3806546 - OIDC LMS API calls return "error.Action.Restricted" after token retrieval - SAP SuccessFactors Learning

• An error occurs when attempting to connect to LMS APIs using OIDC-based authentication.
• Error message: "ERROR: error.Action.Restricted"
• Error message: "Failed to authenticated OIDC token"

• SAP SuccessFactors Learning

1. Configure OIDC with Identity Authentication Service and successfully obtain an access token.
2. Call a Learning OData API (for example, the user learningPlan v1 metadata endpoint).
3. Observe the response error "ERROR: error.Action.Restricted" or "Failed to authenticated OIDC token".

The error "error.Action.Restricted" is related to the permission of the API user querying an LMS entity/API and not to the OIDC configuration.

1. Verify that the API user's user ID is identical in BizX, LMS User, and LMS Admin.
2. Ensure the API user has sufficient Learning permissions/roles to access the targeted APIs and entities. Refer to the article in the See also section.
3. For the metadata call /learning/odatav4/user/learningPlan/v1/, generate and use an access token for a user with "userType":"user" (do not use an admin token).
4. In the OIDC token request, use SAP_SF_API_Connection as the resource. Do not use an LMS bundled application dependency as the resource for this use case.
5. Re-test the Learning API call and confirm the error no longer occurs.

KBA 3678043 - Permission error encountered when accessing SAP SuccessFactors Learning APIs

OIDC, error.Action.Restricted, Failed to authenticated OIDC token, LMS API, OData v4, learningPlan v1, IAS, token validation, API permissions, API user, identity authentication, microservices, resource parameter, SAP_SF_API_Connection, user token , KBA , LOD-SF-LMS-ODA , Web Services OData , Problem