Verify migration service access

Last update: July 28, 2026

CREATED FOR:

Intermediate
Developer

IMPORTANT

The bulk data migration tool is currently in Early Access. Access is provided exclusively through the Commerce Deployed Engineering (CDE) engagement process. For an overview of the tool and its eligibility requirements, see Bulk data migration tool.

Use this guide to verify end-to-end access to the Commerce Data Migration Service (CDMS) API from your environment. A successful call simultaneously validates network reachability from your egress IPs (IP allowlisting), IMS authentication, and tenant authorization.

Complete this guide after you finish all items in the Customer readiness checklist and before you run the migration described in the migration guide.

Prerequisites

An OAuth 2.0 Server-to-Server credential (client ID and client secret) created in the Adobe Developer Console.
Your IMS organization ID, in the format <org>@AdobeOrg. The organization must own the target tenant.
The target tenantId, a 22-character, alphanumeric IMS tenant ID.
Outbound egress IP addresses submitted to and allowlisted by Adobe for the CDMS gateway. Coordinate with the Adobe team if you are uncertain about the IP addresses or their status.
The region-specific service host from the Service hosts by environment and region table.

Generate an IMS access token

Generate an access token using your OAuth 2.0 Server-to-Server credentials with the client_credentials grant. The IMS host in this step is the same for all data regions. Only the CDMS host changes per region.

curl -X POST "https://ims-na1.adobelogin.com/ims/token/v3" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "x-org-id:<your-org-id>@AdobeOrg" \
  -d "grant_type=client_credentials" \
  -d "client_id=<your-ims-client-id>" \
  -d "client_secret=<your-ims-client-secret>" \
  -d "scope=AdobeID,openid,read_organizations,additional_info.projectedProductContext,additional_info.roles,adobeio_api,read_client_secret,manage_client_secrets"

Call the List Migrations API

The following request retrieves the list of migrations for the tenant and requires the access token from the previous step. Select the host for your region from the Service hosts by environment and region table. The -i flag prints the HTTP status line and response headers so you can confirm the result.

curl -i "https://<host>/<tenantId>/v1/migrations" \
  -H "Authorization: Bearer <your IMS access token>"

Interpret the response

HTTP code

Meaning

Example response body

200

Success. Connectivity, authentication, and tenant authorization all passed. The response body contains the list of migrations for the tenant.

{"migrations":[...]}

401

Missing or invalid Bearer token, rejected before reaching the service. Regenerate the token.

Varies (gateway-generated)

403

The authenticated user does not have migration permissions for this tenant.

{"error":"access_denied","message":"You do not have permission to access this tenant"}

500

Internal server error.

{"error":{"message":"Internal Server Error","status":500}}

NOTE

If the request times out or the connection is refused, and no HTTP status is returned, your egress IP is likely not allowlisted, or you are using an incorrect host. Confirm the region host in the following table and your allowlisted IPs.

Service hosts by environment and region

Region or environment

Host

Sandbox or pre-production

https://na1-sandbox.api.commerce.adobe.com

North America

https://na1.api.commerce.adobe.com

Europe

https://eu1.api.commerce.adobe.com

India

https://in1.api.commerce.adobe.com

https://uk1.api.commerce.adobe.com

Australia and New Zealand

https://au1.api.commerce.adobe.com

Next steps

After you confirm access, proceed to the migration guide to begin environment configuration and migration execution.

recommendation-more-help

commerce-help-cloud-service