Appearance
Account management
Routes used by account.ubisoft.com. Exchange to an account app ID first:
| Purpose | ID |
|---|---|
| Account management | afb4b43c-f1f7-41b7-bcef-a635d8c83822 |
| Account website (osClient) | 74e71609-1ddf-47da-9073-71ac3aa8c90c |
| Connect client (login hop) | f68a4bb5-608a-4ff2-8123-be8ef797e0a6 |
Sensitive writes add Ubi-Challenge (reCAPTCHA). Some unauthenticated mail-link calls also send GenomeId.
Login / 2FA-at-login: Authentication.
2FA enrollment
GET
https://public-ubiservices.ubi.com/v3/profiles/me/2faPOST
https://public-ubiservices.ubi.com/v3/profiles/me/start2faActivationBody: { "codeGenerationPreference": "{preference}" } plus Ubi-Challenge.
POST
https://public-ubiservices.ubi.com/v3/profiles/me/2faBody: { "2faActivationKey": "{key}" } plus Ubi-Challenge.
PUT
https://public-ubiservices.ubi.com/v3/profiles/me/2faUpdate settings. Headers include Ubi-2FACode and Ubi-Challenge.
DELETE
https://public-ubiservices.ubi.com/v3/profiles/me/2faPOST
https://public-ubiservices.ubi.com/v3/profiles/me/2facodeRequest a code (email/SMS). Ubi-Challenge required.
Trusted devices
GET
https://public-ubiservices.ubi.com/v3/profiles/me/trusteddevicesAlso seen as /v3/users/{userId}/trustedDevices.
PUT
https://public-ubiservices.ubi.com/v3/profiles/me/trusteddevices/{id}Body: { "friendlyName": "{name}" }.
DELETE
https://public-ubiservices.ubi.com/v3/profiles/me/trusteddevices/{id}Email
POST
https://public-ubiservices.ubi.com/v3/users/startChangeEmailBody: { "email": "{newEmail}", "nextUrl": "_" }. GenomeId + Ubi-Challenge. Authorization omitted.
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/completeChangeEmailts
type CompleteChangeEmailBody = {
emailValidationCode: string
newEmail: string
identityToken: string
} | {
newEmail: string
resetKey: string
}Activation
POST
https://public-ubiservices.ubi.com/v3/users/startActivationGenomeId + Ubi-Challenge.
PUT
https://public-ubiservices.ubi.com/v3/users/completeActivationBody: { "email": "{email}", "activationKey": "{key}" }.
Password reset
POST
https://public-ubiservices.ubi.com/v3/users/startResetPasswordBody: { "email": "{email}", "nextUrl": "{url}" }.
POST
https://public-ubiservices.ubi.com/v3/users/completeResetPasswordMail-link body: { "email", "password", "resetKey" }. SMS variant adds countryCallingCode, phoneNumber, identityToken, and Ubi-TransactionId.
Password rules: GET /v1/users/passwords/rules.
Phone
POST
https://public-ubiservices.ubi.com/v3/users/me/phoneValidationCodePOST
https://public-ubiservices.ubi.com/v3/users/me/startPhoneActivationPOST
https://public-ubiservices.ubi.com/v3/users/me/completePhoneActivationPATCH
https://public-ubiservices.ubi.com/v3/users/meRemove phone: { "phone": null }.
Age verification
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/startAgeVerificationBody: { "callbackUrl": "{url}", "cancelUrl": "{url}" }.
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/cancelAgeVerificationFamily / guardian
GET
https://public-ubiservices.ubi.com/v3/users/me/familyHeader: GenomeId.
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/startGuardianLinkWithTeen{userId} is the teen. Body: { "guardianEmail": "{email}" }. GenomeId + Ubi-Challenge.
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/completeGuardianLinkWithTeen{userId} is the guardian / parent. Body: { "teenUserId": "{userId}", "guardianLinkToken": "{token}" }. GenomeId.
POST
https://public-ubiservices.ubi.com/v3/users/validateCompleteMinorCreationPOST
https://public-ubiservices.ubi.com/v3/users/completeMinorCreationCancel deletion
POST
https://public-ubiservices.ubi.com/v3/users/completeCancelDeletionBody: { "cancelKey", "email", "executorId?" }.
