# OCAPI requests: authentication, methods, caching and state

*B2C Commerce Developer Study Guide · Application Development · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/b2c-commerce-developer/application-development/ocapi-requests-authentication-methods-caching-and-state*

How an existing OCAPI integration picks the Shop or Data API and its authentication, builds valid request URLs, chooses PUT, PATCH, POST or a method override, prevents lost updates with resource states, and keeps Shop API responses cacheable.

- Certification: Salesforce B2C Commerce Developer
- Exam section: Application Development
- Study guide: https://www.certifyforce.com/study-guide/b2c-commerce-developer

**Official exam objective:**

> Given a business requirement, use OCAPI Shop and Data APIs to enable interoperability with an external system.

## What the exam expects

- Choose the Shop API or the Data API for an external system's requirement, and the matching authentication (none for guest browsing, a customer JWT, or an OAuth token).
- Build request URLs: version segment, multiple identifiers, URL-encoded case-sensitive IDs.
- Pick PUT, PATCH or POST, and override the method where PUT is blocked.
- Use `_resource_state` for optimistic locking and `not_exists` for safe creation.
- Keep Shop API responses cacheable and explain what is never cached, when hooks run, and why stateless clients flood controllers with sessions.

Key terms: **Shop API** (interacts as a shop customer or an agent shopping on behalf of one); **Data API** (create, read, update and delete access to system resources); **JWT** (the customer token passed in each Shop API request); **resource state** (a server-side token for one resource's current state); **composite cache entry** (one document plus its expansion documents, cached together).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Client ID | Mandatory for all requests | [Get Started With OCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.html) |
| Data API authentication | OAuth token for the client ID or a Business Manager user | [Get Started With OCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.html) |
| Version segment | Lowercase v, underscore, such as `v24_5` | [OCAPI URL Syntax](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/urlschema.html) |
| Identifiers | URL encoded and case-sensitive | [OCAPI URL Syntax](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/urlschema.html) |
| PUT on staging and production | Blocked; use POST with a method override | [OCAPI HTTP Methods](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/httpmethods.html) |
| Override precedence | `method` parameter beats the header | [OCAPI HTTP Methods](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/httpmethods.html) |
| Resource state mismatch | HTTP 409 | [OCAPI Resource States](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/resourcestates.html) |
| Create-only write | Pass `not_exists` | [OCAPI Resource States](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/resourcestates.html) |
| Shop API `cache_time` | Default 60; 0 to 86,400 seconds | [OCAPI Best Practices](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/bestpractices.html) |
| Composite entry TTL | Shortest TTL of the included documents | [OCAPI Best Practices](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/bestpractices.html) |
| Cache hit | Custom hooks don't run | [OCAPI Best Practices](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/bestpractices.html) |
| OCAPI status | Deprecated as of April 2026; maintenance-only | [Why Use SCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/why-use-scapi.html) |

## Check yourself

- When is the entire OCAPI cache cleared without anyone invalidating it?
- Why can't a team clear only the OCAPI cache?
- What does a PUT return when it creates a resource?
- Which Data API hook runs after `PUT /libraries/{library_id}/content/{content_id}`?

## Sources

- [Get Started With OCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.html)
- [OCAPI HTTP Methods](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/httpmethods.html)
- [OCAPI URL Syntax](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/urlschema.html)
- [OCAPI Resource States](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/resourcestates.html)
- [OCAPI Best Practices](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/bestpractices.html)
- [OCAPI Hooks for Data API](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/hooks-data.html)
- [Site Performance](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-site-performance.html)
- [Why Use SCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/why-use-scapi.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the B2C Commerce Developer pack (USD $19): https://www.certifyforce.com/practice-exams