Review Integrated User

Salesforce uses an Integration User to establish communication between systems. It serves as the "identity" for external applications when they interact with your Salesforce data via APIs. Salesforce configuration lets administrators restrict integration users for API only.

When properly implemented, administrators can use this configuration for implementing zero trust and least privilege for programmatic access. Lack of the implementation may allow excessive permissions to the integration users, increasing the risk of unauthorized access to the data.

• API-Only Access Control
  Restricts system identities, such as integration users, to programmatic access only, enforcing the principle of least privilege for all external integrations.