Overview

The Account service is a YaaS essential service. The Builder uses this service to:

  • Create or delete an organization and edit the related information. The service also enables you to invite YaaS users to your organization and to manage the invitations.
  • Manage join requests that users create for your projects and organizations.
  • Invite YaaS users to projects and manage the invitations you send or receive.
  • Grant roles from one account to another YaaS account of your choice.
This documentation is for the Account service, not the C4C Account service.


API Reference

/accounts

/accounts/{id}

get

Use this endpoint to get information about the user with the specified ID.

Security / Access Control:
To access this method, access token must be issued for the user with the specified ID.

put

Use this endpoint to update the information of the account with the specified ID. The service deletes any fields that have the value set to null or are not included in the request body.

Security / Access Control:
To access this method, access token must be issued for the user with the specified ID.

delete

Delete the account with the specified ID. To delete an account you must remove all of its dependencies first.

Security / Access Control:
To access this method, access token must be issued for the user with the matching ID.

/accounts/rolesTransfer

Use this endpoint to grant source account's roles to an alternate account.

post

Iinitiates the process and sends a security code to the user's email address.

Security / Access Control:
To access this method, access token must be issued for the user initiating the process.

/accounts/rolesTransfer/confirm

post

The user enters the security code. This step finishes process of granting roles to an alternate account. When the process is completed the target account will have the same roles as the source account. No changes will be made to the source account.

/myScopes

/myScopes

get

Returns a list of scopes available for the user in the specified project.
Security / Access Control: To access this method, access token must be issued for a user in the context of a given project. The service returns the data only for the user in the context of the project for which the token is issued.
The user cannot fetch information about his roles in a different project than the project for which the access token is issued.
The user cannot fetch information about other users.

/organizations

Use this endpoint to manage organizations.

/organizations

get

Retrieve information about organizations. Results are filtered by one of the attributes: account, member. You cannot filter organizations by both account and member.

Security / Access Control:
To access this method, an access token must be issued for a user who is a member or an owner of the organization.

post

Creates a new organization.

Security / Access Control:
To access this method, access token must be issued for the user that will be the owner of the new organization.
The MEMBER and OWNER roles are assigned to the account of the user that created the organization by default. The response body contains a link to the newly created organization, as well as the organization ID.

/organizations/{organizationId}

get

Retrieves information about the organization with the specified ID.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

put

Update the organization.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope. This endpoint conforms to PUT semantics: you must submit the entire document in your request. Any missing property is handled as if it's null.

delete

Deletes the organization with the specified ID. To delete an organization, you must remove the projects that were created within this organization.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope to manage this resource.

patch

Performs a partial update on an organization. Allows you to change the value of the organization's public flag, as well as the domain of the organization.

  • When you set the public flag to true, the organization becomes public.

  • When you set the public flag to flase, the organization becomes private.
Security / Access Control: To access this method you need a token issued for organizationId with hybris.org_manage scope.

Recommended content-type is application/merge-patch+json

/organizations/{organizationId}/approvals

put

Marks organization as ready for approval.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope to manage this resource. This endpoint conforms to PUT semantics: you must submit the entire document in your request. Any missing property is handled as if it's null.

/organizations/{organizationId}/invitations

Use this endpoint to manage invitations in an organization.

post

Invites a user to an organization. If the invitation is sent to a user that does not have a YaaS account, he is asked to register first.

Security / Access Control:
To access this method, access token must be issued for the organization and have either of these scopes: hybris.org_manage or hybris.org_member.

get

Returns the list of invitations sent by the organization.

Security / Access Control:
To access this method, access token must be issued for the organization and have the hybris.account_view scope.

/organizations/{organizationId}/invitations/{invitationId}

get

Returns a single invitation sent by an organization.

Security / Access Control:
To access this method, access token must be issued for the organization and have the hybris.account_view scope.

delete

Deletes a single invitation sent by an organization.

Security / Access Control:
To access this method, access token must be issued for the organization and have the hybris.org_manage scope.

put

Resends the invitation e-mail.

Security / Access Control:
To access this method, access token must be issued for the organization and have the hybris.org_manage scope.

/organizations/{organizationId}/projects

get

Retrieve information about projects in the organization with the specified ID. You can filter the results using the member and projectId query parameters. If you use the member query parameter, the service returns only the projects to which the member for whom the token is issued belongs. If you use the projectId query parameter, the service returns only the project with the specified ID to which the specified member belongs.

Security / Access Control:
To access this method, an access token must be issued for the organization to which the searched project belongs. Alternatively, an access token must be issued for the user whose identifier is passed in the member query parameter.

/organizations/{organizationId}/paymentmethods

post

Creates a new payment method for the given organization.

Security / Access Control:
To access this method, access token must be issued for the requested organization and have hybris.org_payment scope.

get

Retrieve the list of all payment methods created for the given organization.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

/organizations/{organizationId}/paymentmethods/{paymentMethodId}

get

Retrieve information about the payment method with the given ID.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

delete

Remove the payment method with the given ID.

Security / Access Control:
To access this method, access token must be issued for the requested organization and have hybris.org_payment scope.

/organizations/{organizationId}/defaultpaymentmethod

get

Retrieves the default payment method set for the given organization.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

post

Sets the selected payment method as default. The organization has to have a payment method already created. All fields of this payment method need to be valid. You chose the payment method by using the id body parameter

Security / Access Control:
To access this method, access token must be issued for the requested organization and have hybris.org_payment scope to manage this resource.

/organizations/{organizationId}/members

This endpoint allows you to manage organization members.
Operations on members are instantaneous. Members do not get any notifications of the changes.

post

Adds a new member to the organization with the specified ID.

Security / Access Control:
To access this method, access token must be issued for organization and have hybris.org_members scope.

get

Returns the full list of members in the organization with the specified ID.

Security / Access Control:
To access this method, access token must be issued for the organization.

/organizations/{organizationId}/members/{userId}

get

Returns the member with the given ID.

Security / Access Control:
To access this method, access token must be issued for the organization.

delete

Removes the member with the specified ID from the organization.

Security / Access Control:
To access this method, access token must be issued for the organization and have hybris.org_members scope.

put

Allows to edit member roles.

Security / Access Control:
To access this method, access token must be issued for organization and have hybris.org_members scope.

/organizations/{organizationId}/roles

get

Retrieve information about all roles for the organization.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

post

Creates a new member role in the context of the organization and service roles. The response body contains an ID of the organization role and a link to it.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope to manage this resource.

/organizations/{organizationId}/roles/{roleId}

Use this endpoint to manage a single role with the specified ID.

get

Retrieve information about the specified role. The response body contains serviceRoles of a chosen role.

Security / Access Control:
To access this method, an access token must be issued for the requested organization.

put

Update a single organization role. This endpoint confirms to PUT semantics. You must provide all parameters in your request.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope.

delete

Delete organization role from the system. The role will be unassigned from accounts.

Security / Access Control:
To access this method, an access token must be issued for the requested organization and have hybris.org_manage scope.

/projects

/projects

get

Retrieve information about all projects. You can filter the results by: account, member. You cannot filter the results using both attributes in the same call.

Security / Access Control:
To access this method, access token must be issued for a user that is a member or the owner of the project.

post

Creates a new project. Roles VIEWER, OWNER PUBLISHER and DEVELOPER are automatically created. The OWNER role is assigned to the creator of the projec by default. Response body contains the project ID and a link to the created Project.

Security / Access Control:
To access this method, access token must be issued for user within an organization that will be the owner of new project and have hybris.org_project_create or hybris.org_project_manage scope. Parameters passed in the body json must be aligned with the parameters from the access token.

/projects/{projectId}

get

Retrieve information about a specific project. Response body contains the project's ID, type and the list of the members of the project.

Security / Access Control:
To access this method, access token must be issued for the requested project and have the hybris.account_manage or hybris.account_view scope. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

put

Update the project.

Security / Access Control:
To access this method, access token must be issued for tenant of requested project and have hybris.account_manage scope to manage this resource. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope. This endpoint conforms to PUT semantics: you must submit the entire document in your request. Any missing property is handled as if it's null.

delete

Delete the specified project. To delete a project, you must remove all dependent clients and applications.

Security / Access Control:
To access this method, access token must be issued for tenant of requested project and have hybris.account_manage scope to manage this resource. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

patch

Allows you to change the value of the public flag of the project with the specified ID.

  • When you set it to true, the project becomes a public project.

  • When you set it to flase, the project becomes a private project.
Security / Access Control: To access this method, access token must be issued for tenant of requested project and have the hybris.account_manage scope. Alternatively, access token must be issued for the organization containing given project and have hybris.org_project_manage scope.

Recommended content-type is application/merge-patch+json.

/projects/{projectId}/invitations

Use this endpoint to manage invitations in a project.

post

Invites a user to a project. If the invitation is sent to a user that does not have a YaaS account, he is asked to register first.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_manage scope. Alternatively the access token must be issued for the project's organization and have hybris.org_project_manage scope.

get

Returns a list of invitations to a project.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_view or hybris.account_manage scope.

/projects/{projectId}/invitations/{invitationId}

get

Returns a single invitation to a project.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_view or hybris.account_manage scope.

delete

Deletes a single invitation to a project.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_manage scope.

put

Resends the invitation e-mail.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_manage scope.

/projects/{projectId}/roles

get

Retrieve information about all user roles available in the project.