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/completeCancelDeletionPer-user variant. Empty body.
Validation codes
POST
https://public-ubiservices.ubi.com/v3/users/{userId}/validationCodes/{mode}Issue a code (email/phone). {mode} is the channel. Ubi-Challenge required.
ts
type ValidationCodeBody = {
email: string
context: string
}POST
https://public-ubiservices.ubi.com/v3/users/{userId}/validationCodes/{mode}/validationCheck the code. Same challenge header.
ts
type ValidationCodeCheckBody = {
validationCode: string
context: string
}Opt-ins
GET
https://public-ubiservices.ubi.com/v1/users/me/optinsPUT
https://public-ubiservices.ubi.com/v1/users/me/optinsPUT body is the opt-in object the GET returned (shape varies by country/age).
GET
https://public-ubiservices.ubi.com/v1/users/configs/optins/{countryCode}?ageGroup=GET
https://public-ubiservices.ubi.com/v1/spaces/{spaceId}/configs/usercontrols/globaloptins?countryCode=&ageGroup=User-controls catalogue. Send Ubi-LocaleCode. Opt-ins space: 674bda67-9a08-48dd-8596-d467684d8c6c.
Communication preferences
GET
https://public-ubiservices.ubi.com/v2/users/me/communicationPreferencesPUT
https://public-ubiservices.ubi.com/v2/users/me/communicationPreferencesPUT body from the account site is { "2faCode": "{communicationPreference}" } — the field name is 2faCode even though this is the communication-preference value, not a 2FA login code.
OAuth clients
GET
https://public-ubiservices.ubi.com/v1/profiles/{profileId}/applications/oauth/clients/consents?offset=0&limit=50Optional query: applicationIds (array). Send Ubi-LocaleCode.
DELETE
https://public-ubiservices.ubi.com/v1/profiles/{profileId}/applications/{applicationId}/oauth/clients/consentsPersonal data export
POST
https://public-ubiservices.ubi.com/v1/users/{userId}/personalData/extractionsGET
https://public-ubiservices.ubi.com/v1/users/{userId}/personalData/extractionsGET
https://public-ubiservices.ubi.com/v1/users/{userId}/personalData/extractions/{extractionId}/downloadDownload is a blob.
Amazon Prime Gaming
POST
https://public-ubiservices.ubi.com/api/external/v1/amazonprimegaming/primeDELETE
https://public-ubiservices.ubi.com/v2/externalparties/public/amazonprimegaming/primePOST links (/api/external/… on ubi-services). DELETE unlinks (/v2/externalparties/…).
Spending limits
GET
https://public-ubiservices.ubi.com/v3/users/{userId}/policies/spendingLimitsPUT
https://public-ubiservices.ubi.com/v3/users/{userId}/policies/spendingLimitsPUT body: { "limit": {value} }.
Spent
GET
https://scs.ecom.ubi.com/api/v1/users/{userId}/spent/{currency}Money spent in {currency} for that user. Host is SCS ecom (scs.ecom.ubi.com), not ubi-services. account.ubisoft.com wires this as scsClient.scsApi.getSpentMoney.
Policies
GET
https://public-ubiservices.ubi.com/v3/policies/{countryCode}?languageCode=&contentFormat=htmlLegal / policy HTML for a country. languageCode is the locale; contentFormat is html in the official client.
Subscriptions
GET
https://uss.ecom.ubi.com/v2/subscriptions?filter=ubisoftAccountId eq '{userId}'Host is USS. account.ubisoft.com uses https://uss.ecom.ubi.com; some other official clients use https://uss.ubi.com for the same path (UAT/CERT2/DEV: https://uss.uat.ecom.ubi.com). The account client remaps HTTP 403 to 401 locally; the server still returns 403.
ESS subscription
GET
https://ess.ubi.com/account/{userId}/subscription?type=Per-type subscription on ESS (https://ess.ubi.com in PROD; https://ess.uat.ecom.ubi.com on CERT2/UAT/DEV). Query type is required.
ts
type EssSubscription = {
id: string
userId: string // ubisoftAccountId
startedAt?: string
type: string
level?: string
creatorId?: string // creatorAppId
status: string
isActive: boolean // status is "active" or "suspended"
isCancellationInProgress?: boolean
}Host table: Environments → Ecommerce.