Unable to make Retrieve request using MC SOAP API

Question

I am trying to retrieve all data from a Data Extension using the following postman request

Payload:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <soapenv:Header>
      <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1">
         <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-24440876">
            <wsse:Username>[email protected]</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password123</wsse:Password>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>
   <soapenv:Body>
      <RetrieveRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
         <RetrieveRequest>
            <ObjectType>DataExtensionObject[MYDEKEY]</ObjectType>
            <Properties>subscriberkey</Properties>
         </RetrieveRequest>
      </RetrieveRequestMsg>
   </soapenv:Body>
</soapenv:Envelope>

and the following paylad:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <soapenv:Header>
  <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
     <wsse:UsernameToken>
        <wsse:Username>[email protected]</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password123</wsse:Password>
     </wsse:UsernameToken>
  </wsse:Security>
 </soapenv:Header>
 <soapenv:Body>
 <RetrieveRequestMsg xmlns="https://mcq5ntprmbgb52l70d51pvb1hnjy.soap.marketingcloudapis.com/Service.asmx">
     <RetrieveRequest>
        <ObjectType>DataExtensionObject[MYDEKEY]</ObjectType>
        <Properties>subscriberkey</Properties>
     </RetrieveRequest>
  </RetrieveRequestMsg>
 </soapenv:Body>
</soapenv:Envelope>

I have setup a Web App package in Marketing Cloud to and setup Data Extension Read/Write scopes to allow access.

When making the request I get the following error:

SecurityAn invalid security token was providedhttps://mcq5ntprmbgb52l70d51pvb1hnjy.soap.marketingcloudapis.com/Service.asmx

The username and password provided is the details I use to login to the account so they are definitely correct.

I have tried using token authentication (with another app which has Server-to-Server integration) but this was also unsuccessful.

EDIT: Here is the updated call with token authentication

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <soapenv:Header>
   <fueloauth>tokengoeshes</fueloauth>
 </soapenv:Header>
 <soapenv:Body>
 <RetrieveRequestMsg xmlns="https://mcq5ntprmbgb52l70d51pvb1hnjy.soap.marketingcloudapis.com/Service.asmx">
     <RetrieveRequest>
        <ObjectType>DataExtensionObject[MYDEKEY]</ObjectType>
        <Properties>subscriberkey</Properties>
     </RetrieveRequest>
  </RetrieveRequestMsg>
 </soapenv:Body>
</soapenv:Envelope>

Answer 1

Please try an Installed Package with type "server-to-server" (I understand you have already).

Additionally, I would recommend to use the token instead of username / password in the SOAP envelope. It is more secure due to the token expiry of 20 minutes, and probably circumvents your error entirely.

Get a token: https://developer.salesforce.com/docs/atlas.en-us.mc-app-development.meta/mc-app-development/access-token-s2s.htm

In your scenario it's enough to just limit to payload as follows:

Host: https://YOUR_SUBDOMAIN.auth.marketingcloudapis.com
POST /v2/token
Content-Type: application/json


{
"grant_type": "client_credentials",
"client_id": "yyyyyyyyy",
"client_secret": "xxxxxx"
}

Then you can replace the entire soapenv:header region with this:

    <soapenv:Header>
       <fueloauth>yourToken</fueloauth>
    </soapenv:Header>

Here is a complete request that works in my test:

POST {{soapEndpoint}}/Service.asmx
Content-Type: text/xml
SOAPaction: Retrieve

<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <s:Header>
   <fueloauth>{{accessToken}}</fueloauth>
 </s:Header>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <RetrieveRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
         <RetrieveRequest>
            <ObjectType>DataExtensionObject[201947-DEMO]</ObjectType>
            <Properties>SubscriberKey</Properties>
            <Properties>FirstName</Properties>
            <Properties>Lastname</Properties>
            <Filter xmlns:q1="http://exacttarget.com/wsdl/partnerAPI" xsi:type="q1:SimpleFilterPart">
               <q1:Property>SubscriberKey</q1:Property>
               <q1:SimpleOperator>equals</q1:SimpleOperator>
               <q1:Value>2019431</q1:Value>
            </Filter>
         </RetrieveRequest>
      </RetrieveRequestMsg>
    </s:Body>
</s:Envelope>