50 Then if taob = ta_ext_on_behalf_of: 50 - 19 = 31 Meaning only 31 characters remain for uido + upn + uidn + agent. ``` **Practical caps per variable sub-claim:** | Sub-claim | Description | Max length | | --- | --- | --- | | `uido` | Identity origin | ~20 | | `upn` | Login ID / email | ~80 | | `uidn` | Display name (after `%3A` escaping) | ~60 | | `tsob` / `taob` | Trusted-system / trusted-agent hint | ~21 | | `agent` | Agent ID | ~32 | | `login` | Passwordless literal (e.g. `pwdless`) | short | | `sesb` | Session-bridge hint | short | | `chid` | Channel ID | 100 | **Notes:** * **Identity Origin Variance** — `uido` is a static IDP-configuration string (e.g. `ecom`, `google`, `Link_Brand_Production`). A longer origin reduces the budget available for user-supplied inputs. * **Double-Count Fallback** — if a shopper registers without a first and last name, `uidn` is generated from the email (prefix as first name, domain as last name), so the email is effectively counted **twice** (once as `upn`, once as `uidn`). Long emails are the most common cause of overflow. * Colons inside `uidn` are URL-encoded as `%3A`, which can further inflate its length. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), for example: `clientId:clientSecret`. Not required if the grant type is `authorization_code_pkce` or `refresh_token`. Example: `Basic `. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `TrustedSystemTokenRequest`. #### Responses * **200** The shopper JWT access token was retrieved successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example getTrustedSystemAccessTokenSuccess: same as POST /organizations/{organizationId}/oauth2/session-bridge/token 200 response._ * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **409** Conflict Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: ConflictingCalls409_ ``` { "error": "conflict", "error_description": "The same loginId and tenantId tried to login twice within 1 second." } ``` * **503** Gateway error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: GatewayError503_ ``` { "error": "gateway_server_error", "error_description": "A service that the server relies on is down or is having difficulty." } ``` ### GET Obtain a new agent on behalf of an authorization token for a registered customer. `GET /organizations/{organizationId}/oauth2/trusted-agent/authorize` Operation ID: `getTrustedAgentAuthorizationToken`. This endpoint enables trusted agents (such as customer service representatives or merchants) to obtain authorization tokens that allow them to act on behalf of registered customers. This facilitates customer support scenarios where agents need secure access to customer accounts. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `client_id` (query, string, required) The SLAS public client ID or SLAS private client ID for use with trusted-agent requests. When using a private client ID a PKCE code challenge is not required. Maximum length: 40. * `channel_id` (query, string, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `code_challenge` (query, string) PKCE code challenge. Created by the caller. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The _`code_challenge` and 'code\_verifier'_ are required if a using SLAS public `client_id`. Minimum length: 43. Maximum length: 128. * `login_id` (query, string, required) The ID of the shopper for trusted agent access. For TAOB Guest the `login_id` must be set to `Guest`. Maximum length: 128. * `idp_origin` (query, string, required) The IDP that the shopper is associated with. For TAOB Guest the `idp_origin` must be set to `slas`. This is standard for SLAS Guest requests. If any other `idp_origin` value is used, SLAS returns a bad request. Maximum length: 16. * `redirect_uri` (query, string, required) The redirect for Account Manager to redirect to. A variety of URI formats and wildcard for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: * `http://localhost:3000/callback` * `https://example.com/callback` * `com.example.app:redirect_uri_path` * `*.subdomain.topleveldomain.com` Maximum length: 256. * `response_type` (query, string, required) Must be `code`. Indicates that the caller wants an authorization code. Response Type Allowed values: `code`. #### Responses * **303** The new agent was obtained successfully. Headers: * `Location` (string) Location header with the `redirect_uri` to Account Manager, which allows the agent to log in. URL with redirect Maximum length: 2048. Example: `https://account.demandware.com:443/dwsso/UI/Login?realm=/&goto=https://account.demandware.com:443/dwsso/oauth2/authorize?client_id=6739cb07-2f5f-4e16-a88a-8113a3cb5512&redirect_uri=https://stg.us1.shopper.cc.salesforce.com/api/v1/trusted-agent/callback"`. * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `string`. Type: `string`. _Example: getTrustedAgentAuthorizationTokenSuccess_ ``` {} ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Get a shopper JWT access token for a registered customer using a trusted agent (merchant). `POST /organizations/{organizationId}/oauth2/trusted-agent/token` Operation ID: `getTrustedAgentAccessToken`. If using a SLAS private client ID, you must also use an `_sfdc_client_auth` header. The value of the `_sfdc_client_auth` header must be a Base64-encoded string. The string is composed of a SLAS private client ID and client secret, separated by a colon (`:`). For example, `privateClientId:privateClientsecret` becomes `cHJpdmF0ZUNsaWVudElkOnByaXZhdGVDbGllbnRzZWNyZXQ=` after Base64 encoding. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `_sfdc_client_auth` (header, string) "Base64-encoded string of client credentials. The string is composed of a client ID and client secret, separated by a colon (`:`), like this: `clientId:clientSecret`. (Do not add the string `"Basic"`.) The `_sfdc_client_auth` header is only required when using a SLAS private client ID." * `Authorization` (header, string) This is the `Bearer` token that is returned from Account Manager after the trusted agent on behalf of (TAOB) authorize call. Example: `Bearer HQ8zQXpc0VVaXEdBdzasZQaCQDw`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `TrustedAgentTokenRequest`. #### Responses * **200** Success Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example: getTrustedAgentAccessTokenSuccess_ ``` { "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg", "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w", "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU", "expires_in": 900, "token_type": "Bearer", "refresh_token_expires_in": 7776000, "usid": "18cda486-fe32-4e27-888b-6e4f89938e67", "customer_id": "1000005", "enc_user_id": "45D39A8499A95288F82855427EBA99B5", "idp_access_token": "" } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **503** Gateway error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: GatewayError503_ ``` { "error": "gateway_server_error", "error_description": "A service that the server relies on is down or is having difficulty." } ``` ### POST Request a reset password token. `POST /organizations/{organizationId}/oauth2/password/reset` Operation ID: `getPasswordResetToken`. This endpoint initiates the password reset process for a customer by requesting a password reset token. The token is delivered through the configured delivery mode (email, SMS, etc.) and can be used with the password/action endpoint to set a new password. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `PasswordActionRequest`. #### Responses * **200** The reset password token was requested successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadMissingAccessOrRefreshToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token or refresh token" } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **412** Precondition failure Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: DependentServiceUnavailable412_ ``` { "error": "precondition_failure", "error_description": "Dependent service is not available." } ``` ### POST Create a new password. `POST /organizations/{organizationId}/oauth2/password/action` Operation ID: `resetPassword`. This endpoint allows a customer to set a new password using a valid password reset token. The customer must provide the token received from the password/reset endpoint along with the desired new password. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), for example: `clientId:clientSecret` Example: `Basic `. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `PasswordActionVerifyRequest`. #### Responses * **200** The password was created successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadParameters400_ ``` { "error": "invalid_request", "error_description": "Bad or missing request parameters." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **503** Gateway error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: GatewayError503_ ``` { "error": "gateway_server_error", "error_description": "A service that the server relies on is down or is having difficulty." } ``` ### POST Issue a shopper token (JWT). `POST /organizations/{organizationId}/oauth2/passwordless/token` Operation ID: `getPasswordLessAccessToken`. This endpoint issues a shopper JSON Web Token (JWT) using a passwordless login token. It enables authentication flows where traditional username/password combinations are not required, supporting alternative authentication methods. * * * ## Token Issuer Subject Construction & Constraints The Issuer Subject (`isb`) claim of the issued JWT is a composite string that identifies the shopper session. It concatenates the identity origin (`uido`), login ID (`upn`), display name (`uidn`), guest customer ID (`gcid`, 26 chars), registered customer ID (`rcid`, 26 chars, when applicable), channel ID (`chid`), and any flow-specific values (`tsob`, `taob`, `agent`, `login`, `sesb`) as `key:value` pairs separated by `::`. **Constraint:** the assembled `isb` must not exceed **256 characters**. Exceeding this returns `400 BAD_REQUEST` with _"Issuer Subject length must be less than 256 characters"_. **Length calculation breakdown** (with `gcid`\=26, `rcid`\=26, `chid`≤100). Overhead = key chars + each key's trailing `:` + `::` separators between pairs. | Shape | Overhead | Fixed values | Remaining budget | | --- | --- | --- | --- | | Guest | 32 | gcid 26 + chid 100 = 126 | 98 | | Registered | 39 | gcid 26 + rcid 26 + chid 100 = 152 | 65 | | TSOB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(tsob) | | TSOB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(tsob) | | Pwdless | 47 | gcid 26 + rcid 26 + chid 100 = 152 | 57 - len(login) | | SESB guest | 39 | gcid 26 + chid 100 = 126 | 91 - len(sesb) | | SESB registered | 46 | gcid 26 + rcid 26 + chid 100 = 152 | 58 - len(sesb) | | TAOB guest | 47 | gcid 26 + chid 100 = 126 | 83 - len(taob + agent) | | TAOB registered | 54 | gcid 26 + rcid 26 + chid 100 = 152 | 50 - len(taob + agent) | **Worst case (TAOB registered):** ``` 256 total - 54 overhead - 26 gcid - 26 rcid - 100 chid (allowed max) ---- 50 Then if taob = ta_ext_on_behalf_of: 50 - 19 = 31 Meaning only 31 characters remain for uido + upn + uidn + agent. ``` **Practical caps per variable sub-claim:** | Sub-claim | Description | Max length | | --- | --- | --- | | `uido` | Identity origin | ~20 | | `upn` | Login ID / email | ~80 | | `uidn` | Display name (after `%3A` escaping) | ~60 | | `tsob` / `taob` | Trusted-system / trusted-agent hint | ~21 | | `agent` | Agent ID | ~32 | | `login` | Passwordless literal (e.g. `pwdless`) | short | | `sesb` | Session-bridge hint | short | | `chid` | Channel ID | 100 | **Notes:** * **Identity Origin Variance** — `uido` is a static IdP-configuration string (e.g. `ecom`, `google`, `Link_Brand_Production`). A longer origin reduces the budget available for user-supplied inputs. * **Double-Count Fallback** — if a shopper registers without a first and last name, `uidn` is generated from the email (prefix as first name, domain as last name), so the email is effectively counted **twice** (once as `upn`, once as `uidn`). Long emails are the most common cause of overflow. * Colons inside `uidn` are URL-encoded as `%3A`, which can further inflate its length. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), for example: `clientId:clientSecret` Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `PasswordLessLoginTokenRequest`. #### Responses * **200** The shopper token was issued successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `TokenResponse`. _Example getPasswordLessAccessTokenSuccess: same as POST /organizations/{organizationId}/oauth2/session-bridge/token 200 response._ * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **503** Gateway error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: GatewayError503_ ``` { "error": "gateway_server_error", "error_description": "A service that the server relies on is down or is having difficulty." } ``` ### POST Invalidate a refresh token. `POST /organizations/{organizationId}/oauth2/revoke` Operation ID: `revokeToken`. A basic auth header with Base64-encoded `clientId:secret` is required in the Authorization header, and the refresh token to be revoked is required in the body. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string, required) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`), like this: `clientId:clientSecret` Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `TokenActionRequest`. _Example: TokenActionRequestBody_ ``` { "token": "ry5XU_WHX20S6Cn6W7keFIs7Pzkv4wTZJS9Yvh0Ve9A.cdBxoCY9Q3jffQQOFnb_qghbSmSRnn9-2H4GwFTDMTk", "token_type_hint": "refresh_token" } ``` #### Responses * **200** The refresh token was revoked successfully. Media type: `application/json`. Schema: `TokenActionRequest`. _Example: revokeTokenSuccess_ ``` { "access_token": "", "id_token": "null", "refresh_token": "EnL9U2f3-WiVPwL60CFBI21UY_oxWAwX5JkgO-X12Vs", "expires_in": 0, "refresh_token_expires_in": 0, "token_type": "Bearer", "usid": "null", "customer_id": "null", "enc_user_id": "null", "idp_access_token": "" } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingRefreshToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing refresh token." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InvalidBasicAuth401_ ``` { "error": "invalid_client", "error_description": "Basic Authorization failed." } ``` * **500** Internal server error Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Return token properties. `POST /organizations/{organizationId}/oauth2/introspect` Operation ID: `introspectToken`. A basic auth header with Base64-encoded `clientId:secret` is required in the Authorization header, as well as an access token or refresh token. Use `token_type_hint` to help identify the token. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string, required) Base64 string for HTTP Basic authentication. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `TokenActionRequest`. _Example: TokenActionRequestBody_ ``` { "token": "ry5XU_WHX20S6Cn6W7keFIs7Pzkv4wTZJS9Yvh0Ve9A.cdBxoCY9Q3jffQQOFnb_qghbSmSRnn9-2H4GwFTDMTk", "token_type_hint": "refresh_token" } ``` #### Responses * **200** Token properties returned successfully. Media type: `application/json`. Schema: `TokenActionRequest`. _Example: introspectTokenSuccess_ ``` { "active": true, "client_id": "553ac8ac-4db9-4ed3-825c-3ae3bf5d327b", "exp": 1602523099, "iat": 1594747099, "iss": "https://localhost:9000/", "scope": "offline_access openid", "sub": "usid:edbf780a-2d83-4e82-9f64-8d051e3538d2::uido:Google::upn:blair.slas.test@gmail.com::uidn:Foo SLAS-Test", "token_type": "refresh_token" } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadMissingAccessOrRefreshToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token or refresh token" } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InvalidBasicAuth401_ ``` { "error": "invalid_client", "error_description": "Basic Authorization failed." } ``` * **500** Internal server error Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### GET Return a JSON listing of claims about the currently authenticated user. `GET /organizations/{organizationId}/oauth2/userinfo` Operation ID: `getUserInfo`. This endpoint returns identity information about the authenticated user in the form of OpenID Connect claims. It requires a valid access token and returns information such as user ID, name, email, and other identity attributes based on the scopes granted during authentication. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `channel_id` (query, string) Used when getting user information for a SFCC login. For an B2C Commerce customer, this is angalous to the site ID. Required when getting user information for an B2C Commerce customer. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `idpValidate` (query, boolean) When a user authenticates via an IDP, SLAS calls the IDP's `/userinfo` endpoint to retrieve user information. Since some IDPs don't reliably return user info, set `idpValidate=false` to skip this call and use the user information already stored in SLAS instead. Default: `true` Example: `false`. _Example_ ``` false ``` * `Authorization` (header, string, required) SLAS Access Token Maximum length: 4096. Example: `Bearer eyJ2ZXIiOiIxLjAiLCJraWQiOiI0ZTQyNTFkOS0zM2Y2LTRjMTMtYjZmZC1mOWJkNTJmYTZhNDciLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4xLjAiLCJhbGciOiJFUzI1NiJ9.eyJhdXQiOiJHVUlEIiwic2NwIjoic2ZjYy5wcm9kdWN0cy5ybyBzZmNjLmNhdGFsb2dzLnJvIHNmY2Muc2hvcHBlci5ydyIsInN1YiI6ImNjLXNsYXM6OnNsc2FfZGV2OjpzY2lkOjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3Yjo6dXNpZDoxY2E3OWZiNi0xYjIyLTRmOWItOGJiNi05YmU5NWNjMjA4NjMiLCJjdHgiOiJzbGFzLm5vdF9mb3JfZXh0ZXJuYWxfdXNlIiwiaXNzIjoic2xhcy9kZXYvc2xzYV9kZXYiLCJpc3QiOjEsImF1ZCI6ImNvbW1lcmNlY2xvdWQvZGV2L3Nsc2FfZGV2IiwibmJmIjoxNTk0NzY0MDgwLCJzdHkiOiJVc2VyIiwiaXNiIjoidWlkbzpzbGFzOjp1cG46R3Vlc3Q6OnVpZG46R3Vlc3QgVXNlciIsImV4cCI6MTU5NDc2NTkxMCwiaWF0IjoxNTk0NzY0MTEwLCJqdGkiOiJDMkMxNjM0NTE0NTEwLTE3MTQzMTg2NzY0MjcwNTcyNjQ2NTYxMzgifQ.UVYAsWXCn3hoUPy8vLlc7O96RZEHD3N3ZgdNH-ZVvJ1G-R6uJ2VPrYvwKmYXF41Ujm2bo83AYOHVqEEEPT8Kgw`. #### Responses * **200** Claims returned successfully. Media type: `application/json`. Schema: `string`. Type: `string`. _Example: getUserInfoSuccess_ ``` { "customer_id": "abxHc1lblIlKwRl0k1mqYYkewY", "email": "slas-okta-test@test.org", "external_id": "okta-00u38qdjnScLOB1mq5d6", "family_name": "Test", "given_name": "Slas", "name": "Slas Test", "sub": "98a84e4b-be50-422a-ab04-e9034e859eb9", "validated": true } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **500** Internal server error Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### GET Return a JSON listing of the OpenID/OAuth endpoints, supported scopes and claims, public keys used to sign the tokens, and other details. For performance purposes, the \`/.well-known/openid-configuration\` endpoint is rate limited to 25 call per minute. `GET /organizations/{organizationId}/oauth2/.well-known/openid-configuration` Operation ID: `getWellknownOpenidConfiguration`. This endpoint provides OpenID Connect discovery information in a standardized format. It allows clients to programmatically discover SLAS capabilities, including available endpoints, supported authentication flows, token signing algorithms, and other configuration details. This information helps clients integrate with the authentication service with minimal manual configuration. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` #### Responses * **200** The JSON listing information was returned successfully. Media type: `application/json`. Schema: `string`. Type: `string`. _Example: getWellknownOpenidConfigurationSuccess_ ``` { "authorization_endpoint": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2/authorize", "claims_supported": [ "email", "name", "given_name", "family_name", "sub" ], "code_challenge_methods_supported": [ "S256" ], "grant_types_supported": [ "authorization_code", "authorization_code_pkce", "client_credentials", "refresh_token" ], "id_token_encryption_enc_values_supported": [ "A256GCM" ], "issuer": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2", "jwks_uri": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2/jwks", "response_types_supported": [ "code", "token", "token id_token" ], "revocation_endpoint": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2/revoke", "scopes_supported": [ "email", "openid", "profile" ], "subject_types_supported": [ "public" ], "token_endpoint": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2/token", "userinfo_endpoint": "https://stg.us.shopper.cc.salesforce.com/api/v1/organizations/zzzz_tst/oauth2/userinfo" } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: MalformedTenantId400_ ``` { "error": "invalid_request", "error_description": "Tenant Id Exception - Must be a well-formed tenantId" } ``` * **500** Internal server error Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### GET Retrieve JWKS keys. `GET /organizations/{organizationId}/oauth2/jwks` Operation ID: `getJwksUri`. The `/jwks` endpoint provides a JSON Web Key Set (JWKS) that includes current, past, and future public keys. These keys allow clients to validate the Shopper JSON Web Token (JWT) issued by SLAS, ensuring that no tampering with the token has occurred. Every SLAS JWT that is passed into SLAS, SCAPI, or OCAPI is always validated and is rejected if the signature validation does not match. To optimize performance, the `/jwks` endpoint is limited to 25 calls per minute, so we recommended caching the JWKS keys and refresh them only when necessary, instead of making frequent requests. Typically, the JWKs endpoint can be used once per DAY. For additional information on using JWKS, see [https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-validate-jwt-with-jwks.html](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-validate-jwt-with-jwks.html). #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` #### Responses * **200** The response body containing the JWKS keys was retrieved successfully. Media type: `application/json`. Schema: `object`. _Example: getJwksSuccess_ ``` { "keys": [ { "crv": "P-256", "kid": "2d670fa8-0f28-44a1-b8b4-87a6d2feb1d8", "kty": "EC", "use": "sig", "x": "_2tPqxGhgX6cA5Qg7v6UH_9om8OR3-OehkgXXWraTp8", "y": "DAykmQPtf282buIcL0rLwKYbK6ApgripMjazdAthUFw" }, { "crv": "P-256", "kid": "eb70508f-4d64-46f7-a3d5-b36558d6e6b6", "kty": "EC", "use": "sig", "x": "VV0JVJFhkz71wY0E73Z-snorZ5oJf1QOdkIbCjyMqLs", "y": "QLkqBVSPPrkd7HjaSEMgMU9Ob-FDpg1W-oLq5I4ExqQ" }, { "crv": "P-256", "kid": "0f2016af-1388-4972-b54d-31cb9e3704ed", "kty": "EC", "use": "sig", "x": "KpmPoZTFXs80Uxy7QcOQ9aaqW35xgT3Qyakee8zR7gA", "y": "P87TZ52rjnOGlmjaPeUGbLaOqiB7FHnoEzULIw6QlfJ" } ] } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: getJwksUri400_ ``` { "error": "invalid_request", "error_description": "Tenant Id Exception - Must be a well-formed tenantId" } ``` * **500** Internal Server Error Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Authorize user for WebAuthn registration `POST /organizations/{organizationId}/oauth2/webauthn/register/authorize` Operation ID: `authorizeWebauthnRegistration`. Authorizes a user to register a WebAuthn credential (passkey). This endpoint validates the user's credentials and creates a password action token that can be used to start the registration process. The token is sent to the user via the specified channel (email or SMS). The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`. Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `PasswordActionRequest`. #### Responses * **204** User successfully authorized for WebAuthn registration. TOTP sent to user. * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` ### POST Start WebAuthn registration `POST /organizations/{organizationId}/oauth2/webauthn/register/start` Operation ID: `startWebauthnUserRegistration`. Starts the WebAuthn registration process by generating credential creation options. Returns the challenge and other parameters needed by the authenticator to create a new credential. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`. Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `RegistrationStartRequest`. _Example: registrationStartRequest_ ``` { "client_id": "12345678-1234-1234-1234-123456789012", "pwd_action_token": "12345678", "user_id": "user@example.com", "channel_id": "RefArch", "display_name": "John Doe", "nick_name": "My iPhone" } ``` #### Responses * **200** Registration options successfully generated. Media type: `application/json`. Schema: `object`. _Example: startWebauthnUserRegistrationSuccess_ ``` { "extensions": {}, "attestation": "none", "challenge": "qcjjr4ZckSHuiSd1nShZkVt12I1udQO_7MAkynXP8Nk", "authenticatorSelection": { "userVerification": "preferred", "requireResidentKey": false, "residentKey": "preferred" }, "user": { "name": "darth.vader", "id": "GyOH81kDRxJBvHPQkkbmTagOADuixhp_37P_UnSwHAI", "displayName": "Darth Vader" }, "rp": { "name": "SLAS Service", "id": "localhost" }, "timeout": 90000, "excludeCredentials": [], "pubKeyCredParams": { "alg": -7, "type": "public-key" } } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` ### POST Finish WebAuthn registration `POST /organizations/{organizationId}/oauth2/webauthn/register/finish` Operation ID: `finishWebauthnUserRegistration`. Completes the WebAuthn registration process by verifying the credential created by the authenticator. Stores the public key and credential information for future authentication. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`. Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/json`. Schema: `RegistrationFinishRequest`. #### Responses * **204** Registration successfully completed * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` ### POST Start WebAuthn authentication `POST /organizations/{organizationId}/oauth2/webauthn/authenticate/start` Operation ID: `startWebauthnAuthentication`. Starts the WebAuthn authentication process by generating credential request options. Returns the challenge and allowed credentials for the user to authenticate with. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`. Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `AuthenticateRequest`. _Example: authenticateRequest_ ``` { "tenant_id": "zzte_053", "client_id": "12345678-1234-1234-1234-123456789012", "channel_id": "RefArch", "user_id": "user@example.com" } ``` #### Responses * **200** Authentication options successfully generated Media type: `application/json`. Schema: `PublicKeyCredentialRequestOptions`. _Example: webauthnAuthenticationStartSuccess_ ``` { "challenge": "V2FsdGVyIFdoaXRlIFRlc3QgQ2hhbGxlbmdl", "timeout": 60000, "rpId": "localhost", "allowCredentials": [ { "type": "public-key", "id": "AQIDBAUGBwgJCgsMDQ4PEA", "transports": [ "usb", "nfc" ] } ], "userVerification": "preferred", "extensions": {} } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **404** Not Found Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: UserNotFound404_ ``` { "error": "not_found", "error_description": "User Not Found" } ``` ### POST Finish WebAuthn authentication `POST /organizations/{organizationId}/oauth2/webauthn/authenticate/finish` Operation ID: `finishWebauthnAuthentication`. Completes the WebAuthn authentication process by verifying the assertion from the authenticator. Returns OAuth tokens upon successful authentication. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `Authorization` (header, string) Base64-encoded string for HTTP Basic authentication. The string is composed of a client ID and client secret, separated by a colon (`:`). For example: `clientId:clientSecret`. Example: `Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW`. #### Request body (required) Media type: `application/json`. Schema: `AuthenticateFinishRequest`. #### Responses * **200** Authentication successful Media type: `application/json`. Schema: `AuthenticateResult`. _Example: webauthnAuthenticationFinishSuccess_ ``` { "credentialId": "AQIDBAUGBwgJCgsMDQ4PEA", "username": "user@example.com", "success": true, "tokenResponse": { "access_token": "eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg", "id_token": "eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w", "refresh_token": "EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU", "expires_in": 900, "refresh_token_expires_in": 7776000, "token_type": "Bearer", "usid": "18cda486-fe32-4e27-888b-6e4f89938e67", "customer_id": "1000005", "enc_user_id": "45D39A8499A95288F82855427EBA99B5", "idp_access_token": "" } } ``` * **400** Bad request Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` ### GET Retrieve passkey user information and credentials by login ID `GET /organizations/{organizationId}/oauth2/webauthn/passkey/user/{loginId}` Operation ID: `getPasskeyUserByLoginId`. Security: ShopperToken (sfcc.pwdless\_login). This endpoint retrieves a user's WebAuthn passkey information including all associated credentials. It returns the user's profile information along with a list of all registered passkey credentials. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. This endpoint requires Shopper JWT authentication. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `channel_id` (query, string, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `loginId` (path, string, required) The login ID (username) of the user whose passkey information is being retrieved Minimum length: 1. Maximum length: 256. Example: `user@example.com`. * `Authorization` (header, string, required) Shopper JWT access token Minimum length: 1. Maximum length: 4096. Example: `Bearer eyJ2ZXIiOiIxLjAiLCJraWQiOiI0ZTQyNTFkOS0zM2Y2LTRjMTMtYjZmZC1mOWJkNTJmYTZhNDciLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4xLjAiLCJhbGciOiJFUzI1NiJ9...`. #### Responses * **200** The passkey user information and credentials were retrieved successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/json`. Schema: `PasskeyUser`. _Example: getPasskeyUserByLoginIdSuccess_ ``` { "id": 26, "userName": "user@example.com", "displayName": "John Doe", "userHandle": "yRU-7pWyWUE6nw8hztqqUZG635p7UKDDb2lbC1FyF78", "slasUserId": 10000, "credentials": [ { "id": 21, "userId": 26, "credentialId": "t5Awv5pJ_kM7K8U2-5ijw5rSKNkHFHTTg_gAbdrod8c", "nickName": "Fingerprint", "publicKey": "pQECAyYgASFYIKIpY59lUthC1dDw_9WXKCOaLNCB2WSoGrK0kAZG33s3IlggxTvdmk2QC_HPjAwf_eHdoxIBvfN3c376ws8xUaxlJ4A", "userHandle": "yRU-7pWyWUE6nw8hztqqUZG635p7UKDDb2lbC1FyF78", "signatureCount": "2" }, { "id": 22, "userId": 26, "credentialId": "SVKfbUGBXofb2JzliJrMtZDENYByWgq_j4-p2M_3wC4", "nickName": "YubiKey", "publicKey": "pQECAyYgASFYIHM_4IKLMC8dboiRNfD0E0Gk4LmCTIgEyCTr-9SyHHeIIlggfn5_AzAl67kttLXWb-_Ts6MG7WHKoXzlKtame_wEYPE", "userHandle": "yRU-7pWyWUE6nw8hztqqUZG635p7UKDDb2lbC1FyF78", "signatureCount": "5" } ] } ``` * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingLoginId400_ ``` { "error": "invalid_request", "error_description": "The login ID is missing or invalid." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **403** Forbidden - token validation failed Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: TokenMismatch403_ ``` { "error": "forbidden", "error_description": "The loginId, organizationId, or channel_id in the token does not match the request parameters." } ``` * **404** Not found Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: PasskeyUserNotFound404_ ``` { "error": "not_found", "error_description": "No passkey user found with the provided login ID." } ``` ### DELETE Delete passkey user and all associated credentials `DELETE /organizations/{organizationId}/oauth2/webauthn/passkey/user/{loginId}` Operation ID: `deletePasskeyUser`. Security: ShopperToken (sfcc.pwdless\_login). This endpoint deletes a user's WebAuthn passkey information and all associated credentials. The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId, and channel\_id in the token match the values in the path and query parameters. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. This endpoint requires Shopper JWT authentication. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `channel_id` (query, string, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `loginId` (path, string, required) The login ID (username) of the user whose passkey information is being deleted Minimum length: 1. Maximum length: 256. Example: `user@example.com`. * `Authorization` (header, string, required) Shopper JWT access token Minimum length: 1. Maximum length: 4096. Example: `Bearer eyJ2ZXIiOiIxLjAiLCJraWQiOiI0ZTQyNTFkOS0zM2Y2LTRjMTMtYjZmZC1mOWJkNTJmYTZhNDciLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4xLjAiLCJhbGciOiJFUzI1NiJ5...`. #### Responses * **204** The passkey user and all credentials were deleted successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingLoginId400_ ``` { "error": "invalid_request", "error_description": "The login ID is missing or invalid." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **403** Forbidden - token validation failed Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: TokenMismatch403_ ``` { "error": "forbidden", "error_description": "The loginId, organizationId, or channel_id in the token does not match the request parameters." } ``` * **404** Not found Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: PasskeyUserNotFound404_ ``` { "error": "not_found", "error_description": "No passkey user found with the provided login ID." } ``` ### DELETE Delete a specific passkey credential `DELETE /organizations/{organizationId}/oauth2/webauthn/passkey/user/{loginId}/credentials/{credentialId}` Operation ID: `deletePasskeyCredential`. Security: ShopperToken (sfcc.pwdless\_login). This endpoint deletes a specific WebAuthn passkey credential for a user. The endpoint validates the Shopper JWT signature and ensures that the loginId, organizationId, and channel\_id in the token match the values in the path and query parameters. The SLAS client must have the `sfcc.pwdless_login` scope to access this endpoint. This endpoint requires Shopper JWT authentication. #### Parameters * `organizationId` (path, string, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/get-started.html#instance-types). Minimum length: 1. Maximum length: 32. Example: `f_ecom_zzxy_prd`. _Example_ ``` f_ecom_zzxy_prd ``` * `channel_id` (query, string, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. _Example_ ``` RefArch ``` * `loginId` (path, string, required) The login ID (username) of the user whose passkey credential is being deleted Minimum length: 1. Maximum length: 256. Example: `user@example.com`. * `credentialId` (path, string, required) The unique identifier of the credential to delete Minimum length: 1. Maximum length: 1024. Example: `Y3JlZGVudGlhbElkMTIz`. * `Authorization` (header, string, required) Shopper JWT access token Minimum length: 1. Maximum length: 4096. Example: `Bearer eyJ2ZXIiOiIxLjAiLCJraWQiOiI0ZTQyNTFkOS0zM2Y2LTRjMTMtYjZmZC1mOWJkNTJmYTZhNDciLCJ0eXAiOiJqd3QiLCJjbHYiOiJKMi4xLjAiLCJhbGciOiJFUzI1NiJ5...`. #### Responses * **204** The passkey credential was deleted successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingParameter400_ ``` { "error": "invalid_request", "error_description": "The login ID or credential ID is missing or invalid." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **403** Forbidden - token validation failed Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: TokenMismatch403_ ``` { "error": "forbidden", "error_description": "The loginId, organizationId, or channel_id in the token does not match the request parameters." } ``` * **404** Not found Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: PasskeyCredentialNotFound404_ ``` { "error": "not_found", "error_description": "No passkey credential found with the provided credential ID." } ``` ### POST Request a one-time password (OTP) for a shopper. `POST /organizations/{organizationId}/oauth2/otp/request` Operation ID: `requestOtp`. Security: ShopperToken (sfcc.pwdless\_login). Generates a one-time password (OTP) and delivers it to the shopper via the specified mode (email or callback). The OTP can then be used with the `/otp/verify` endpoint to verify the shopper. When `mode` is `email`, the `email` field is required. A shopper is limited to 6 email OTP requests per 10-minute window. When `mode` is `callback`, the `callback_uri` field is required and must match a registered callback URI for the client. #### Parameters * `organizationId` (path, OrganizationId, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id). _Example_ ``` f_ecom_zzxy_prd ``` #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `OtpRequest`. _Example: otpRequest_ ``` { "client_id": "12345678-1234-1234-1234-123456789012", "channel_id": "RefArch", "user_id": "shopper@example.com", "mode": "email", "email": "shopper@example.com", "locale": "en-GB" } ``` #### Responses * **202** The OTP was generated and delivery was initiated successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingClientId400_ ``` { "error": "invalid_request", "error_description": "Bad or missing client_id." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **429** Too many requests Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: TooManyRequests429_ ``` { "error": "invalid_request", "error_description": "Too many OTP requests were made. Please try again later." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ### POST Verify a one-time password (OTP) for a shopper. `POST /organizations/{organizationId}/oauth2/otp/verify` Operation ID: `verifyOtp`. Security: ShopperToken (sfcc.pwdless\_login). Verifies a one-time password (OTP) previously issued by the `/otp/request` endpoint. On success, the OTP token is consumed and cannot be reused. Each new call to `/otp/request` invalidates any previously issued OTP. #### Parameters * `organizationId` (path, OrganizationId, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id). _Example_ ``` f_ecom_zzxy_prd ``` #### Request body (required) Media type: `application/x-www-form-urlencoded`. Schema: `OtpVerifyRequest`. _Example: otpVerifyRequest_ ``` { "pwd_action_token": "12345678", "client_id": "12345678-1234-1234-1234-123456789012", "channel_id": "RefArch", "user_id": "shopper@example.com" } ``` #### Responses * **204** The OTP was verified successfully. Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. * **400** Bad request or invalid/expired OTP Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: BadOrMissingAccessToken400_ ``` { "error": "invalid_request", "error_description": "Bad or missing access token." } ``` * **401** Unauthorized Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: Unauthorized401_ ``` { "error": "invalid_client", "error_description": "Authorization failed." } ``` * **429** Too many requests Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: TooManyRequests429_ ``` { "error": "invalid_request", "error_description": "Too many OTP verification attempts were made. Please try again later." } ``` * **500** Internal server error Headers: * `X-RateLimit-1M-Limit` (string) The 1 minute maximum number of requests permitted per hour. * `X-RateLimit-1M-Remaining` (string) The 1 minute number of requests remaining in the current rate limit window. * `X-RateLimit-1M-Reset` (string) The 1 minute time at which the current rate limit window resets in UTC epoch seconds. * `X-RateLimit-5M-Limit` (string) The 5 minute maximum number of requests permitted per hour. * `X-RateLimit-5M-Remaining` (string) The 5 minute number of requests remaining in the current rate limit window. * `X-RateLimit-5M-Reset` (string) The 5 minute time at which the current rate limit window resets in UTC epoch seconds. Media type: `application/problem+json`. Schema: `Oauth2ErrorResponse`. _Example: InternalServerError500_ ``` { "error": "server_error", "error_description": "The server has encountered a situation that it doesn't know how to handle." } ``` ## Schemas ### LoginRequest Supports multiple custom parameters to invoke hooks in B2C Commerce API. Multiple custom parameters can be added. Use the `c_` prefix to distinguish custom query parameters from standard query parameters, for example: c\_captcha=true If there is a validation error, a 400 Bad\_Request with the details of the error is thrown. * `client_id` (_string_) SLAS client ID. Required when the grant type is `authorization_code_pkce`. Maximum length: 40. Example: `z99ec276-cg53-4g94-cf72-76f300c6778zc`. * `response_type` (_object_) Must be `code`. Indicates that the client wants an authorization code (when the grant type is `authorization_code`). Includes all fields of `ResponseType`. * `redirect_uri` (_string_, required) The URI to which the server redirects the browser after the user grants the authorization. The URI must be registered with the SLAS client. A variety of URI formats and wildcards for host are supported, but app links like airbnb:// or fb:// are not. Examples of supported URIs: Examples of supported URIs: * `http://localhost:3000/callback` * `https://example.com/callback` * `com.example.app:redirect_uri_path` * `*.subdomain.topleveldomain.com` Maximum length: 256. Example: `http://localhost:3000/callback`. * `state` (_string_) Value to be sent by the client to determine the state between the authorization request and the server response. Optional, but strongly recommended. Maximum length: 512. Example: `client-state`. * `scope` (_string_) Scopes to limit an application's access to a user's account. Maximum length: 256. Example: `openid|offline_access|email`. * `usid` (_string_) The unique shopper ID. Maximum length: 128. Example: `18cda486-fe32-4e27-888b-6e4f89938e67`. * `channel_id` (_string_, required) The channel that the request is for. For a B2C Commerce request, this is angalous to the site ID. Maximum length: 100. Example: `RefArch`. * `code_challenge` (_string_) PKCE code verifier. Created by the client calling the `login` endpoint. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_challenge` is optional when using a private client id for the token request. Minimum length: 43. Maximum length: 128. Example: `krc5G3_5lRUcXDUzFZQ88oJA_-ZmlHWkyGsgOrSLEWg`. Additional properties: `any`. Additional Property Support This type supports additional properties passed along with the defined properties of this API. To indicate that the properties were defined and expected to be handled as additional properties, they are expected to be prefixed with a `c_`. The type will reject any property that does not fit this pattern, only allowing additional properties beginning with the known prefix. Example: `c_trackingId`. ### Oauth2ErrorResponse * `error` (_string_, required) Example: `invalid_client`. * `error_uri` (_string_) Example: `https://api.commercecloud.salesforce.com/documentation/error/v1/errors/oauth-service`. * `error_description` (_string_) Example: `Missing access token or refresh token.`. ### PasswordlessLoginRequest A request for a passwordless login token. This is only available for registered users using B2C Commerce. * `user_id` (_string_, required) User ID for logging in. Maximum length: 128. Example: `samantha.sampleson@example.com`. * `mode` (_string_, required) Password Action delivery modes Allowed values: `callback`, `sms`, `email`. Example: `email`. * `locale` (_string_) The locale of the template. Required when the mode is `email` or `sms`. Example: `en-us`. * `usid` (_string_) The shopper's unique identifier, if known. If not provided, a new USID is generated. Example: `18cda486-fe32-4e27-888b-6e4f89938e67`. * `channel_id` (_string_, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. * `callback_uri` (_string_) The callback URI. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback\_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback\_url. Example: `http://localhost:9050/passwordless/login/callback`. * `last_name` (_string_) The user's last name. Required when `register_customer` is `true`. The `last_name` parameter is not used when `register_customer` parameter is not added or is `false`. Maximum length: 100. Example: `Sampleson`. * `email` (_string_) The user's email address. Required when `register_customer` is `true` and `user_id` is not an email address. The `email` parameter is not used when `register_customer` parameter is not added or is `false`. Maximum length: 128. Example: `samantha.sampleson@example.com`. * `first_name` (_string_) The user's first name. Optional when `register_customer` is `true`. The `first_name` parameter is not used when `register_customer` parameter is not added or is `false`. Maximum length: 100. Example: `Samantha`. * `phone_number` (_string_) The user's phone number. Optional when `register_customer` is `true`. The `phone_number` parameter is not used when `register_customer` parameter is not added or is `false`. Maximum length: 48. Example: `17776665555`. * `customer_no` (_string_) The customer number assigned to the shopper profile when `register_customer` is set to `true`. If the `customer_no` already exists, the request fails. The `customer_no` parameter is optional and only used when `register_customer` is set to `true`. Maximum length: 100. Example: `123456789`. ### TokenResponse * `access_token` (_string_, required) Short term shopper JWT that can be used to access Shopper APIs. Valid for 30 minutes. A trusted agent shopper JWT is valid for 15 min. Example: `eyJ2ZXIiOiIxLjAiLCJraWQiOiJTTEFTIiwidHlwIjoiand0IiwiY2x2IjoiSjIuMS4wIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJjb3JlL2Rldi9idGluZ2V5bHRtMiIsImF1dCI6IkdVSUQiLCJzdWIiOiJ1c2lkOjo1NGFkMmM1YS05MWYwLTQ0YWItODE3Yy03M2Q2Yjg2ODcyZDk6OnVwbjpndWVzdCIsIm5iZiI6MTU4Mjg0NTYyNCwiY3R4Ijoic2ZkYy5jb21tZXJjZWNsb3VkIiwiaXNzIjoiY29yZS9kZXYvYnRpbmdleWx0bTIiLCJzdHkiOiJVc2VyIiwiaXN0IjoxLCJleHAiOjE1ODI4NDU3NDQsImlhdCI6MTU4Mjg0NTY1NCwianRpIjoiQzJDOTA0ODg2NDA3MDkwNDg4NjQwNzMyMjExNzQ1ODEyMTQzIn0.2a6lMBSY17PrhDO8pvEk7PCXW_nkguMHi4J-Tuirkz-ETB6rnKyuRjF5yD6B55tMvm8dO8ulAHyDYqjObMxLJg`. * `id_token` (_string_, required) User ID token. Valid for 30 minutes. Example: `eyJraWQiOiI3NGU2YjMxZS1lYTczLTQ3OTYtOWRkYi1jMDJmZGI4ZDgwYmUiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2lkOmQ1MDBhMzY5LTc1MWQtNDkzYy1iNDAzLThmOThmYjg3MTdiNiIsImF1ZCI6IjU1M2FjOGFjLTRkYjktNGVkMy04MjVjLTNhZTNiZjVkMzI3YiIsImlzcyI6ImRldi51cy5zaG9wcGVyLmNjLnNhbGVzZm9yY2UuY29tIiwibmFtZSI6ImJsYWlyLnNsYXMudGVzdEBnbWFpbC5jb20iLCJleHAiOjE1OTExMTE0MzgsImlhdCI6MTU5MTEwOTYzOCwiZW1haWwiOiJibGFpci5zbGFzLnRlc3RAZ21haWwuY29tIn0.KgpAcq-G9Lz7IGnjkJlaFLFXYncVCwcVrRIuy3bEfgzRozqaDRvAori4oOz4RtgYjmoc5x2euoisHL0mVnHgPKOdYBty1wTJqneJEQt6hP4Kp0KFciID_ILCi-DE8VWS5t0NknnMP_iKhIkqcRL48iwPFUWkWA6AEWxE_yvJLNRLithsSxsx7EfBfpD8Hr2b5tMEwImQNmJNYGRTI4LSmcYspBORvJoAnfGpMC0kglxl40bhf5j4ItX4_DiWQC4zaGYD-HJV4BDr6C7iGCs5ZVPypF0yQD3iBio26fwj9Ys5WF9XMtPtqET2kqsz6fDC5GkE6HTUHH_r87jxbDq-8w`. * `refresh_token` (_string_, required) Long term refresh token that can be used to refresh an access token. Valid for 30 days. The refresh\_token will not be returned for trusted agents JWTs. A JWT for trusted agents expires after 15 minutes and is not refreshable. When expired, then app must restart the authorization flow and make another request to the /trusted-agent/authorize endpoint. Example: `EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU`. * `expires_in` (_integer_, required) Remaining access token expiry time, in seconds. Example: `900`. * `refresh_token_expires_in` (_number_, required) Remaining refresh token expiry time, in seconds. Example: `2592000`. * `token_type` (_TokenType_, required) * `usid` (_string_, required) The unique shopper ID. Returned when using the `client_credentials` grant type. Example: `18cda486-fe32-4e27-888b-6e4f89938e67`. * `customer_id` (_string_, required) Customer's ID Example: `1000005`. * `enc_user_id` (_string_, required) MD5 Hashed B2C Commerce user ID in uppercase. Example: `45D39A8499A95288F82855427EBA99B5`. * `idp_access_token` (_string_, required) This is the access token that is returned from the IDP. The IDP access token is returned to be able to make calls into the IDP outside of SLAS. Maximum length: 8192. Example: `eyJraWQiOiJYS21HbHVuSm0zSlBTMHNjQXZXV19XQlYtRi1wMkxLSDR0V05UMHVVSjVJIiwiYWxnIjoiUlMyNTYifQ.eyJ2ZXIiOjEsImp0aSI6IkFULjFMY0xxTWhqM2t0N1FKeFhxQ0VtdGZOOVV2eUcweW1meDFxZG9BdzF1NWMub2FyeXhveHF0QUtxaVFMbkM1ZDYiLCJpc3MiOiJodHRwczovL2Rldi05NTY1MjM2Lm9rdGEuY29tIiwiYXVkIjoiaHR0cHM6Ly9kZXYtOTU2NTIzNi5va3RhLmNvbSIsInN1YiI6Im9rdGEuc2xhcy50ZXN0IiwiaWF0IjoxNjc5Njk4MzA4LCJleHAiOjE2Nzk3MDE5MDgsImNpZCI6IjBvYTJrNXNma0JXZ0poTEVHNWQ2IiwidWlkIjoiMDB1MzhxZGpuU2NMT0IxbXE1ZDYiLCJzY3AiOlsib2ZmbGluZV9hY2Nlc3MiLCJvcGVuaWQiLCJlbWFpbCIsInByb2ZpbGUiXSwiYXV0aF90aW1lIjoxNjc5Njk4MzA2fQ.FDbGsnZGwTYVKGSlAo6jqcjG2HQ_BqQKRk72M5h69DRHyOM4wngsEELN_Wtgj3E77sP7IOmIKjiK5SFP17ADMbKZptVr2pqaMVF3PuU3Cbl_MgXZValfT-z12jHRq9sHMfsdTjY2RnvG44ZDFKc2no8mdL6IJ1MfCaZT5Tql5Ktq_UgudaWFsYqad3ETcmp5Y8ivz1bFnqud0sO9D9JzYOtfd9h71JKcsSC2rXc_Si-INPKKaGl8CDgaLXxu_Am9twJpUenHLpy0BerhcVvdFz7_611E53xOT_Esrc1pe-XAZtlYsJFnhxTBDT342ukiSWk2m6juVappv1GsRfUf2g`. * `idp_refresh_token` (_string_) This is the refresh token that is returned from the IDP. The IDP refresh token is returned to be able to make calls into the IDP outside of SLAS. Maximum length: 128. Example: `EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU`. * `dnt` (_string_) Do not track Maximum length: 5. Example: `true`. ### TokenRequest * `refresh_token` (_string_) The long-term token used to refresh the short term access token. Required only with a grant type of `refresh_token`. Maximum length: 256. * `code` (_string_) Authorization code from the OAuth 2.1 service received in the front channel that is used to get access tokens and refresh tokens. Required with a grant type of `authorization_code` and `session_bridge`. Maximum length: 256. Example: `M0t1K0pyoFKhBpUZnuUYO07xf8iYyMJrAc7h31h_ra8.gglPClJHsofqdTm_yPe5n6m2yCXzFmD8qICwIEjQGVA`. * `usid` (_string_) The shopper's unique identifier, if known. If not provided, a new USID is generated. Example: `54ad2c5a-91f0-44ab-817c-73d6b86872d9`. * `grant_type` (_GrantType_, required) * `redirect_uri` (_string_) The redirect URI that was used when getting the authorization code. A variety of URI formats and wildcards for host are supported, but app links like `airbnb://` or `fb://` are not. Examples of supported URIs: * `http://localhost:3000/callback` * `https://example.com/callback` * `com.example.app:redirect_uri_path` * `*.subdomain.topleveldomain.com` Maximum length: 256. Example: `http://localhost:3000/callback`. * `code_verifier` (_string_) PKCE code verifier. Created by the client calling the `login` endpoint. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_verifier` is optional when using a private client id for the token request. Maximum length: 128. * `client_id` (_string_) The SLAS client ID. Required when the grant type is `authorization_code_pkce`. Maximum length: 40. Example: `z99ec276-cg53-4g94-cf72-76f300c6778zc`. * `channel_id` (_string_) The channel (B2C Commerce site) that the user is associated with. \*\*Important: We strongly recommended using the channel\_id query parameter because it will be required in the future. **NOTE - As of July 31, 2024**, SLAS will be requiring the `channel_id` query parameter in token requests. Maximum length: 100. Example: `RefArch`. * `dnt` (_string_) This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `false`. Example: `true`. ### SessionBridgeTokenRequest * `code` (_string_, required) Authorization code returned from session bridge authorization received in the front channel that is used to get session bridge access tokens and refresh tokens. Required with a grant type of `session_bridge`. The SLAS client must have the `sfcc.session_bridge` scope to request a session bridge token. Maximum length: 256. Example: `M0t1K0pyoFKhBpUZnuUYO07xf8iYyMJrAc7h31h_ra8.gglPClJHsofqdTm_yPe5n6m2yCXzFmD8qICwIEjQGVA`. * `client_id` (_string_, required) The SLAS public client ID for use with PKCE requests. This is a required parameter when using a public client. Maximum length: 40. Example: `6c388ebd-6843-4863-aef9-781382c9e8cd`. * `channel_id` (_string_, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. * `code_verifier` (_string_, required) PKCE code verifier. Created by the caller. This is a required parameter when using a public client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Example: `Ar0lAwU_jsuA~ZXX8-JnMbZFxrnDot2OtgLEi1kOT_FxD6Bo0EQDbbrvoym9xHvatNGnNzrObLJeK6e4U9m4pveRMbdwNGa4jwiAlKGvijVn0PW0hqb03_w1gQE00wTo`. * `dwsid` (_string_, required) Cookie passed back from the '/authorize' endpoint call for session bridge. This parameter is optional and not needed if using the `dwsgst` parameter. **DEPRECATED** - As of January 31, 2024, SLAS will no longer support the SESB `dwsid` parameter for `guest` users for `session-bridge/token` calls. It is recommended to transition over to using a SESB `dwsgst` token. The `dwsid` will still be needed for `registered` user session-bridge/token calls. Example: `pATvWUO3KSdt-Kmcy-8-RsxKnoO4BMDwoec7ACVlW6tZNnhaOL7gt7mHqL-h7QYn5TyE61z0DeSMCqxngsWeHw==`. * `grant_type` (_string_, required) Grant Type Allowed values: `authorization_code`, `refresh_token`, `client_credentials`, `authorization_code_pkce`, `session_bridge`. * `login_id` (_string_, required) The ID of the shopper for session bridge access. If requesting a token for a guest user set login\_id to `guest`. Maximum length: 128. Example: `jack.shopper@example.com`. * `dwsgst` (_string_) Signed guest Json Web Token (JWT) that was obtained from B2C Commerce. This parameter is optional and not needed if using the guest `dwsid` parameter. Example: `eyJraWQiOiIxNjgxNTU5OTkxNzkwIiwiYWxnIjoiRVMyNTYifQ.eyJ0ZW5hbnRJZCI6IkJHVk5fUzA1IiwiZHdzaWQiOiJuWHRhckdNU2ZxbnBaSUNJUGFKTHJSWGZ6b2lWYXBBU3BBTFNfeFdUMV9QZjRBWDA0N1lMQ1dSUFByM1BiSEl4d2RaODFiVGZoM3M1Wlgza2NhOG0zZz09IiwiY3VzdG9tZXJJZCI6ImJjQXI5N2NuMm1ZdmhjMGhqTGsxYmFXSzRqIiwiaWF0IjoxNjg1MTI4NjM2LCJleHAiOjE2ODUxMjkyMzksImlzcyI6ImNvbW1lcmNlY2xvdWQvcHJvZHVjdGlvbi9iZ3ZuczA1IiwidmVycyI6IjEiLCJ0eXBlIjoiRyJ9.BGY4kyOXbQSzZxubE3BrSzhf8ByehGUfJa7_J2XRQ93xY4dAOhF_xbXcHmBaEUBUzSny-Cf0pATzEaSsKpTxkg`. * `dwsrst` (_string_) Signed registered customer Json Web Token (JWT) that was obtained from B2C Commerce. This parameter is optional and not needed if using the registered user `dwsid` parameter. **NOTE:** The registered customer Json Web Token (JWT) will be available in ECOM versions 25.4 and higher. Example: `eyJraWQiOiIxNjMwOTM5MzAyODE0IiwiYWxnIjoiRVMyNTYifQ.eyJmbmFtZSI6Ikx1a2UiLCJkd3NpZCI6IkdkWWpSQjViZGVpU0xkb3Ixdy15QzRTZ1l3dDJHYl9Ec255OG5nZ2I3c0VDajVMWndnT0ZJWTZsa21sNlVRMXZoazl1SDVJUGxMek5rZTJhNTV2YU9nPT0iLCJ2ZXJzIjoiMiIsImlzcyI6InNsYXMvZGV2L2Jndm5fc3RnIiwidHlwZSI6IlIiLCJsbmFtZSI6IlNreXdhbGtlciIsInJjdXN0b21lcklkIjoiOGgzNHh6dDQxOTVpOHA1MmE2ejAzczIxNDgiLCJwaG9uZSI6bnVsbCwidGVuYW50SWQiOiJiZ3ZuX3N0ZyIsImN1c3RvbWVySWQiOiI0OHB1eXA4dTdmMmM5NHgzMTUxeDA4bGEweiIsImV4cCI6MTczNTE1NDQ4NiwiaWF0IjoxNzMyNTYyNDg2LCJlbWFpbCI6Imx1a2Uuc2t5d2Fsa2VyQG5hYm9vLm9yZyJ9.Q2nF0wuEl1X7aVZ-ycCwxDjjmq5toJred5AEDqKXXjj89BY_0HIQoAEMbx9UDqOmhjdBkxN4idVzYVoXcl0c2A`. * `usid` (_string_) The unique shopper ID. Returned when from session bridge authorization. Example: `18cda486-fe32-4e27-888b-6e4f89938e67`. * `dnt` (_string_) This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `false`. Example: `true`. ### TrustedSystemTokenRequest A request for an access token on behalf of a registered user whose credentials are stored using a third party system. * `usid` (_string_) The shopper's unique identifier, if known. If not provided, a new USID is generated. Example: `54ad2c5a-91f0-44ab-817c-73d6b86872d9`. * `grant_type` (_string_, required) Grant Type Allowed values: `authorization_code`, `refresh_token`, `client_credentials`, `authorization_code_pkce`, `session_bridge`. * `hint` (_string_, required) Type of system used for Trusted System On Behalf of requests. Allowed values: `ts_ext_on_behalf_of`. * `login_id` (_string_, required) The ID used by the shopper for trusted system access. If set to `guest`, a token is returned for a guest user. Maximum length: 128. Example: `samantha.sampleson@example.com`. * `idp_origin` (_string_, required) IDPs that work with SLAS. Use `ecom` when using B2C Commerce is the identity provider. Allowed values: `apple`, `auth0`, `azure`, `azure_adb2c`, `cognito`, `default`, `ecom`, `facebook`, `forgerock`, `gigya`, `gigya_socialize`, `google`, `okta`, `ping`, `salesforce`. * `client_id` (_string_, required) The SLAS public client ID for use with trusted-system requests. Maximum length: 40. Example: `6c388ebd-6843-4863-aef9-781382c9e8cd`. * `channel_id` (_string_, required) The channel (ECOM site) that the user is associated with. Maximum length: 100. Example: `RefArch`. * `email_id` (_string_) The email address for the shopper that is used for trusted-system requests. If not provided, `login_id` is used instead. Maximum length: 128. Example: `samantha.sampleson@example.com`. * `dnt` (_string_) This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `false`. Note: The default value for `dnt` is set to `false` for SLAS token requests except for Trusted Agent token request. For Trusted Agent token requests the default value for `dnt` is `true`. Example: `true`. ### TrustedAgentTokenRequest * `agent_id` (_string_) The ID of the merchant. If passed in, the `agent_id` will be validated using the SUB claim in the response from Account Manager. This is an optional parameter unless the request is for a Trusted Agent on Behalf then `agent_id` is required. Maximum length: 40. Example: `merchant@example.com`. * `client_id` (_string_, required) The SLAS public client ID or SLAS private client ID for use with trusted-system requests. The `client_id` is not needed if a using a SLAS private `client_id` and the `_sfdc_client_auth` header. Maximum length: 40. Example: `6c388ebd-6843-4863-aef9-781382c9e8cd`. * `channel_id` (_string_, required) The channel (B2C Commerce site) that the user is associated with. Maximum length: 100. Example: `RefArch`. * `code_verifier` (_string_, required) PKCE code verifier. Created by the caller. