# OCAPI settings: client IDs, resources and contexts

*B2C Commerce Developer Study Guide · Data Management Using Business Manager Usage · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/b2c-commerce-developer/data-management-using-business-manager-usage/ocapi-settings-client-ids-resources-and-contexts*

How an existing OCAPI integration is authorized: Account Manager client IDs, the Open Commerce API Settings page with its API type and Global or site context, and the JSON document's resource, method, attribute, cache and version settings.

- Certification: Salesforce B2C Commerce Developer
- Exam section: Data Management Using Business Manager Usage
- Study guide: https://www.certifyforce.com/study-guide/b2c-commerce-developer

**Official exam objective:**

> Given a specification and a sandbox instance, configure OCAPI permissions for Data and Shop APIs.

## What the exam expects

- Open the Open Commerce API Settings page and pick the API type (Shop or Data) and the context (Global or one site) a requirement needs.
- Obtain and enable a client ID in Account Manager, and say how a request supplies it and what happens when it is missing or unauthorized.
- Write a client's resource entries: `resource_id` paths and wildcards, `methods`, `read_attributes`, `write_attributes`, `cache_time` and `version_range`.
- Override global permissions for one site, and explain why saved changes take a few minutes to apply.

Key terms: **OCAPI settings** (JSON documents in Business Manager that authorize clients and control caching); **context** (Global for all sites, or a single site); **client ID** (the Account Manager identifier every request must carry); **resource entry** (one `resource_id` with its allowed methods and properties); **property selection syntax** (the `(**)` or `(a,b)` notation for attribute lists).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Settings path | Administration > Site Development > Open Commerce API Settings | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| Default permissions | None; unauthorized requests get HTTP 401 | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| Settings delay | Cached up to three minutes before they take effect | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| Data API context | Most resources support only global permissions | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| Missing client ID | HTTP 400 (Bad Request) | [OCAPI Client Application Identification](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/clientapplicationidentification.html) |
| Client ID precedence | Bearer token, then request parameter, then header | [OCAPI Client Application Identification](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/clientapplicationidentification.html) |
| `cache_time` | Default 60 s, range 0-86,400 s | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| `/products/**` | Grants all subresources | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| `_v` | Config file structure version, not the OCAPI version | [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html) |
| Data API resources | Coupons, customer lists, slot configurations, content | [Get Started With OCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.html) |
| OCAPI status | Deprecated as of April 2026, maintenance-only; migrate to SCAPI | [Why Use SCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/why-use-scapi.html) |

## Check yourself

- When a request carries both a client_id parameter and an x-dw-client-id header, which one is used?
- Why can a client ID still be accepted for a while after it is disabled in Account Manager?
- Which custom response headers can a client's settings add?
- Why would a /products/*/prices response omit the prices property entirely?

## Sources

- [OCAPI Settings](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/ocapisettings.html)
- [OCAPI Client Application Identification](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/clientapplicationidentification.html)
- [Get Started With OCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-commerce-ocapi/get-started-with-ocapi.html)
- [Why Use SCAPI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/why-use-scapi.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the B2C Commerce Developer pack (USD $19): https://www.certifyforce.com/practice-exams