OCAPI settings: client IDs, resources and contexts
How an existing OCAPI integration is authorized: Account Manager client IDs, the Open Commerce API Settings page with its API type and Global or site context, and the JSON document's resource, method, attribute, cache and version settings.
Given a specification and a sandbox instance, configure OCAPI permissions for Data and Shop APIs.
~7 min read · 9 practice questions ·
What the exam expects
- Open the Open Commerce API Settings page and pick the API type (Shop or Data) and the context (Global or one site) a requirement needs.
- Obtain and enable a client ID in Account Manager, and say how a request supplies it and what happens when it is missing or unauthorized.
- Write a client's resource entries:
resource_idpaths and wildcards,methods,read_attributes,write_attributes,cache_timeandversion_range. - Override global permissions for one site, and explain why saved changes take a few minutes to apply.
Key terms: OCAPI settings (JSON documents in Business Manager that authorize clients and control caching); context (Global for all sites, or a single site); client ID (the Account Manager identifier every request must carry); resource entry (one resource_id with its allowed methods and properties); property selection syntax (the (**) or (a,b) notation for attribute lists).
Key facts
- Detail
- Administration > Site Development > Open Commerce API Settings
- Detail
- None; unauthorized requests get HTTP 401
- Detail
- Cached up to three minutes before they take effect
- Detail
- Most resources support only global permissions
- Detail
- HTTP 400 (Bad Request)
- Detail
- Bearer token, then request parameter, then header
cache_time- Detail
- Default 60 s, range 0-86,400 s
/products/**- Detail
- Grants all subresources
_v- Detail
- Config file structure version, not the OCAPI version
- Detail
- Coupons, customer lists, slot configurations, content
- Detail
- Deprecated as of April 2026, maintenance-only; migrate to SCAPI
- When a request carries both a client_id parameter and an x-dw-client-id header, which one is used?
- Why can a client ID still be accepted for a while after it is disabled in Account Manager?
- Which custom response headers can a client's settings add?
- Why would a /products/*/prices response omit the prices property entirely?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the B2C Commerce Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 28 lessons of the B2C Commerce Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (9 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both