Kurt_Koller

I've seen many customers have a security review that comes back flagging the use of GET on the API and putting client id and secret on the URL. Apparently people are somehow convinced that that's "in public". https://developers.marketo.com/rest-api/authentication/#using_an_access_token https://developers.marketo.com/rest-api/endpoint-reference/authentication-endpoint-reference/#!/Identity/identityUsingGET I've explained to people that it doesn't put it in cleartext to the public exactly (which is what people seem to think), as all connections are HTTPS. There is an abstract risk related to logging or something like proxy intercepting - if they log full URLs somewhere then that would be logged in a file somewhere and then that file and who can see it is important. Regardless, it's not how OAuth 2.0 is supposed to work and there is risk associated with GET, which is why it's not allowed in the OAuth 2.0 spec. Would it be possible to update these pages to show that you can use a POST? i.e. both of these work perfectly well:   curl --location --request GET 'https://123-ABC-456.mktorest.com/identity/oauth/token?grant_type=client_credentials&client_id=<client id>&client_secret=<client secret>'     curl --location --request POST 'https://123-ABC-456.mktorest.com/identity/oauth/token' \ --header  'Content-Type: application/x-www-form-urlencoded'  \ --data-urlencode  'grant_type=client_credentials'  \ --data-urlencode  'client_id=<client id>'  \ --data-urlencode 'client_secret=<client secret>' I'm not sure if the POST is officially supported at Marketo, but it absolutely should be, and if it is, I think the documentation should have that as the default, not the GET, and maybe even deprecate the GET, up to you. Security is more and more on people's minds and this has been flagged in numerous companies. I tried the POST like 2 years ago, and saw that it worked, and have told people they can use that instead - I just told someone else today and I think it might be best to just support this and change the documentation. Thanks for the consideration. ... View more

There are many integrations out there and many of them now expect that people can call REST endpoints with the proper method. As an example, we have an integration right now where we can POST to create a person in another system, which returns an ID. Ideally, we would like to PUT to the user record to do an update. This is currently not supported by Marketo, the only options are GET and POST. A few old timey servers out there support ?_method=DELETE or ?_method=POST on the URL of a POST, however that number is very few. Please add additional methods to webhooks so we can take advantage of additional, modern integrations. ... View more

Release Notes: Fall '18 - Marketo Docs - Product Documentation In the release notes liked above, it has the following: API Lead Map REST API Marketo now supports the use of email-disposition fields over the Lead APIs (includes Black Listed, Marketing Suspended, Email Suspended, and Relative Urgency). What does this mean exactly? I think it might mean we will be able to get these fields when querying a lead. They don't show up in lead/describe.json (release date isn't until October 12 so that makes sense) so I'm not sure what they mean exactly. Any info on this would be appreciated Thanks Kurt Koller Digital Pi ... View more

We are trying to keep Leads in our external database in sync with leads in the Marketo database. Nonwithstanding the inablility just get all leads in once call, instead having to go through in monthly gets using a filter like created or updated, once we have all the leads in our own database we figure we could get updates and keep them in sync. Leads are removed in a variety of ways. Activities have two main activities that we see (we are testing on instance with a single partition) when they are removed: 37, Delete Lead 32, Merge Leads We have been using Bulk Export API to get all activities for Leads. In this data we get activity data for both of these activities. The question is, are all leads which are Deleted included in these activities? I know you can only get them for a limited about of time, but will every deleted lead also return a Delete Lead activity or a Merge Leads activity? I ask because we are trying to keep leads in sync, and using these types and we are off by a large percentage in some instances, where the leads just have a smattering of activities and then are gone, with no 37 or 32 or anything else indicating that they've been deleted, but indeed they are deleted, so we never see that the lead is removed and our database is completely wrong very quickly.. I'd love to know all of the possible types of activities that could signal a Lead has been removed, if there are more than these two. If not, are there cases where the 37/32 wouldn't be pulled down via Bulk API? Or should every lead that has been deleted/merged show in this data? Alternatively we would have to check the lead API endpoint in batches etc on a constantly rotating basis to figure out if leads are still existing, which is both wasteful and uses many API calls and takes days. Thanks, Kurt ... View more

Currently, when you download a file on the Bulk API at  and there is a server problem on the Marketo env, instead of the CSV file you get {"requestId":"3fd2#161992bc7e1","success":false,"errors":[{"code":"611","message":"System error"}]} It would be ideal if this call would return a 500 or 503 status code, since this is a file retrieval operation and not an API call like the others. We can check length of the download as a bandaid, but if we are getting leads and we get just a header row it could easily end up being the same length as the specified file download length. And it's a little awkward to check what's supposed to be a CSV export file for json. ALSO When you're out of quota you get an error 1029. http://developers.marketo.com/rest-api/bulk-extract/ " The daily quota is a maximum of 500MB per day, which is shared between leads and activities.  When the quota is exceeded, you cannot Create or Enqueue another job until the daily quota resets at midnight Central Time .  Until that time, an error “1029, Export daily quota exceeded” is returned." The error message in the table of errors http://developers.marketo.com/rest-api/error-codes/  says: 1029 Too many jobs in queue Subscriptions are allowed a maximum of 10 bulk extract jobs in the queue at any given time. Is this error doubled up on or is the documentation incorrect? Thanks, Kurt ... View more

When we extract activities from the bulk API, we don't see any of type 28, "Sync Lead Updates to SFDC." We do continue to get them through SOAP for the same dates. The expectation I have is that Bulk extract of activities would have all activities for a time range. Does anyone know if these activities being excluded from the Bulk extract API? Thanks! ... View more