I have an ExactTarget admin account which I use to create another user, who is an API user (give him all the possible accesses), but get an "User not authorized" error when I try to do a soap API request through this new created user. What am I missing when I am creating the user? Can someone help me defining the set of privileges a newly created api user must be given from the ET UI for doing a data extract api request?

Thanks, Erisa

  • What type of SFMC/ExactTarget account is it? Enterprise 2.0? – Adam Spriggs Feb 13 '15 at 17:05
  • @AdamSpriggs We have different ET clients and most probably they will have different account types. Why is that important? – Erisa Feb 25 '15 at 14:49
  • The permissions needed to utilize the API are different between account types. There are also differences between the API calls depending on the account type (e.g. specifying the ClientID). – Adam Spriggs Feb 25 '15 at 15:31

This isn't going o directly answer the permissions question, however, will explain how to do this in a more secure method.

The original method to interact with SOAP API used a plain text authentication:

      <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
         <o:UsernameToken u:Id="uuid-2517ad18-a6e9-4f38-98a9-184b30a59fb9-1">

This is somewhat insecure, and also takes up a user in your account.

With the newer method, you now can create an app in the Marketing Cloud "App Center" and authenticate against a REST authentication service, providing much better security.

You can read more about the process here - http://code.exacttarget.com/apis-sdks/soap-api/using-app-center-to-get-an-api-key.html

You will most likely just create an API Integration

API Integrations allow you to leverage the Marketing Cloud APIs. Create an API Integration app when you want to use Fuel APIs to automate tasks or integrate business systems. API Integration apps utilize an OAuth2 client credentials flow to acquire access tokens directly from the Fuel authentication service.

You would then use the following SOAP header (adding any required namespaces).

    <fueloauth xmlns="http://exacttarget.com">YOURACCESSTOKEN</fueloauth>

I have a post that explains the entire process in more detail here - http://kellyjandrews.com/using-fuel-oauth2-with-the-soap-api/

  • I am using the old Api (java and Axis 2.0) not the Fuel one. So I am not sure if I can integrate oath authorization, and how to add the access token to my java soap calls. – Erisa Feb 26 '15 at 13:55
  • I would need to see your user permission set. Also, is it Ent 2.0 – Kelly J Andrews Feb 26 '15 at 13:59

In Admin page, check below settings:

  1. in "My Users", click "Edit" for your API user, make sure "API User" is enabled

API Enabled

  1. If it is still not working, check permission for the roles user is assigned to.

For example if this user is assigned to "Administrator" or "Marketing Cloud Administrator". Click "Roles" in Admin page, click "Edit Permission" for one of the roles, and look for "Admin" -> "API Access" -> "Webservice API" option and make sure it is selected. (notice your login may not have access to "Roles" page, in this case you will need to contact SFMC support.)

Role Permission

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.