Consent and delegation

B2C Helpdesk API

Stores how the helpdesk screens look for a tenant: which filters, columns and search settings agents see, separately for B2C and B2B.

https://{tenant-host}/helpdesk-management/api/v1audience helpdesk-management2 operations

Reviewed, not yet called live: 28 October 2026checked live called on a tenantfrom source read in the service codenot confirmed not confirmed

When to use it

Read the helpdesk's filter, column or search settings for B2C or B2B.
Set those settings from a script, for example to copy them from one tenant to another.

Connect

Base URL: https://{tenant-host}/helpdesk-management/api/v1
Token: POST https://{tenant-host}/oauth/v1/token with grant_type=client_credentials. The client ID and secret go in the form body.checked live
Client to create: Access admin → Web clients → a client with the grant type Client credentials. Not an API client: those are only for Access's own configuration API.checked live
Default audiences: probably helpdesk-management. Not confirmed: no tenant we checked runs the service.not confirmed
Default scopes: Unknown. The reference names none, and Access on the tenant we checked defines no helpdesk scopes.not confirmed
Availability: Not deployed on every tenant. Where it's missing, the gateway answers {"code":"not_found",...} with HTTP 511.checked live

curl -s https://{tenant-host}/oauth/v1/token \
  -d grant_type=client_credentials \
  -d client_id=$CLIENT_ID \
  -d client_secret=$CLIENT_SECRET

curl -s https://{tenant-host}/helpdesk-management/api/v1/configurations/B2C/COLUMNS \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Operations

Open an operation to see its parameters and code, and send it to your tenant. Scopes aren't known yet for this service.

Connect to your tenant

Then open any operation below and send it.

Tenant hostClient IDClient secret

Sends grant_type=client_credentials to https://{tenant-host}/oauth/v1/token through this site's server. The secret and token stay in this tab only; host and client ID are remembered.

What trips people up

Not on every tenant

checked live

None of the tenants we checked run this service. The gateway answers {"code":"not_found","message":"The requested location was not found"} with HTTP 511. That is not a client or token problem.

Path values are upper-case

not confirmed

businessType is B2B or B2C. configurationFor is FILTERS, COLUMNS or SEARCH.

PUT names the business type with a boolean

not confirmed

The body says isB2B: true or false where the GET path says B2B or B2C. A PUT with isB2B: false and configurationType: COLUMNS is read back from /configurations/B2C/COLUMNS.

PUT is an upsert with no body

not confirmed

It answers 201 when the configuration is new and 204 when it replaced one. Read it back with the GET to see what was stored.

data has no documented shape

not confirmed

data is free JSON that the helpdesk screens read. Get the current configuration first and send it back changed, rather than writing one from scratch.

Nothing saved yet is a 404

not confirmed

The GET answers 404 until a configuration exists for that business type and screen part.

When a call fails

Reply	Means	What to change
The service answers 401	The token lacks this service's audience, or it expired.	Add the audience to the client's Default audiences (Access admin → Web clients → the client), then get a new token.
The service answers 403 and the token has the audience	A scope the operation needs is missing.	Add one of the operation's scopes to the client's Default scopes. Use the scope names your tenant lists under Access admin → Scopes.
Token endpoint: 401 invalid_client	Unknown client ID or wrong secret.	Check the client ID and paste the secret again.
Token endpoint: 400 unauthorized_client	The client may not use client credentials.	Add the grant type Client credentials to the web client.
Token endpoint: 400 invalid_request about an audience	You asked for an audience the client doesn't have.	Add it to Default audiences, or stop asking for it.
Token endpoint: 500 right after scopes were added	The client's Default scopes, joined with spaces, are over about 1024 characters.	Move scopes to Additional scopes and request them per call, or split the work over two clients.
{"code":"not_found","message":"The requested location was not found"}	That service isn't deployed on this tenant.	Nothing to change in the client. Ask whoever runs the tenant.

Two kinds of client exist in Access. Service APIs like this one take a web client with the Client credentials grant. Access's own configuration API takes an API client: a web client sent there gets 401 invalid_credentials.