Skip to content

Commit 9e3cf14

Browse files
amit-kumar8-sfamit-kumar8-sf
authored
@W-21097674: Adding support for AM API Client (#109)
1 parent a8ebec8 commit 9e3cf14

27 files changed

Lines changed: 4603 additions & 23 deletions

‎docs/api-readme.md‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ const { data, error } = await instance.ocapi.PATCH('/code_versions/{code_version
243243

244244
## Account Manager Operations
245245

246-
The SDK provides a unified client for managing users, roles, and organizations through the Account Manager API.
246+
The SDK provides a unified client for managing users, roles, organizations, and API clients through the Account Manager API.
247247

248248
### Authentication
249249

@@ -253,7 +253,7 @@ For CI/CD and automation, you can also use **OAuth client credentials flow** (re
253253

254254
### Unified Client (Recommended)
255255

256-
The recommended approach is to use the unified `createAccountManagerClient` which provides access to all Account Manager APIs (users, roles, and organizations):
256+
The recommended approach is to use the unified `createAccountManagerClient`, which provides access to all Account Manager APIs (users, roles, organizations, and API clients):
257257

258258
```typescript
259259
import { createAccountManagerClient } from '@salesforce/b2c-tooling-sdk/clients';
@@ -296,6 +296,19 @@ const orgs = await client.listOrgs({ size: 25, page: 0 });
296296
const org = await client.getOrg('org-id');
297297
const orgByName = await client.getOrgByName('My Organization');
298298
const auditLogs = await client.getOrgAuditLogs('org-id');
299+
300+
// API Clients API (service accounts for programmatic access)
301+
const apiClients = await client.listApiClients({ size: 20, page: 0 });
302+
const apiClient = await client.getApiClient('api-client-uuid', ['organizations', 'roles']);
303+
await client.createApiClient({
304+
name: 'my-client',
305+
organizations: ['org-id'],
306+
password: 'SecureP@ss12',
307+
active: false,
308+
});
309+
await client.updateApiClient('api-client-uuid', { name: 'new-name', active: true });
310+
await client.changeApiClientPassword('api-client-uuid', 'oldPassword', 'newPassword12');
311+
await client.deleteApiClient('api-client-uuid'); // Client must be disabled 7+ days first
299312
```
300313

301314
### Client Credentials Flow (Alternative)
@@ -329,6 +342,7 @@ import {
329342
createAccountManagerUsersClient,
330343
createAccountManagerRolesClient,
331344
createAccountManagerOrgsClient,
345+
createAccountManagerApiClientsClient,
332346
} from '@salesforce/b2c-tooling-sdk/clients';
333347
import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk/auth';
334348

@@ -353,6 +367,12 @@ const orgsClient = createAccountManagerOrgsClient(
353367
{ accountManagerHost: 'account.demandware.com' },
354368
auth,
355369
);
370+
371+
// API Clients client (service accounts)
372+
const apiClientsClient = createAccountManagerApiClientsClient(
373+
{ accountManagerHost: 'account.demandware.com' },
374+
auth,
375+
);
356376
```
357377

358378
### User Operations
@@ -446,6 +466,41 @@ const allOrgs = await client.listOrgs({ all: true });
446466
const auditLogs = await client.getOrgAuditLogs('org-123');
447467
```
448468

469+
### API Client Operations
470+
471+
Manage Account Manager API clients (service accounts for programmatic access). API clients are created inactive by default and must be disabled for at least 7 days before deletion.
472+
473+
```typescript
474+
import { createAccountManagerClient } from '@salesforce/b2c-tooling-sdk/clients';
475+
import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk/auth';
476+
477+
const auth = new ImplicitOAuthStrategy({ clientId: 'your-client-id' });
478+
const client = createAccountManagerClient({}, auth);
479+
480+
// List API clients with pagination
481+
const result = await client.listApiClients({ size: 20, page: 0 });
482+
483+
// Get API client by ID (optionally expand organizations and roles)
484+
const apiClient = await client.getApiClient('api-client-uuid', ['organizations', 'roles']);
485+
486+
// Create a new API client (created inactive by default)
487+
const newClient = await client.createApiClient({
488+
name: 'my-client',
489+
organizations: ['org-id'],
490+
password: 'SecureP@ss12',
491+
active: false,
492+
});
493+
494+
// Update an API client (only provided fields are updated)
495+
await client.updateApiClient('api-client-uuid', { name: 'new-name', active: true });
496+
497+
// Change API client password
498+
await client.changeApiClientPassword('api-client-uuid', 'oldPassword', 'newPassword12');
499+
500+
// Delete an API client (must have been disabled for at least 7 days)
501+
await client.deleteApiClient('api-client-uuid');
502+
```
503+
449504
### Required Permissions
450505