Security / Access Control:
To access this method, access token must be issued for the project and have either the hybris.account_view or hybris.account_manage scope. Alternatively, the access token must be issued for the organization that owns the project and have the hybris.org_project_manage scope.

post

Create a new member role in the context of the project and service roles. Response body contains the ID of the project role and the role URL.

Security / Access Control:
To access this method, access token must be issued for project and have the hybris.account_manage scope. Alternatively, the access token must be issued for the organization that owns the project and have the hybris.org_project_manage scope.

/projects/{projectId}/roles/{roleId}

get

Retrieve information about a specific role. Response body contains serviceRoles of a chosen role.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_view or hybris.account_manage scope. Alternatively, the access token must be issued for the the organization that owns the project and have the hybris.org_project_manage scope.

put

Update the project role with the given identifier. This endpoint conforms to PUT semantics - you must pass all of the body parameters to perform a successful update.
Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_manage scope. Alternatively, the access token must be issued for the the organization that owns the project and have the hybris.org_project_manage scope.

delete

Delete a project role. The role you delete is unassigned from all user accounts.

Security / Access Control:
To access this method, access token must be issued for the project and have the hybris.account_manage scope. Alternatively, the access token must be issued for the the organization that owns the project and have the hybris.org_project_manage scope.

/projects/{projectId}/members

This endpoint allows you to manage project members.
Operations on members are instantaneous. Members do not get any notifications of the changes.

post

Adds a new member to the project with the specified ID.

Security / Access Control:
To access this method, access token must be issued for project and have hybris.org_members scope.

get

Retrieve the list of all users assigned to the project. The returned list includes the project roles assigned to each member.

Security / Access Control:
To access this method, access token must be issued for the requested project and have the hybris.account_manage or hybris.account_view scope. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

/projects/{projectId}/members/{userId}

get

Returns the member with the specified ID.

Security / Access Control:
To access this method, access token must be issued for the requested project and have the hybris.account_manage or hybris.account_view scope. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

put

Allows to edit member roles.

Security / Access Control:
To access this method, access token must be issued for the requested project and have the hybris.account_manage or hybris.account_view scope. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

delete

Removes the member with the specified ID from the organization.

Security / Access Control:
To access this method, access token must be issued for the requested project and have the hybris.account_manage or hybris.account_view scope. Alternatively, access token must be issued for the requested organization and have hybris.org_project_manage scope.

/public

/public/organizations

Use this endpoint to manage public organizations.

get

Lists public organizations registered under the domain name specified in the query parameter.

Security / Access Control:
To access this method, access token must be issued for the user. User’s email domain should match the domain specified in the query parameter.

/public/organizations/{organizationId}/joinrequests

Use this endpoint to manage organization join requests.

post

Allows the user to create an organization join request. The domain of the user's email address has to match the public organization's domain.

Security / Access Control:
To access this method, access token must be issued for the user initiating the process.

get

Returns the list of all join requests to the given organization.

Security / Access Control:
To access this method you need a token issued for the organiaztion with hybris.org_manage scope.

/public/organizations/{organizationId}/joinrequests/{joinrequestId}

Use this endpoint to manage a specific join request with joinRequestId.

put

Confirms join request.

Security / Access Control:
To access this method you need a token issued for the organization with hybris.org_manage scope.

delete

Cancels/rejects the join request.

Security / Access Control:
To reject join request you need a token issued for organizationId with hybris.org_manage scope. To cancel join request you need a token issued for the user initiating the process.

get

Returns a single join request.

Security / Access Control:
To access this method you need a token issued for organizationId with hybris.org_manage scope.

/public/organizations/{organizationId}/projects

Use this endpoint to manage projects within a public organization.

get

Lists public projects of the given organization.

Security / Access Control:
To access this method, access token must be issued for the user. User’s email domain should match the domain specified in the query parameter.

/public/organizations/{organizationId}/projects/{projectId}/joinrequests

Use this endpoint to manage join requests to a project in a public organization.

post

Allows user to create project join request. The domain of the user's email address must match the domain of the organization that owns given project.

Security/Access Control:
To access this method, an access token must be issued for the user that initiates the process.

get

Returns the list of of the project's join requests.

Security / Access Control:
To access this method, an access token must be issued for the project and have the hybris.account_manage scope.

/public/organizations/{organizationId}/projects/{projectId}/joinrequests/{joinRequestId}

Manages a single join request with the specified joinRequestId.

put

Confirms join request.

Security/Access Control:
To access this method, an access token must be issued for the project and have the hybris.account_manage scope.

delete

Rejects a join request with the specified joinRequestId.

Security / Access Control:
To access this method, an access token must be issued for the project and have the hybris.account_manage scope.

get

Returns a single join request with the specified joinRequestId.

