SFMC SOAP API Server-to-Server Integrations

Question

I'm trying to create a QueryDefinition through the SOAP API using a new Server-to-Server Integration. I can successfully generate an access_token through the TENANT_ENDPOINT.auth.marketingcloudapis.com/v2/token endpoint but am unable to use it in any requests.

This is the SOAP envelope being generated

<soapenv:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://exacttarget.com/wsdl/partnerAPI" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <fueloauth> [ACCESS TOKEN FROM AUTH REQUEST] </fueloauth>
  </soapenv:Header>
  <soapenv:Body>
    <tns:CreateRequest>
      <tns:Objects xsi:type="ns1:QueryDefinition" xmlns:ns1="http://exacttarget.com/wsdl/partnerAPI">
        <tns:Name>Sample Query</tns:Name>
        <tns:CustomerKey>SamlpeQueryKey</tns:CustomerKey>
        <tns:QueryText>SELECT * FROM [QueryDefinitionTest]</tns:QueryText>
        <tns:TargetType>DE</tns:TargetType>
        <tns:DataExtensionTarget>
          <tns:CustomerKey>QueryDefinitionTest</tns:CustomerKey>
          <tns:Name>QueryDefinitionTest</tns:Name>
        </tns:DataExtensionDarget>
        <tns:TargetUpdateType>Overwrite</tns:TargetUpdateType>
      </tns:Objects>
    </tns:CreateRequest>
  </soapenv:Body>
</soapenv:Envelope>

This is the error being returned from SFMC

<soap:Fault>
  <faultcode>soap:Client</faultcode>
  <faultstring>User not authorized</faultstring>       
  <faultactor>https://webservice.exacttarget.com/Service.asmx</faultfactor>
  <detail>
    <apifault xmlns="urn:fault.partner.exacttarget.com">
      <Code>11</Code>
      <Message>User not authorized</Message>
    </apifault>
  </detail>
</soap:Fault>

Has something on the SOAP API changed that I haven't found in the docs? I'm not authenticating through a user so the error message doesn't give me an indication as to what is going on.

Answer 1

Same issue is discussed here:

Can I use an OAuth 2.0 token for API Integration in Enhanced Packages in the Soap API fueloauth token header

I also encountered the same problem. SOAP Webservice seems to expect a user-based authentication, but server-to-server integrations cannot be configured to feature one, as the clientId and clientSecret are not connected to a user.

If you change your integration to use the "security header" with username and password instead of YOURTOKEN, SOAP calls in the new API Framework do work. The user whose name & password you enter needs to be an API user.

This is merely a workaround though, not a solution.

Here are the details on the security header: https://developer.salesforce.com/docs/atlas.en-us.noversion.mc-apis.meta/mc-apis/authenticate-soap-api.htm