17.08.2026
16:09
Hi,
The UDA itself as intended in Webcon is a very good initiative. I've compared the same setup on 2026.1.1.45 and 2025.2.1.259 against User Defined API:
- created brand new application account in API Integration admin panel
-> given only App.UserDefAPI.ReadWrite.All scope
- added app accounts to the respective applications access right
-> created test UDA with only API app auth Oauth2 checked
-> the test is about retrieving data source content, so chosen appropriate data sources; when data source was BPS, then checked the "Access to data in the context of the system account"
- using Postman
-> obtained valid token for each environment, with "App.UserDefAPI.ReadWrite.All" specified in token scopes
-> 2025 version result ok, Postmant received JSON with expected data
-> 2026 error with status 403, explanation "Invalid scopes"
For the failing one I've enabled the User auth in BPS Portal and obtained correct result in web browser, so the UDA is defined correctly in the 2026 version.
So:
2025.2.1.259 — OAuth2 App Context, with App.UserDefAPI.ReadWrite.All, same configuration logic as 2026 → works
2026.1.1.45 — same config as 2025, verified from every point (correct scope in the token, webcon app access given, tested with brand new API account) → "Invalid scopes", but the same UDA works via Cookie authentication