451506
Account Manager operations require:

‎docs/cli/account-manager.md‎

Lines changed: 266 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
2-
description: Commands for managing Account Manager resources including users, roles, and organizations.
2+
description: Commands for managing Account Manager resources including users, roles, organizations, and API clients.
33
---
44

55
# Account Manager Commands
66

7-
Commands for managing Account Manager resources including users, roles, role assignments, and organizations.
7+
Commands for managing Account Manager resources including users, roles, role assignments, organizations, and API clients.
88

99
## Global Flags
1010

@@ -792,3 +792,267 @@ Displays a table of audit log records with the selected columns. Timestamps are
792792
- If organization is not found, an error is returned
793793
- If no audit records are found, a message is displayed
794794
- Timestamps are displayed in a human-readable format with zero-padding for consistent spacing
795+
796+
---
797+
798+
## API Client Management
799+
800+
Commands for managing Account Manager API clients (service accounts for programmatic access). API clients can be assigned roles and organizations, support client credentials or JWT authentication, and are created inactive by default. They must be disabled for at least 7 days before they can be deleted.
801+
802+
### b2c am clients list
803+
804+
List Account Manager API clients with pagination.
805+
806+
#### Usage
807+
808+
```bash
809+
b2c am clients list [FLAGS]
810+
```
811+
812+
#### Flags
813+
814+
| Flag | Description | Default |
815+
|------|-------------|---------|
816+
| `--page` | Page number (0-based) | `0` |
817+
| `--size`, `-s` | Number of results per page (1-4000) | `20` |
818+
| `--columns`, `-c` | Comma-separated list of columns to display | Default columns |
819+
| `--extended`, `-x` | Show all available columns | `false` |
820+
| `--json` | Output results as JSON | `false` |
821+
822+
#### Default Columns
823+
824+
- ID
825+
- Name
826+
- Description
827+
- Active
828+
- Auth Method
829+
- Created
830+
831+
#### Extended Columns
832+
833+
- Last Auth
834+
- Disabled
835+
836+
#### Examples
837+
838+
```bash
839+
b2c am clients list
840+
b2c am clients list --size 50 --page 1
841+
b2c am clients list --extended --json
842+
```
843+
844+
#### Notes
845+
846+
- Created and Disabled dates are formatted as `MM/DD/YYYY HH:MM:SS` with zero-padding for equal column width (e.g. `09/10/2020 14:30:00`)
847+
- Page size must be between 1 and 4000
848+
- Page number must be a non-negative integer (0-based)
849+
850+
---
851+
852+
### b2c am clients get
853+
854+
Get details of a single Account Manager API client by ID.
855+
856+
#### Usage
857+
858+
```bash
859+
b2c am clients get <API-CLIENT-ID> [FLAGS]
860+
```
861+
862+
#### Arguments
863+
864+
| Argument | Description | Required |
865+
|----------|-------------|----------|
866+
| `API-CLIENT-ID` | API client UUID | Yes |
867+
868+
#### Flags
869+
870+
| Flag | Description |
871+
|------|-------------|
872+
| `--expand` | Comma-separated fields to expand. Valid values: `organizations`, `roles` |
873+
| `--json` | Output results as JSON |
874+
875+
#### Examples
876+
877+
```bash
878+
b2c am clients get <api-client-id>
879+
b2c am clients get <api-client-id> --expand organizations,roles --json
880+
```
881+
882+
#### Output
883+
884+
When not using `--json`, displays formatted API client information including:
885+
886+
- **API Client Details**: ID, Name, Description, Active, Auth Method, Password Modified, Created, Disabled
