A POST that adds a product is sent to /baskets/{basketid}/items.

The OCAPI access key must therefore expose exactly that resource path.

If the current configuration uses a deeper path such as "/baskets//items/", the request to “…/items” doesn’t match and OCAPI returns 403.

Changing resourceid to “/baskets//items” aligns the key with the URI defined in the official Shop API (“Create Basket Item”), allowing the call to succeed.

Methods or attribute lists do not correct an unmatched resource path.

1. Salesforce B2C Commerce Cloud

Open Commerce API (Shop)

v23.1 – “Basket Items > Create Basket Item (POST /baskets/{basketid}/items)” (https://documentation.b2c.com/api/shop/23.1

section 3.4.17).

2. Salesforce B2C Commerce

OCAPI Settings Guide – “resourceid patterns: ‘/baskets//items’ matches add-item call; extra segment requires ‘/’ or ‘/’.” (Settings Guide PDF

pp. 7-8).

3. Salesforce B2C Commerce

OCAPI Permissions Schema – “writeattributes/readattributes accept attribute names or ‘()’; ‘(+items)’ is invalid.” (Schema JSON

section definitions).