I have an ExactTarget admin account which I use to create another user, who is an API user (give him all the possible accesses), but get an "User not authorized" error when I try to do a soap API request through this new created user. What am I missing when I am creating the user? Can someone help me defining the set of privileges a newly created api user must be given from the ET UI for doing a data extract api request?

Thanks, Erisa

  • What type of SFMC/ExactTarget account is it? Enterprise 2.0? Commented Feb 13, 2015 at 17:05
  • @AdamSpriggs We have different ET clients and most probably they will have different account types. Why is that important?
    – Erisa
    Commented Feb 25, 2015 at 14:49
  • The permissions needed to utilize the API are different between account types. There are also differences between the API calls depending on the account type (e.g. specifying the ClientID). Commented Feb 25, 2015 at 15:31

2 Answers 2


This isn't going o directly answer the permissions question, however, will explain how to do this in a more secure method.

The original method to interact with SOAP API used a plain text authentication:

      <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
         <o:UsernameToken u:Id="uuid-2517ad18-a6e9-4f38-98a9-184b30a59fb9-1">

This is somewhat insecure, and also takes up a user in your account.

With the newer method, you now can create an app in the Marketing Cloud "App Center" and authenticate against a REST authentication service, providing much better security.

You can read more about the process here - http://code.exacttarget.com/apis-sdks/soap-api/using-app-center-to-get-an-api-key.html

You will most likely just create an API Integration

API Integrations allow you to leverage the Marketing Cloud APIs. Create an API Integration app when you want to use Fuel APIs to automate tasks or integrate business systems. API Integration apps utilize an OAuth2 client credentials flow to acquire access tokens directly from the Fuel authentication service.

You would then use the following SOAP header (adding any required namespaces).

    <fueloauth xmlns="http://exacttarget.com">YOURACCESSTOKEN</fueloauth>

I have a post that explains the entire process in more detail here - http://kellyjandrews.com/using-fuel-oauth2-with-the-soap-api/

  • I am using the old Api (java and Axis 2.0) not the Fuel one. So I am not sure if I can integrate oath authorization, and how to add the access token to my java soap calls.
    – Erisa
    Commented Feb 26, 2015 at 13:55
  • I would need to see your user permission set. Also, is it Ent 2.0 Commented Feb 26, 2015 at 13:59

In Admin page, check below settings:

  1. in "My Users", click "Edit" for your API user, make sure "API User" is enabled

API Enabled

  1. If it is still not working, check permission for the roles user is assigned to.

For example if this user is assigned to "Administrator" or "Marketing Cloud Administrator". Click "Roles" in Admin page, click "Edit Permission" for one of the roles, and look for "Admin" -> "API Access" -> "Webservice API" option and make sure it is selected. (notice your login may not have access to "Roles" page, in this case you will need to contact SFMC support.)

Role Permission

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .