Provides instructions for completing the Enable SaaS API Data Loss Prevention for Salesforce Commerce Tenants workflow in Cisco Secure Access. You must have full admin access to the Secure Access dashboard.

Secure Access supports SaaS API DLP protection in Salesforce Commerce deployments for both production and sandbox development for:

Table 1. Scanning cadence and object coverage
Scan Type	Cadence	Object Coverage	Cursor
DLP	Every 7 minutes	product, catalog, category, campaign, gift_certificate	Yes
DLP Discovery	Periodic / on-demand	product, catalog, category, campaign, gift_certificate, promotion, and coupon	No (full poll)

To use this feature you must authorize the tenant using the procedure described below. Once the tenant is authorized, for each item from the list above residing in the tenant, when Secure Access finds data in violation of an enabled SaaS API rule it will enforce the action of that rule.

Before you begin

You must have full admin access to the Secure Access dashboard. See Manage Accounts.
You must have full admin access in a Salesforce Commerce account.

Procedure

Navigate to Admin > Authentication.
Under SaaS API Platforms, click to expand Salesforce Commerce.
In the DLP subsection, click Authorize New Tenant to add a Salesforce Commerce tenant to your Secure Access environment.
In the Salesforce Authorization dialog, check the checkbox to verify you meet the prerequisites, then click Next.
Enter the Tenant Name. Click Next.
Enter values for for following information associated with your Salesforce Commerce Deployment (See Salesforce :
- SCAPI Client
  - Role: Assign the Salesforce Commerce API (realm-scoped) role.
  - Token Auth: Set to client_secret_post.
  - Scopes: Ensure the following scopes are enabled: sfcc.products.rw, sfcc.products, sfcc.catalogs.rw, sfcc.catalogs, sfcc.campaigns.rw, sfcc.campaigns, sfcc.gift-certificates, sfcc.gift-certificates.rw, sfcc.promotions.rw, sfcc.promotions, sfcc.coupons.rw, sfcc.coupons, sfcc.sites, sfcc.customers, sfcc.customers.rw, roles, profile, tenantFilter, sfcc.orders, sfcc.orders.rw, sfcc.preferences, sfcc.consents, sfcc.experiences.
  Find this in the Salesforce Commerce Account Manager under API Client. See Salesforce documentation for more information.
- OCAPI API Client
  - Role: Assign the Sandbox API User (for sandbox) or the equivalent production role defined by your tenant policy.
  - Token Auth: Set to client_secret_post.
  Find this in the Salesforce Commerce Account Manager under API Client. See Salesforce documentation for more information.
  
  Note
  Do not assign the Salesforce Commerce API role to the OCAPI API client. The OCAPI service does not support this role and will reject the configuration.
- OCAPI Settings
  - Apply these settings independently for each of your SFCC instances (production, staging, and sandbox).
  - Use Ant-style resource IDs (e.g., /sites, /libraries/*) to define access.
  - Use the configuration template provided in the reference section below.
  Find this under the Salesforce Commerce Business Manager under Administration > Site Development > Open Commerce API Settings. See Salesforce documentation for more information.
- Short code
  
  Find this under the Salesforce Commerce Business Manager under Administration > Salesforce Commerce API Settings. See Salesforce documentation for more information.
Use the following JSON structure to configure your OCAPI settings within the Business Manager:
```
{
    "_v": "23.2",
    "clients": [
        {
            "client_id": "dad7794b-a60c-440d-b21a-c73874b58387",
            "resources": [
                {
                    "resource_id": "/sites",
                    "methods": ["get"],
                    "read_attributes": "(**)"
                },
                {
                    "resource_id": "/sites/*",
                    "methods": ["get"],
                    "read_attributes": "(**)"
                }
            ]
        }
    ]
}
```
Click Done to complete.
The new tenant will appear on the Authorization page in the list under Salesforce Commerce.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.