Configure x-on-behalf-user access when a Technical Account needs to perform Analyzer API operations for specific users in the same organization.
When on-behalf access is enabled, a central application can work with user-owned Analyzer documents and data without requiring individual user authentication tokens.
What on-behalf access enables
A Technical Account can act on behalf of an approved user to:
- Access the user's documents.
- Retrieve extracted values from the user's documents.
- Search the user's data.
- Upload documents for the user.
- Extract attributes configured by the user.
Access applies only to users explicitly approved for the Technical Account.
Requirements
Before requesting on-behalf access:
- Configure the Technical Account for Analyzer API access.
- Make at least one successful Analyzer API call using the Technical Account.
- Ensure each user belongs to the same organization as the Technical Account.
- Collect the exact email address for each user who requires on-behalf access.
Adobe rejects on-behalf requests for users in another organization or when the supplied email address doesn't exactly match the user's account.
Identify the Technical Account
Identify the Technical Account that generates the OAuth access token and makes the API requests.
To find its Technical Account ID:
- Open the project in Adobe Developer Console.
- Open the OAuth Server-to-Server credential used for Analyzer.
- Open the page used to generate an access token.
- Locate the Technical Account ID.
The Technical Account ID ends in @techacct.adobe.com.
Verify that the ID belongs to the Technical Account your integration uses before submitting the allowlist request.
Identify the users
Create a list of the users the Technical Account needs to act on behalf of.
For each user:
- Collect the user's exact Adobe account email address.
- Verify that the user belongs to the same organization as the Technical Account.
Only users included in the approved allowlist can be accessed through on-behalf requests.
Request on-behalf access
Adobe Support manages the allowlist for each Technical Account.
The organization's System Administrator must submit a support request that includes:
- The Technical Account ID ending in @techacct.adobe.com.
- The complete list of user email addresses to allowlist.
- Confirmation of approval from the organization's System Administrator.
Adobe reviews the request and configures the approved users for the Technical Account.
The Technical Account must have completed at least one successful Analyzer API call before Adobe can update its configuration.
Make an API request on behalf of a user
After Adobe approves the allowlist, include the x-on-behalf-user header in requests that should run on behalf of an approved user.
Set the header value to the user's approved email address:
x-on-behalf-user: user@example.com
Continue to authenticate the request with the Technical Account's OAuth Server-to-Server bearer token.
The request runs in the context of the user identified by the x-on-behalf-user header. The user must be on the Technical Account's approved allowlist.
