Loading
Salesforce now sends email only from verified domains. Read More
Enhance Salesforce with Code
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Give Integration Users API Only Access

            You are here:

            1. Salesforce Help
            2. Docs
            3. Enhance Salesforce with Code

            Give Integration Users API Only Access

            Following the principle of least privilege, we recommend creating and configuring one Salesforce user for every integration. By assigning a different user to each calling system, domain, use case, or API resource, you restrict each of those users to a unique subset of data and functionality. Setting up dedicated integration users gives you more control over operations and traceability of transactions. And it minimizes the impact if a user or integration is compromised. The Salesforce Integration user license supports this best practice by offering a profile that restricts assigned users to API-only access, ideal for system-to-system integration users.

            Required Editions

            Available in: Enterprise, Unlimited, Performance, and Developer Editions.

            The Salesforce Integration user license makes the Minimum Access - API Only Integrations profile and the Salesforce API Integration permission set license available for assignment.

            Note
            Note The Minimum Access - API Only Integrations profile replaces the deprecated Salesforce API Only System Integrations profile, which isn't available in newly provisioned orgs.

            The Minimum Access - API Only Integrations profile enables and also restricts assigned users to operate via API. You can’t turn off the API-only access granted through this profile, but you can change other capabilities, permissions, settings, and data access granted to users via this profile. Find and review the profile in your org to understand what it can and can’t control. Users with this profile can also access objects that are accessible to all users. If your integration users need more access than the profile provides, use permission set licenses to expand the options.

            The Salesforce API Integration permission set license extends the functionality of the Salesforce Integration user license with many of the same user and object permissions typically available on the System Administrator standard profile. Find and review the Salesforce API Integration permission set license on the Company Information page in Setup to see what it makes available. Assign this or other permission set licenses to users with the Minimum Access - API Only Integrations profile to make more permissions available. Configure and assign permission sets or permission set groups to grant permissions to integration users so they can perform the API operations.

            Follow the standard process to find and assign the user license and profile and any permission set licenses, permission sets, and permission set groups to your integration user.

            Considerations

            Users assigned the Salesforce Integration user license and Salesforce API Only System Integrations profile are not authorized to access Salesforce data or features through any user interface. The individual permissions granted through the Salesforce Integration license and the related Minimum Access - API Only Integrations profile can’t be turned off, including on any clones of the profile.

            By default, orgs in supported editions are granted a limited number of Salesforce Integration user licenses. Contact a Salesforce account executive for information on how to purchase add-on licenses.

            As a part of integration planning or after assigning permissions to an integration user, decide how users are authorized and authenticated via the API so they can log in to an org. For integrations using a REST-based API, create an external client app and use an OAuth 2.0 flow. For integrations using a SOAP-based API, including the Bulk API, use the SOAP-specific login() call.

            See Also

             
            Loading
            Salesforce Help | Article