Skip to main content

Adobe Admin

Adobe Admin lists Admin Console users and product profiles, and can remove a user from a product profile or from the organization through the User Management API (UMAPI).

JWT / Service Account credentials are deprecated. This connector uses OAuth Server-to-Server only.

UMAPI throttles clients to about 25 requests per minute (users and actions) and 5 requests per minute for groups. A 429 response includes Retry-After.

You cannot use UMAPI to add or remove users if the org is using the Azure/Entra or Google automated sync in Admin Console.

Authentication Types​

Adobe Admin supports 1 authentication method:

  • OAuth Server-to-Server — client_credentials grant against Adobe IMS, plus X-Api-Key (the Client ID) on every UMAPI request.
    • Pros: Matches current Adobe UMAPI auth; no user login
    • Cons: System Admin must create the Developer Console project; Client ID must be pasted again as X-Api-Key

Configuration​

FieldExample
Adobe Organization ID12345@AdobeOrg
Adobe Client ID (X-Api-Key)Same Client ID as the OAuth credential

The org id appears in Admin Console and Developer Console URLs.

Setting up OAuth Server-to-Server​

  1. Sign in as a System Admin.
  2. In Adobe Developer Console create a Project, add User Management API, and choose OAuth Server-to-Server.
  3. Select the product profiles this credential may manage.
  4. Copy Client ID, Client Secret, and Organization ID.
  5. In Willow paste Client ID and Client Secret. Token URL can stay blank (defaults to https://ims-na1.adobelogin.com/ims/token/v3). Scopes (comma separated): openid,AdobeID,user_management_sdk. Leave Send credentials as JSON unchecked.
  6. Enter the Organization ID and paste the same Client ID as X-Api-Key.

See Adobe's UMAPI authentication and OAuth Server-to-Server.

Available Tools​

  • List Users — GET /v2/usermanagement/users/{orgId}/{page}. Page is 0-based. Optional domain and directOnly. Only active users are returned. Groups include product profiles (and admin groups named with a prefix such as _admin_…).
  • Get User — GET /v2/usermanagement/organizations/{orgId}/users/{email}. Optional domain (use AdobeID for Adobe ID users).
  • List Groups — GET /v2/usermanagement/groups/{orgId}/{page}. Returns user groups and PRODUCT_PROFILE entries (groupName, productName, licenseQuota). Use groupName when removing product access.
  • Remove Product Profile — POST /v2/usermanagement/action/{orgId} with remove.group. Removes one product profile or user group by exact Admin Console name. Does not delete the Adobe account.
  • Remove From Organization — POST /v2/usermanagement/action/{orgId} with removeFromOrg. Removes the user from the org and all of its profiles. delete_account defaults to false. Adobe IDs are never deleted. delete_account: true permanently deletes an org-owned Enterprise/Federated directory account and assets.

Troubleshooting​

401 invalid token​

Cause: Client credentials are wrong, or the token URL / scopes do not match IMS.

Solution: Use https://ims-na1.adobelogin.com/ims/token/v3 and scopes openid,AdobeID,user_management_sdk. Do not use a JWT credential.

403 missing API key​

Cause: X-Api-Key is missing or is not the Client ID.

Solution: Paste the same Client ID into the X-Api-Key setting.

429 Too Many Requests​

Cause: UMAPI client limit (about 25/min for users and actions, 5/min for groups).

Solution: Wait for Retry-After and retry. Avoid tight loops over every page.

User not found / empty list​

Cause: List/Get only return active users. Disabled or removed accounts are omitted.

Solution: Check Admin Console status. Disabled users are not returned by these endpoints.

On this page