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. The `code_verifier` is not needed if a using a SLAS private `client_id` and the `_sfdc_client_auth` header. Example: `Ar0lAwU_jsuA~ZXX8-JnMbZFxrnDot2OtgLEi1kOT_FxD6Bo0EQDbbrvoym9xHvatNGnNzrObLJeK6e4U9m4pveRMbdwNGa4jwiAlKGvijVn0PW0hqb03_w1gQE00wTo`. * `grant_type` (_string_, required) Grant Type Allowed values: `authorization_code`, `refresh_token`, `client_credentials`, `authorization_code_pkce`, `session_bridge`. * `login_id` (_string_, required) The ID is the shopper for trusted agent access. For TAOB Guest the `login_id` must be set to `Guest`. Maximum length: 128. Example: `jack.shopper@example.com`. * `idp_origin` (_string_, required) The IDP that the user is associated with. For TAOB Guest the `idp_origin` parameter should be `slas`. If set to any other IDP origin a 400 Bad Request will be returned. Maximum length: 16. Example: `ecom`. * `usid` (_string_) The shopper's unique identifier, if known. If not provided, a new USID is generated. Example: `54ad2c5a-91f0-44ab-817c-73d6b86872d9`. * `dnt` (_string_) This is an optional parameter to set `Do Not Track` for the session. SLAS is making this available, but will not be used by B2C Commerce until after the 24.4 release. Values are: * `false` * `true` If not added the `dnt` value will default to `true` Note: The default value for `dnt` is set to `true` for all TAOB flows. This is opposite from other SLAS token requests. Example: `true`. * `state` (_string_) This is an optional parameter to set state for the trusted agent session. If the `state` parameter is used it will be validated and a 400 Bad Request will be returned if missing or invalid. For TAOB Guest you must pass the `state` parameter to transfer the state from the TAOB Guest authorization call to the token call. The `state` parameter value is returned with the authorization code in the response url from the TAOB guest authorization call, for example: `.../taob/callback?code=HETXpvg5LKBNIHjDTWkRrf2MLVU&state=taob.gst.7bc7fb7f-e646-44fd-bc73-dfd5c3c9019b`. You would use `taob.gst.7bc7fb7f-e646-44fd-bc73-dfd5c3c9019b` for the `state` value in the TAOB request. Example: `taobgst.3ebdcbb6-ef87-4f41-8173-67728636e513`. ### PasswordActionRequest A request for a password reset token. This is only available for resgistered users using B2C Commerce. * `user_id` (_string_, required) User ID for logging in. This is the id that is used to log into SFCC. Maximum length: 128. Example: `samantha.sampleson@example.com`. * `mode` (_string_, required) Password Action delivery modes Allowed values: `callback`, `sms`, `email`. Example: `email`. * `channel_id` (_string_, required) The channel (B2C Commerce site) that the user is associated with. Example: `RefArch`. * `locale` (_string_) The locale of the template. Required when the mode is `email` or `sms`. Example: `en-us`. * `client_id` (_string_) -| The public client ID. Requires setting `grant_type` to `passwordless_login_pkce`. When using the `hint` query parameter either a public or private client ID can be used. Maximum length: 40. Example: `6b200ebd-7843-4073-aef9-792482c9e1de`. * `code_challenge` (_string_) PKCE code challenge. Created by the client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Requires setting `grant_type` to `passwordless_login_pkce` Minimum length: 43. Maximum length: 128. Example: `Nx_Vf0-0W6SpyRVBVTbl8VSu2OE4yD2fZNExW6N3V_Q`. * `callback_uri` (_string_) The callback uri. Required when the mode is `callback`. The `callback_uri` property will be validated against the callback URIs that have been registered with the SLAS client. The callback URI _must_ be a `POST` endpoint because the token will be included in the body. Wildcards are not allowed in the callback\_uri because this is a security risk that can expose the token. This is not considered an OAuth2 callback\_url. Example: `http://localhost:9050/password/reset/callback`. * `idp_name` (_string_) The name of the 3rd party identity provider for the user ID Example: `okta`. * `hint` (_string_) Adding a `hint` query parameter with a value of `cross_device` will remove the need to have the code\_challenge for password reset request. If the `hint` query parameter is used it must also be used in the password reset request. Example: `cross_device`. ### PasswordActionVerifyRequest A request for creating a new password using the password action token. * `client_id` (_string_, required) -| The public client ID. When using the `hint` query parameter either a public or private client ID can be used. Maximum length: 40. Example: `6b200ebd-7843-4073-aef9-792482c9e1de`. * `pwd_action_token` (_string_, required) Password action token that was returned from the `/password/reset` endpoint. Example: `QJO3CA7QTPVCQ3OMROXF2MTDDED3EEC3`. * `code_verifier` (_string_) PKCE code verifier. Created by the client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Example: `Ar0lAwU_jsuA~ZXX8-JnMbZFxrnDot2OtgLEi1kOT_FxD6Bo0EQDbbrvoym9xHvatNGnNzrObLJeK6e4U9m4pveRMbdwNGa4jwiAlKGvijVn0PW0hqb03_w1gQE00wTo`. * `new_password` (_string_) The new password to set for the shopper associated with the password action token. Example: `new_password`. * `channel_id` (_string_, required) The channel that the request is for. For a B2C Commerce request, this is angalous to the site ID. Maximum length: 100. Example: `RefArch`. * `hint` (_string_) Adding a `hint` query parameter with a value of `cross_device` will remove the need to have the code\_verifier for password reset request. If the `hint` query parameter is used it must also have been used in the password action request. Example: `cross_device`. * `user_id` (_string_) User ID for logging in. This is the id that is used to log into SFCC. Required only when hint is provided. Maximum length: 128. Example: `samantha.sampleson@example.com`. ### PasswordLessLoginTokenRequest A request for an access token using a passwordless token. * `grant_type` (_string_, required) Grant Type Allowed values: `authorization_code`, `refresh_token`, `client_credentials`, `authorization_code_pkce`, `session_bridge`. * `hint` (_string_, required) Passwordless hint. Use `pwdless_login`. Example: `pwdless_login`. * `pwdless_login_token` (_string_, required) Passwordless login token that was created from the user ID. Example: `QJO3CA7QTPVCQ3OMROXF2MTDDED3EEC3`. * `client_id` (_string_) The public client ID. Maximum length: 40. Example: `6b200ebd-7843-4073-aef9-792482c9e1de`. * `code_verifier` (_string_) PKCE code verifier. Created by the client. The `code_challenge` is created by SHA256 hashing the `code_verifier` and Base64 encoding the resulting hash. The `code_verifier` should be a high entropy cryptographically random string with a minimum of 43 characters and a maximum of 128 characters. Example: `Ar0lAwU_jsuA~ZXX8-JnMbZFxrnDot2OtgLEi1kOT_FxD6Bo0EQDbbrvoym9xHvatNGnNzrObLJeK6e4U9m4pveRMbdwNGa4jwiAlKGvijVn0PW0hqb03_w1gQE00wTo`. * `login_id` (_string_) The ID used by the shopper for password token request. When provided, login\_id must exactly match the ID used during passwordless login. ex. If passwordless login used `samantha.sampleson@example.com`, but the passwordless login token request provides `sam.sampleson@example.com`, the request fails due to mismatch. Maximum length: 128. Example: `samantha.sampleson@example.com`. ### TokenActionRequest * `token` (_string_, required) Token to inspect or revoke. Example: `EgMYpjfFKdlSy-a3PYeyihmP95IpIp3FaDpPmVH1yu8.lahomBi7zJbRa6yKAuAAiKu3lprTPsEueKwqcBvhRLU`. * `token_type_hint` (_string_) Token Type Hint Allowed values: `access_token`, `refresh_token`. ### RegistrationStartRequest WebAuthn registration request. Inherits most fields from PasswordActionVerifyRequest but does NOT use code\_verifier or new\_password fields. * `client_id` (_string_) OAuth client identifier. Required if Authorization header is not provided. Minimum length: 36. Maximum length: 36. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `12345678-1234-1234-1234-123456789012`. * `pwd_action_token` (_string_, required) Password action token (TOTP) received by the user. The token length is either 6 or 8 digits, configurable in SLAS Admin. Pattern: ^\[0-9\]{6,8}$. Example: `12345678`. * `user_id` (_string_, required) The ID of the user. Maximum length: 128. Example: `user@example.com`. * `channel_id` (_string_, required) The ID of the channel. Maximum length: 100. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `RefArch`. * `display_name` (_string_) Display name for the passkey. Maximum length: 128. Example: `John Doe`. * `nick_name` (_string_) Nickname for the credential. Maximum length: 128. Example: `My iPhone`. ### RegistrationFinishRequest * `client_id` (_string_, required) The ID of the OAuth client. Maximum length: 36. Example: `12345678-1234-1234-1234-123456789012`. * `username` (_string_, required) Username for the credential. Maximum length: 128. Example: `user@example.com`. * `credential` (_PublicKeyCredentialJson_, required) * `channel_id` (_string_, required) The ID of the channel. Maximum length: 128. Example: `RefArch`. * `pwd_action_token` (_string_, required) Password action token. The token length is either 6 or 8 digits, configurable in SLAS Admin. Maximum length: 8. Pattern: ^\[0-9\]{6,8}$. Example: `12345678`. ### AuthenticateRequest * `tenant_id` (_string_) The ID of the tenant. Maximum length: 8. Example: `zzte_053`. * `client_id` (_string_, required) The ID of the OAuth client. Minimum length: 36. Maximum length: 36. