CPQ and Digital Commerce Changes for Guest Users

Cart-Based APIs

A subset of the Cart-based APIs has been enhanced to work with guest users following Salesforce best practices. The list of APIs available as part of Spring '20 Minor Release is shown below.

For authenticated users, there are no changes or impact. They can still use record IDs as the input and the APIs will work as before.

For a Guest User, the APIs will only work if the main IDs (Cart ID, Account ID, etc.) are encrypted. If it’s not an encrypted ID then the API will return an error. Also, if the guest user tries to use one of the API not enhanced yet (not in the list below) then he/she will get an error.

The CPQ APIs are also going to return the main IDs (Cart ID, Account ID, etc.) encrypted if it’s a guest user calling it. Notice that only the main IDs that are used as the core input in another CPQ API will be encrypted (for example, Cart ID, Account ID). The secondary IDs (Product ID, Price List ID, etc.) won’t be encrypted as the security is on the main ID required to start any transaction (e.g. Cart ID, Account ID). This will reduce performance impact in the APIs.

Cart APIs with a Guest User

The CPQ API starts with an Account and then the Cart is used to continue the APIs. Below is a simplified example of how to create a Cart securely with the new encrypted IDs.

If your solution is using the encrypted IDs and, for some reason, the user becomes an authenticated user then you will need to create a custom API to convert the encrypted Cart ID into a normal Cart ID (record ID) as the authenticated user calls will require the normal record ID. To do this you can use the encryption classUserSecurity Class Vlocity provides, but use it with extreme care as mentioned previously. An example of how to do this would be an API that gets the encrypted cart ID as input. Then, in the server-side, an API decrypts it and checks if that record ID is linked to the authenticated user account.

Cart-Based API Endpoints

The following URIs allow guest users to use the cart operations.

/carts

Create Cart

POST /carts

/cpq/carts/*

• Get Cart Summary

  GET /cpq/carts/{encrypted_cart_ID}

• Update Cart SummaryCart-Based API Swagger Reference

  PUT /cpq/carts/{encrypted_cart_ID}

/cpq/carts/*/attributes

Get Filterable Attributes

GET /cpq/carts/{encrypted_cart_ID}/attributes

/cpq/carts/*/cancel

• Cancel Order

  POST /cpq/carts/{encrypted_cart_ID}/cancel

• Create Supplemental Order

  POST /cpq/carts/{encrypted_order_ID}/cancel

• Send Updates on CancellationsCart-Based API Swagger Reference

  PUT /cpq/carts/{encrypted_cart_ID}/cancel

• Submit a Cancel Order Request

  POST /v2/cpq/carts/{encrypted_order_ID}/cancel

/cpq/carts/*/items

• Add Items to Cart

  POST /cpq/carts/{encrypted_cart_ID}/items

• Add to Cart

  POST /cpq/carts/{encrypted_cart_ID}/items

• Get Cart Items

  GET /cpq/carts/{encrypted_cart_ID}/items

• Get Line Items by ID

  GET /cpq/carts/{encrypted_cart_ID}/items

• Remove Items from Cart

  DELETE /cpq/carts/{encrypted_cart_ID}/items

• Update Items in Cart

  PUT /cpq/carts/{encrypted_cart_ID}/items

/cpq/carts/*/items/checkout

• Checkout Items in Cart

  POST /cpq/carts/{encrypted_cart_ID}/items/checkout

• Check Status of the Cart

  GET /cpq/carts/{encrypted_cart_ID}/items/checkout

/cpq/carts/*/items/*/itemattributes

Update Item Attributes

PUT /cpq/carts/{encrypted_cart_ID}/items/{itemId}/itemattributes)

/cpq/carts/*/items/*/pricing

• Apply Adjustment

  POST /cpq/carts/{encrypted_cart_ID}/items/{itemId}/pricing

• Applies an Adjustment (Discount, Markup, or Override to a Price)Cart-Based API Swagger Reference