Security / Access Control:
To access this method, an access token must be issued for the project and have the hybris.account_manage scope.


Grant Roles to an Alternate Account

The Account service allows you to duplicate your project and organization memberships and roles to you different YaaS accounts.
Use this functionality to duplicate the roles and memberships when you create a new user account with the SAP Cloud Platform Identity Authentication Service, or to combine the access and memberships of multiple accounts to a single user account.
This process does not affect the source account in any way. When you complete all of the steps, your old account remains unchanged. You can still access it and use it to work in YaaS.

To grant your roles to another account, follow these steps:

  1. Sign in to the Builder using the account which you want to use as the source of your roles and memberships.
  2. Click the account settings icon on the top navigation bar and go to My Account.
  3. Click Grant Roles to Alternate Account.
  4. In the Your Alternate Email Address field, enter the email address of the account to which you want to grant your roles and memberships. Click NEXT.
  5. Check your email for a security code. Enter that security code in the Security Code field.
  6. Click SUBMIT.
When you grant your roles to an alternate account, keep these two things in mind:
  • You cannot grant roles to an email address that is not registered in YaaS.
  • If you close the window that prompts you to enter the security code, you need to restart the process and use the new security code.


User Roles

User roles are essential for security in YaaS. In the OAuth 2.0 Implicit Grant flow and the Resource Owner Password Credentials Grant flow, the authorization server cross-checks the scopes that you send in requests for access tokens and the scopes attached to user roles. Then, it issues the respective permissions. For more information about the authorization flows available in YaaS, see the Grants section of the OAuth2 service documentation.

When you create an organization or a project, you become their owner and all available scopes are automatically assigned to this role. These scopes come from the YaaS Essentials package. In a project, you can extend the range of available scopes with each package subscription. In addition, you can use scopes that you have in your own services within the project.

A single user in YaaS can have independent roles assigned in an organization, and in a project. For example, Thomas is the Owner of the BigFoot organization. This means he has full access to all data in its projects. At the same time, he is a Viewer in a project named Elbow that belongs to a different organization. This means that he has a read-only access to data in this project. He uses the Builder to switch between the organizations and access the respective data.

The system automatically removes users without at least one role from a project or an organization.

This lists the scopes assigned by the Account service to the pre-defined roles in an organization:

SCOPEOWNERMEMBER
hybris.org_manage 
hybris.org_members 
hybris.org_payment 
hybris.org_project_create 
hybris.org_project_manage 
hybris.org_view

This lists the scopes assigned by the Account service to the pre-defined roles in a project:

SCOPEOWNERVIEWERDEVELOPERPUBLISHER
hybris.account_manage   
hybris.account_view
hybris.api_manage  
hybris.api_view 
hybris.marketplace_submit 
hybris.market_subscriptions_view  
hybris.package_manage  
hybris.package_view  
hybris.package_rateplanview  
hybris.package_rateplanmanage   
hybris.package_publish   
sap.subscription_provider_view   

Use the pre-defined roles when you invite users to your organization or project. You can make your organization or project management more efficient and create custom user roles.

Be careful with the assigned scopes in the role you create. Scopes influence the range of permitted actions for your staff members.


Scopes in Account Service

These scopes are supported by the Account service:

ScopeDescription
hybris.account_manageUse this scope to manage accounts
hybris.account_viewDefault scope with view rights
hybris.org_manageUse this scope to manage organizations
hybris.org_membersUse this scope to manage members within an organization
hybris.org_paymentUse this scope to manage payment methods within an organization
hybris.org_project_createUse this scope to create projects within an organization
hybris.org_project_manageUse this scope to manage projects
hybris.org_viewDefault scope with view rights

For more information about scopes, see the Scopes document in the Overview section.


Glossary

TermDescription
accountUser"s identity represented by email address, which is the account identifier, and a password.
clientAn OAuth2 client as defined in the OAuth 2.0 Authorization Framework. It is created within a project and can interact with services in YaaS.
projectCompany"s planned piece of work. It is required for registering clients and managing their credentials, and package subscriptions. It includes Staff members who have different User roles assigned.
scopesThe access rights to resources and operations in the service, such as hybris.product_manage, which enables you to create and modify products.
serviceSoftware running as a part of a hosted application on a server.
staff membersA group of developers that develop and work with a project or site.
subscriptionA contract granting a user the right to use an API product in a project or site.
user roleSet of permissions defined in the project or site. There are two default roles: OWNER and VIEWER.


  • Send feedback

    If you find any information that is unclear or incorrect, please let us know so that we can improve the Dev Portal content.

  • Get Help

    Use our private help channel. Receive updates over email and contact our specialists directly.

  • hybris Experts

    If you need more information about this topic, visit hybris Experts to post your own question and interact with our community and experts.