887+
- **Redirect URLs**: List of allowed redirect URLs (if present)
888+
- **Scopes**: OAuth scopes (if present)
889+
- **Default Scopes**: Default OAuth scopes (if present)
890+
- **Organizations**: Organization IDs or full objects (if expanded)
891+
- **Roles**: Role IDs or full objects (if expanded)
892+
- **Role Tenant Filters**: Role-to-tenant mappings (if present)
893+
- **Version Control**: Version control identifiers (if present)
894+
895+
#### Notes
896+
897+
- Invalid `--expand` values return an error listing the valid options (`organizations`, `roles`)
898+
- If the API client is not found, an error is returned
899+
900+
---
901+
902+
### b2c am clients create
903+
904+
Create a new Account Manager API client. Clients are created inactive by default and must be explicitly activated (e.g. via update).
905+
906+
#### Usage
907+
908+
```bash
909+
b2c am clients create [FLAGS]
910+
```
911+
912+
#### Required Flags
913+
914+
| Flag | Description |
915+
|------|-------------|
916+
| `--name`, `-n` | API client name (max 200 characters) |
917+
| `--organizations`, `-o` | Comma-separated organization IDs |
918+
| `--password`, `-p` | Password (12–128 characters) |
919+
920+
#### Optional Flags
921+
922+
| Flag | Description |
923+
|------|-------------|
924+
| `--description`, `-d` | Description (max 256 characters) |
925+
| `--roles`, `-r` | Comma-separated role IDs (e.g. SALESFORCE_COMMERCE_API) |
926+
| `--role-tenant-filter` | Role tenant filter (format: ROLE:realm_instance,realm_instance;ROLE2:... e.g. SALESFORCE_COMMERCE_API:abcd_prd) |
927+
| `--active` | Create as active (default: false) |
928+
| `--redirect-urls` | Comma-separated list of allowed redirect URLs for OAuth flows |
929+
| `--scopes` | Comma-separated OAuth scopes |
930+
| `--default-scopes` | Comma-separated default OAuth scopes |
931+
| `--version-control` | Comma-separated version control system identifiers |
932+
| `--token-endpoint-auth-method` | Token endpoint auth method: `private_key_jwt`, `client_secret_post`, `client_secret_basic`, or `none` |
933+
| `--jwt-public-key` | Public key for JWT authentication (PEM or inline) |
934+
| `--json` | Output results as JSON |
935+
936+
#### Examples
937+
938+
```bash
939+
b2c am clients create --name my-client --organizations org-id-1 --password "SecureP@ss123"
940+
b2c am clients create -n my-client -o org-id-1 -p "SecureP@ss123" -r SALESFORCE_COMMERCE_API
941+
b2c am clients create -n my-client -o org-id-1 -p "SecureP@ss123" --scopes "mail,openid" --default-scopes "mail"
942+
```
943+
944+
#### Notes
945+
946+
- Name must be non-empty and at most 200 characters; description at most 256 characters
947+
- Password must be 12–128 characters
948+
- Role tenant filter must match pattern: `ROLE:realm_instance(,realm_instance)*(;ROLE:...)*` (e.g. SALESFORCE_COMMERCE_API:abcd_prd)
949+
- At least one organization ID is required
950+
951+
---
952+
953+
### b2c am clients update
954+
955+
Update an existing Account Manager API client. Only provided fields are updated; omitted fields keep their current values.
956+
957+
#### Usage
958+
959+
```bash
960+
b2c am clients update <API-CLIENT-ID> [FLAGS]
961+
```
962+
963+
#### Arguments
964+
965+
| Argument | Description | Required |
966+
|----------|-------------|----------|
967+
| `API-CLIENT-ID` | API client UUID | Yes |
968+
969+
#### Flags
970+
971+
| Flag | Description |
972+
|------|-------------|
973+
| `--name`, `-n` | API client name (max 200 characters) |
974+
| `--description`, `-d` | Description (max 256 characters) |
975+
| `--organizations`, `-o` | Comma-separated organization IDs |
976+
| `--roles`, `-r` | Comma-separated role IDs |
977+
| `--role-tenant-filter` | Role tenant filter (format: ROLE:realm_instance,realm_instance;ROLE2:... e.g. SALESFORCE_COMMERCE_API:abcd_prd) |
978+
| `--active` | Set active (true/false) |
979+
| `--redirect-urls` | Comma-separated list of allowed redirect URLs for OAuth flows |
980+
| `--scopes` | Comma-separated OAuth scopes |
981+
| `--default-scopes` | Comma-separated default OAuth scopes |
982+
| `--version-control` | Comma-separated version control system identifiers |
983+
| `--token-endpoint-auth-method` | Token endpoint auth method: `private_key_jwt`, `client_secret_post`, `client_secret_basic`, or `none` |
984+
| `--jwt-public-key` | Public key for JWT authentication (PEM or inline) |
985+
| `--json` | Output results as JSON |
986+
987+
#### Examples
988+
989+
```bash
990+
b2c am clients update <api-client-id> --name new-name
991+
b2c am clients update <api-client-id> --active
992+
b2c am clients update <api-client-id> --scopes "mail,openid" --default-scopes "mail"
993+
```
994+
995+
#### Notes
996+
997+
- At least one flag must be provided
998+
- Name at most 200 characters; description at most 256 characters
999+
- Role tenant filter must match pattern: `ROLE:realm_instance(,realm_instance)*(;ROLE:...)*`
1000+
1001+
---
1002+
1003+
### b2c am clients delete
1004+
1005+
Delete an Account Manager API client. The client must have been disabled for at least 7 days before it can be deleted.
1006+
1007+
#### Usage
1008+
1009+
```bash
1010+
b2c am clients delete <API-CLIENT-ID>
1011+
```
1012+
1013+
#### Arguments
1014+
1015+
| Argument | Description | Required |
1016+
|----------|-------------|----------|
1017+
| `API-CLIENT-ID` | API client UUID | Yes |
1018+
1019+
#### Examples
1020+
1021+
```bash
1022+
b2c am clients delete <api-client-id>
1023+
```
1024+
1025+
---
1026+
1027+
### b2c am clients password
1028+
1029+
Change the password for an Account Manager API client.
1030+
1031+
#### Usage
1032+
1033+
```bash
1034+
b2c am clients password <API-CLIENT-ID> [FLAGS]
1035+
```
1036+
1037+
#### Arguments
1038+
1039+
| Argument | Description | Required |
1040+
|----------|-------------|----------|
1041+
| `API-CLIENT-ID` | API client UUID | Yes |
1042+
1043+
#### Flags
1044+
1045+
| Flag | Description | Required |
1046+
|------|-------------|----------|
1047+
| `--current`, `-c` | Current password | Yes |
1048+
| `--new`, `-n` | New password (12–128 characters) | Yes |
1049+
1050+
#### Examples
1051+
1052+
```bash
1053+
b2c am clients password <api-client-id> --current "OldP@ss" --new "NewP@ss123"
1054+
```
1055+
1056+
#### Notes
1057+
1058+
- New password must be 12–128 characters

‎docs/cli/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,13 @@ These flags are available on all commands that interact with B2C instances:
5555

5656
### Account Management
5757

58-
- [Account Manager Commands](./account-manager) - Manage Account Manager users, roles, and organizations
58+
- [Account Manager Commands](./account-manager) - Manage Account Manager users, roles, organizations, and API clients
5959

6060
All Account Manager commands are under the `am` topic:
6161
- `b2c am users ...` - User management commands
6262
- `b2c am roles ...` - Role management commands
6363
- `b2c am orgs ...` - Organization management commands
64+
- `b2c am clients ...` - API client management (list, get, create, update, delete, password)
6465

6566
### Utilities
6667

0 commit comments

Comments
 (0)