SCAPI Zone

A SCAPI zone is the Salesforce-managed embedded CDN (eCDN) zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API. No support case is required.

Use the SCAPI zone to respond to abusive API traffic, such as credential stuffing against login endpoints, and to inspect HTTP and security traffic for your SCAPI hostname. Platform guardrails reject configurations that would break SCAPI routing or caching.

This zone is not a storefront zone that you create. Storefront zones are covered in CDN Zones.

Open the zone in Business Manager on the Production instance: Administration > Sites > Embedded CDN Settings, then Configure Zone. For the click path and screenshots, see Access the SCAPI Zone in Business Manager and SCAPI Zone Support for B2C Commerce.

What Is a SCAPI Zone?

Identify the zone by its shortcode-based hostname: <shortcode>.api.commercecloud.salesforce.com.

Salesforce provisions the zone. You can’t create it, add hostnames, or manage certificates. The Crypto tab is read-only. The Certificates table includes the certificate count, hostname, certificate status, hostname status, expiry, issuer, signature, and minimum TLS version. You can’t upload, delete, renew, or otherwise manage certificates. This is the same read-only model used for the Default Domain.

There’s one SCAPI zone for Development, Staging, and Production. Open it only on Production. It doesn’t appear in Business Manager or the CDN API on Development or Staging.
A rule applies to all three environments unless the expression scopes it by the organization ID in the URL path. Business Manager shows a warning banner on the Security Rules tab.
Platform-managed rules are visible and locked, including the Managed Runtime allowlist that skips custom, rate-limiting, and managed web application firewall (WAF) checks.
Configurations that would break SCAPI routing or caching are rejected before they apply. Controls that don’t apply aren’t shown in Business Manager and are rejected by the CDN API.

Controls Available on SCAPI Zones

This table is what Production Business Manager shows. It isn’t a claim that the CDN API exposes the same set. Controls that don’t apply aren’t shown in Business Manager and are rejected by the CDN API.

Available in Production Business Manager	Not available on SCAPI zones
Custom rules (Security Rules tab, Zone Security Rules and Realm Security Rules)	eCDN WAF managed rules
Rate limiting rules (Security Rules tab, Zone Security Rules)	Mutual TLS (mTLS)
IP access lists (Security Rules tab, Realm Security Rules)	TLS 1.3 configuration
Analytics: HTTP and Security traffic views	Managed Runtime (MRT) routing rules
Cache purge (by tag or path)	HTTP Strict Transport Security (HSTS)
Crypto tab: read-only certificate view	Hostname and certificate management

These controls also aren’t available on SCAPI zones: Speed settings, Under Attack Mode, custom error pages, Page Shield, notifications, Logpull, Logpush, Host Header Override, and cache rules. SCAPI caching is platform-managed. See SCAPI Caching.

The management flows for supported controls match storefront zones. For procedures, see:

For Leaked Credentials Detection and rate limiting on SLAS login, see Security.

Managed Runtime SCAPI Request Identification

Starting with B2C Commerce 26.10, you can lock down Shopper API requests on the SCAPI zone so that they’re accepted only from your Managed Runtime (MRT) environments.

SCAPI Zone Visibility gates the Security Rules tab. It’s on by default starting with B2C Commerce 26.10. Managed Runtime SCAPI Request Identification is set per instance: Development, Staging, and Production. For where to turn these switches on in Business Manager, see SCAPI Zone Support for B2C Commerce.

Salesforce generates and rotates the SCAPI Identity Header. Managed Runtime attaches it to requests it forwards to SCAPI. After setup finishes, a locked allow rule for that instance appears on the Security Rules tab. The allow rule is per instance and matches that instance’s organization path, so a Production rule doesn’t apply to Staging or Development.

Enabling the switch doesn’t stop direct SCAPI traffic. You add the block rule. Don’t block every SCAPI call. Admin APIs use Account Manager, and blocking them breaks Admin API and B2C CLI use.

Scope the rule. Use the same organization path as the allow rule, and add /shopper. For example, URI Path contains the organization segment and URI Path contains /shopper. An unscoped rule applies to Development, Staging, and Production. The /shopper condition matches Shopper APIs and the SLAS path and leaves Admin API paths alone. A custom API path, /custom/<api>/..., doesn’t contain /shopper. To block one custom endpoint, use the organization segment and URI Path contains /custom/<api> instead.
Order the rule. Place the block rule directly after that instance’s allow rule. Rules evaluate in order, so a block rule above the allow rule also blocks Managed Runtime traffic.
Choose the action. SCAPI clients can’t solve a challenge, so set the action to block, not Managed Challenge.
Start with log. Leave the rule in log for at least a full business cycle, about 1 to 7 days, including scheduled jobs and peak hours. Review the matches by path, user agent, and ASN. Look for legitimate Shopper API callers that reach SCAPI without going through Managed Runtime, such as native mobile apps, synthetic monitoring, and QA automation. OMS, ERP, and PIM integrations call Admin APIs, so the rule doesn’t match them.
Keep exclusions narrow. Route legitimate callers through Managed Runtime, or exclude a specific path plus a known signal, such as a client ID or a short list of fixed IPs. Don’t allowlist whole IP ranges or networks.
Time the switch. Switch to block only after that review, and not during a flash sale, a holiday code freeze, or another peak window.
Plan a rollback. To roll back, set the block rule back to log, or disable it, before you turn off the feature switch. After you enforce the rule, watch for a spike in SCAPI zone blocks or 403 responses. See Anomaly Detection in Log Center.

Salesforce owns the secret, rotation, and the allow rule. You own the block rule, its exclusions, and monitoring.

This control closes the path that bypasses the CDN and Managed Runtime for Shopper API traffic. Rate limiting and the other bot controls still apply.

For setup steps, see Restrict SCAPI Access to Managed Runtime Traffic for Composable Storefront and Restrict SCAPI Access to Managed Runtime Traffic for Storefront Next.