  PUT /cpq/carts/{encrypted_cart_ID}/items/{itemId}/pricing

• Delete Adjustment

  DELETE /cpq/carts/{encrypted_cart_ID}/items/{itemId}/pricing

• Get Price Waterfall for Price

  GET /cpq/carts/{encrypted_cart_ID}/items/{itemId}/pricing

/cpq/carts/*/price

• Price Items in Cart (Query)

  GET /cpq/carts/{encrypted_cart_ID}/price

• Run Pricing for Items to Cart

  POST /cpq/carts/{encrypted_cart_ID}/price

/cpq/carts/*/pricelists

Get Price Lists for Cart

GET /cpq/carts/{encrypted_cart_ID}/pricelists

/cpq/carts/*/products

• Get Details of Product

  GET /cpq/carts/{encrypted_cart_ID}/products/{pricebookEntryId}

• Get List of Products

  GET /cpq/carts/{encrypted_cart_ID}/products

• Get Products by ID

  GET /v2/cpq/carts/{encrypted_cart_ID}/products?{id}&includeAttachment=[true|false]

/cpq/carts/*/promotions

• Add Promotion to Cart

  POST /cpq/carts/{encrypted_cart_ID}/promotions

• Delete Applied Promo Items

  DELETE /cpq/carts/{encrypted_cart_ID}/promotions

• Get Applied or Available Promotions for Cart

  GET /cpq/carts/{encrypted_cart_ID}/promotions

• Get Cart Promotions

  GET /cpq/carts/{encrypted_cart_ID}/promotions

• Post Cart Promotion Items

  POST /cpq/carts/{encrypted_cart_ID}/promotions

/cpq/catalogs/*

Get Catalog Information

GET /cpq/catalogs

Digital Commerce APIs

Most of the CPQ (Cacheable) APIs, also known as Digital Commerce APIs (DC API) are generic and not specific to a customer. They have been designed to also work with guest users as the basket ID and context ID are generic (not Account ID or Cart ID).

But Vlocity enhanced the security of the Create Cart from Basket API and the APIs that use a context key (such as Account ID, Contract ID). Starting in Spring '20 Minor Release, the records related to context IDs are required to be encrypted:

• If it’s a guest user calling the DC API directly into Salesforce (not via AWS DC Tier)

• Any DC API call via the AWS DC Tier (even if the user is an authenticated user in Salesforce)

  This is because the AWS DC Tier calls Salesforce using an integration user and not the calling guest user or authenticated user. This means that we need to have encrypted IDs for all DC API calls via AWS to avoid a user seeing what product another customer has even if it’s a generic basket of products (it may contain sensitive products)

Digital Commerce API Endpoints

The following URIs and their corresponding Digital Commerce APIs allow guest users to use the basket and offer operations. The Create Basket with BasketAction API creates and updates records for guest users.

Digital Commerce APIs that use a context key must encrypt them.

/carts

Create Cart from Basket

POST /carts

/catalogs/*/basket/*

• Create Basket with BasketAction

  POST /catalogs/{catalogcode}/basket

• Get Basket Details API

  GET /catalogs/{catalogcode}/basket/{basketkey}

• Update Basket Contents API

  POST /catalogs/{catalogcode}/basket/{basketkey}

/catalogs/*/offers/*

• Get Offers by Catalog API

  GET /catalogs/{catalogcode}/offers

• Get Offer Details API

  GET /catalogs/{catalogcode}/offers/{offercode}

• Post Offer Details with Configuration API

  POST /catalogs/{catalogcode}/offers/{offercode}

CPQ Custom Interfaces, Implementations and Hooks

The CPQ Engine has several Pricing Variable Calculation Hook and pre/post-processingPre- and Post-Processing Logic for CPQ APIs steps available to extend or overwrite the out-of-the-box implementations. If you have custom implementations then your custom Apex code needs to be checked.

If it is used with the Guest User and accesses records not shared with the Guest User, then you need to update the class to be “Inherited sharing” instead of “with sharing,” This way the Vlocity interface hook can call your custom implementation with the appropriate sharing level. Otherwise, you can update the code even further and perform the check yourself and decide the logic and actions required.