Activity logs and Marketo API

[Grant_Booth]

Some thoughts on this:
- make sure they understand that it's not really a "user ID": it does uniquely define your Marketo instance, but no one can use it to actually gain access to your data. To gain access to your data, they need to either have a login to your Marketo or have API credentials. Someone could use it to send spam data to your instance, but that's one-way: they would need more than that to pull data from your instance.
- I don't believe there's a way to customize that "Person is Pushed" activity, but if you are forced to go that route, you could try creating a custom activity to indicate that it's a form fill-out occurring. Understanding Custom Activities - Marketo Docs - Product Documentation.

I hope you can change their mind. Not being able to do a simple form post will create nightmares for you. You'll also lose Marketo's inferred data (Inferred Country, etc.) that are based on the person's IP address.

[SanfordWhiteman]

Not being able to do a simple form post will create nightmares for you. You'll also lose Marketo's inferred data (Inferred Country, etc.) that are based on the person's IP address.

Not only that, but you have to turn off Munchkin if the Munchkin ID is really that much of a concern. And Marketo sans Munchkin approaches uselessness.

Bottom line is "leaking" the Munchkin ID -- also present in Marketo email headers, incidentally, so that's another way to obtain it -- just isn't a concern once you understand what the ID really is. It's not like an API client secret. It's like a Google Analytics web property ID, and it has to be publicly readable in order to be useful.

[SanfordWhiteman]

you could try creating a custom activity to indicate that it's a form fill-out occurring

That's true. But then it would take 3 metered API calls to sort-of-approximate what forms can do in a basically unlimited fashion.

Again, it's not that there aren't some acceptable justifications for turning to the API, and even a few very good ones. But exposing the Munchkin ID isn't in either group!

[Raj_Jain]

Again, it's not that there aren't some acceptable justifications for turning to the API, and even a few very good ones. But exposing the Munchkin ID isn't in either group!

Sanford Whiteman Curious to learn more about of these acceptable justifications you mention? Which are the very good ones?

I'm wondering because I  have inherited an instance which relies heavily on API...

[Liudmila_Te]

Thanks a lot!

It helps.