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `12345678-1234-1234-1234-123456789012`. * `channel_id` (_string_, required) The ID of the channel. Maximum length: 100. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `RefArch`. * `user_id` (_string_) The ID of the user. Maximum length: 128. Example: `user@example.com`. ### PublicKeyCredentialRequestOptions Options for requesting a WebAuthn credential (returned by authenticate/start). * `challenge` (_string_) Base64url-encoded challenge. Maximum length: 512. Example: `V2FsdGVyIFdoaXRlIFRlc3QgQ2hhbGxlbmdl`. * `timeout` (_integer_) Timeout value in milliseconds. Example: `60000`. * `rpId` (_string_) The ID of the relying party. Maximum length: 256. Example: `example.com`. * `allowCredentials` (_array of PublicKeyCredentialDescriptor_) Allowed credentials for authentication. * `userVerification` (_string_) The level of requirement for user verification. Allowed values: `required`, `preferred`, `discouraged`. Example: `preferred`. * `extensions` (_object_) WebAuthn extensions. ### AuthenticateFinishRequest * `user_id` (_string_) The ID of the user. Maximum length: 128. Example: `user@example.com`. * `channel_id` (_string_, required) The ID of the channel. Maximum length: 100. Example: `RefArch`. * `client_id` (_string_, required) The ID of the OAuth client. Minimum length: 36. Maximum length: 36. Example: `12345678-1234-1234-1234-123456789012`. * `email` (_string (email)_) User's email address. Maximum length: 128. Example: `user@example.com`. * `tenant_id` (_string_) The ID of the tenant. Maximum length: 8. Example: `zzte_053`. * `usid` (_string_) The unique session ID. Maximum length: 128. Example: `87654321-4321-4321-4321-210987654321`. * `credential` (_PublicKeyCredentialJson_, required) ### AuthenticateResult * `credentialId` (_string_) The credential ID that was used for authentication. Maximum length: 1024. Example: `AQIDBAUGBwgJCgsMDQ4PEA`. * `username` (_string_) The authenticated username. Maximum length: 128. Example: `user@example.com`. * `success` (_boolean_) Specifies whether authentication was successful (true) or not (false). Example: `true`. * `tokenResponse` (_TokenResponse_) ### PasskeyUser Represents a passkey user with their associated credentials * `id` (_integer (int32)_) Unique identifier for the passkey user Example: `26`. * `userName` (_string_) The username of the passkey user Maximum length: 128. Example: `user@example.com`. * `displayName` (_string_) The display name of the passkey user Maximum length: 256. Example: `John Doe`. * `userHandle` (_string_) The user handle (WebAuthn user ID) Maximum length: 128. Example: `yRU-7pWyWUE6nw8hztqqUZG635p7UKDDb2lbC1FyF78`. * `slasUserId` (_integer (int32)_) The associated SLAS user ID Example: `10000`. * `credentials` (_array of PasskeyCredential_) Set of passkey credentials associated with this user Unique items. ### OrganizationId An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id). Type: `string`. Pattern: ^f\_ecom\_\[a-z\]{4}\_(prd|stg|dev|s\[0-9\]{2}|\[0-9\]{3})$. Example: `f_ecom_zzxy_prd`. ### OtpRequest A request to generate and deliver a one-time password (OTP) to a shopper. * `client_id` (_string_, required) The ID of the OAuth client. Minimum length: 36. Maximum length: 36. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `12345678-1234-1234-1234-123456789012`. * `channel_id` (_SiteId_, required) * `user_id` (_string_, required) User ID for the shopper requesting the OTP. Maximum length: 128. Example: `shopper123`. * `mode` (_string_, required) Password Action delivery modes Allowed values: `callback`, `sms`, `email`. Example: `email`. * `email` (_string_) Required when `mode` is `email`. Must match a registered email for the shopper. Maximum length: 128. Example: `shopper@example.com`. * `callback_uri` (_string_) Required when `mode` is `callback`. Must match a registered callback URI for the client. The callback URI must be a `POST` endpoint. Wildcards are not allowed. Maximum length: 256. Example: `https://example.com/otp-callback`. * `locale` (_object_) The locale for the OTP delivery template. Defaults to `en-US` for email mode. Includes all fields of `LanguageCountry`. ### OtpVerifyRequest A request to verify a one-time password (OTP) token for a shopper. * `pwd_action_token` (_string_, required) Password action token (TOTP) received by the user. The token length is either 6 or 8 digits, configurable in SLAS Admin. Pattern: ^\[0-9\]{6,8}$. Example: `12345678`. * `client_id` (_string_, required) The ID of the OAuth client. Minimum length: 36. Maximum length: 36. Pattern: ^\[A-Za-z0-9\_-\]+$. Example: `12345678-1234-1234-1234-123456789012`. * `channel_id` (_SiteId_, required) * `user_id` (_string_, required) The user ID of the shopper whose OTP is being verified. Maximum length: 128. Example: `shopper123`. ### ResponseType Response Type Type: `string`. Allowed values: `code`. Example: `code`. ### TokenType Token Type Type: `string`. Allowed values: `Bearer`. Example: `Bearer`. ### GrantType Grant Type Type: `string`. Allowed values: `authorization_code`, `refresh_token`, `client_credentials`, `authorization_code_pkce`, `session_bridge`. Example: `authorization_code`. ### PublicKeyCredentialJson WebAuthn credential representation. The response field can contain either AuthenticatorAttestationResponseJson (for registration) or AuthenticatorAssertionResponseJson (for authentication). * `id` (_string_, required) Base64url-encoded credential ID Maximum length: 256. Example: `AQIDBAUGBwgJCgsMDQ4PEA`. * `rawId` (_string_, required) Base64url-encoded raw credential ID. Maximum length: 256. Example: `AQIDBAUGBwgJCgsMDQ4PEA`. * `type` (_string_, required) The type of credential. Allowed values: `public-key`. Example: `public-key`. * `clientExtensionResults` (_string_, nullable) WebAuthn client extension results (typically empty). Maximum length: 100. _Example_ ``` { "extensions": {} } ``` * `response` (_AuthenticatorAttestationResponseJson | AuthenticatorAssertionResponseJson_, required) Authenticator response (attestation for registration, assertion for authentication) One of: `AuthenticatorAttestationResponseJson`, `AuthenticatorAssertionResponseJson`. ### PublicKeyCredentialDescriptor Public key credential descriptor. * `type` (_string_, required) Credential type. Allowed values: `public-key`. Maximum length: 256. Example: `public-key`. * `id` (_string_, required) The base64url-encoded ID of the credential. Maximum length: 64. Example: `AQIDBAUGBwgJCgsMDQ4PEA`. * `transports` (_array of string_) Authenticator transports. Items: Allowed values: `usb`, `nfc`, `ble`, `internal`. Maximum length: 8. Example: `usb`. _Example_ ``` [ "internal", "usb" ] ``` ### PasskeyCredential Represents a WebAuthn passkey credential * `id` (_integer (int32)_) Unique identifier for the credential Example: `20`. * `userId` (_integer (int32)_) The ID of the user who owns this credential Example: `26`. * `credentialId` (_string_) The WebAuthn credential ID Maximum length: 1024. Example: `SVKfbUGBXofb2JzliJrMtZDENYByWgq_j4-p2M_3wC4`. * `nickName` (_string_) User-friendly name for the credential Maximum length: 32. Example: `Fingerprint`. * `publicKey` (_string_) The public key associated with this credential Maximum length: 1024. Example: `pQECAyYgASFYIHM_4IKLMC8dboiRNfD0E0Gk4LmCTIgEyCTr-9SyHHeIIlggfn5_AzAl67kttLXWb-_Ts6MG7WHKoXzlKtame_wEYPE`. * `userHandle` (_string_) The user handle associated with this credential Maximum length: 128. Example: `yRU-7pWyWUE6nw8hztqqUZG635p7UKDDb2lbC1FyF78`. * `signatureCount` (_string_) The signature counter for replay attack prevention Maximum length: 8. Example: `42`. ### SiteId The identifier of the site that a request is being made in the context of. Attributes might have site specific values, and some objects may only be assigned to specific sites Type: `string`. Minimum length: 1. Maximum length: 32. Example: `RefArch`. ### LanguageCountry A concatenated version of the standard Language and Country codes, combined with a hyphen '`-`'. Type: `string`. Pattern: ^\[a-z\]\[a-z\]-\[A-Z\]\[A-Z\]$. Example: `en-US`. ### AuthenticatorAttestationResponseJson Authenticator response for registration (attestation). * `clientDataJSON` (_array of object_, required) Base64url-encoded client data JSON. * `id` (_string (byte)_) Example: `eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiVjJGc2RHVnlJRmRvYVhSbElGUmxjM1FnUTJoaGJHeGxibWRsIiwib3JpZ2luIjoiaHR0cHM6Ly9leGFtcGxlLmNvbSJ9`. * `attestationObject` (_array of object_, required) Base64url-encoded attestation object. * `id` (_string (byte)_) Example: `o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVikSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFAAAAAK3OAAI1vMYKZIsLJfHwVQMAIAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gpQECAyYgASFYIIGjL8Hs9Yz5LvVGBnGJlGYKbJZXLqLLnKLJKLJLKLJLIlgg`. ### AuthenticatorAssertionResponseJson Authenticator response for authentication (assertion). * `authenticatorData` (_array of object_, required) Base64url-encoded authenticator data * `id` (_string (byte)_) Example: `SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFAAAAAQ`. * `clientDataJSON` (_array of object_, required) Base64url-encoded client data JSON. * `id` (_string (byte)_) Example: `eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiVjJGc2RHVnlJRmRvYVhSbElGUmxjM1FnUTJoaGJHeGxibWRsIiwib3JpZ2luIjoiaHR0cHM6Ly9leGFtcGxlLmNvbSJ9`. * `signature` (_array of object_, required) Base64url-encoded signature. * `id` (_string (byte)_) Example: `MEYCIQDqwzerkQlKKLJKLJKLJKLJKLJKLJKLJKLJKLJKLJKLJAiEA`. * `userHandle` (_array of object_, nullable) Base64url-encoded user handle. * `id` (_string (byte)_) Example: `dXNlckBleGFtcGxlLmNvbQ`.