I'm trying to create a QueryDefinition through the SOAP API using a new Server-to-Server Integration. I can successfully generate an access_token through the TENANT_ENDPOINT.auth.marketingcloudapis.com/v2/token endpoint but am unable to use it in any requests.

This is the SOAP envelope being generated

<soapenv:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tns="http://exacttarget.com/wsdl/partnerAPI" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <fueloauth> [ACCESS TOKEN FROM AUTH REQUEST] </fueloauth>
      <tns:Objects xsi:type="ns1:QueryDefinition" xmlns:ns1="http://exacttarget.com/wsdl/partnerAPI">
        <tns:Name>Sample Query</tns:Name>
        <tns:QueryText>SELECT * FROM [QueryDefinitionTest]</tns:QueryText>

This is the error being returned from SFMC

  <faultstring>User not authorized</faultstring>       
    <apifault xmlns="urn:fault.partner.exacttarget.com">
      <Message>User not authorized</Message>

Has something on the SOAP API changed that I haven't found in the docs? I'm not authenticating through a user so the error message doesn't give me an indication as to what is going on.

  • Did you set the API user checkbox for the user you are using? Commented Feb 28, 2019 at 11:36
  • Are you using the new soap_instance_url when making your soap calls? This authentication will not work with any legacy endpoints. Commented Feb 28, 2019 at 15:17

1 Answer 1


Same issue is discussed here:

Can I use an OAuth 2.0 token for API Integration in Enhanced Packages in the Soap API fueloauth token header

I also encountered the same problem. SOAP Webservice seems to expect a user-based authentication, but server-to-server integrations cannot be configured to feature one, as the clientId and clientSecret are not connected to a user.

If you change your integration to use the "security header" with username and password instead of YOURTOKEN, SOAP calls in the new API Framework do work. The user whose name & password you enter needs to be an API user.

This is merely a workaround though, not a solution.

Here are the details on the security header: https://developer.salesforce.com/docs/atlas.en-us.noversion.mc-apis.meta/mc-apis/authenticate-soap-api.htm

  • ..or you can just use the v1/requestToken endpoint for SOAP and the new v2/token endpoint for REST - no need to utilize user/pass authentication as it is not nearly as efficient or secure as the OAuth tokens. Commented Feb 28, 2019 at 15:12
  • I was hoping that there was something I was missing but it appears I wasn't. Thanks for sharing the workaround. @Gortonington - Wouldn't I need to have 2 Installed Packages in order to use both auth endpoints? Commented Feb 28, 2019 at 21:18
  • 1
    That is correct - but you would need to have an API user created to utilize the User/Pass as well. It is really tom-a-to, to-mah-to. Commented Feb 28, 2019 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .