Security and the API

Client applications must log in using valid credentials for an organization. The server authenticates these credentials and, if valid, provides the client application with:

• a sessionId that must be set into the session header so that all subsequent calls to the Web service are authenticated
• a URL address (serverUrl) for the client application's Web service requests

Salesforce supports only the Transport Layer Security (TLS) protocol and frontdoor.jsp. Ciphers must have a key length of at least 128 bits.

An organization's Salesforce administrator controls the availability of various features and views by configuring profiles and permission sets, and assigning users to them. To access the API (to issue calls and receive the call results), a user must be granted the “API Enabled” permission. Client applications can query or update only those objects and fields to which they have access via the permissions of the logged-in user.

To create, edit, or delete a profile, from Setup, enter Profiles in the Quick Find box, then select Profiles in the Salesforce user interface. To create, edit, or delete a permission set, from Setup, enter Permission Sets in the Quick Find box, then select Permission Sets.

For more information about tokens, see “Reset Your Security Token” in the Salesforce online help.

When a user's password is changed, the user's security token is automatically reset. The user will experience a blocked login until he or she adds the automatically-generated security token to the end of his or her password or enters the new password after the administrator adds their IP address to the organization's list of trusted IP addresses.

If Single Sign-On (SSO) is enabled for your organization, users who access the API or a desktop client cannot log in to Salesforce unless their IP address is included on your organization's list of trusted IP addresses or on their profile, if their profile has IP address restrictions set. Futhermore, the delegated authentication authority usually handles login lockout policies for users with the “Uses Single Sign-On” permission. However, if the security token is enabled for your organization, then your organization's login lockout settings determine the number of times a user can attempt to log in with an invalid security token before being locked out of Salesforce. For more information, see “Setting Login Restrictions” and “Setting Password Policies” in the online help.

In the Salesforce user interface, sharing refers to the act of granting read or write access to a user or group so that they can view or edit a record owned by other users, if the default organization access levels do not otherwise permit such access. All API calls respect the sharing model.

The following table describes the types of access levels.

Not all access levels are available for every object. See the Fields table for each object to learn which access levels are available, as well as other sharing details specific to that object.

For more information about sharing in general, see the Salesforce online help.

Certain objects can be created or deleted only in the Salesforce user interface. Other objects are read-only—client applications cannot create(), delete(), or update() such objects. Similarly, certain fields within some objects can be specified on create() but not on update(). Other fields are read-only—client applications cannot specify field values in create() or update() calls. For more information, see the respective object descriptions in Object Basics.

Editing API access for a package is done in the Salesforce user interface. For more information, see “Manage API and Dynamic Apex Access in Packages” in the Salesforce online help.

API access for a package affects the API requests originating from components within the package; it determines the objects that the API requests can access. If the API access for a package is not defined, then the objects that the API requests have access to are determined by the user's permissions.

The API access for a package never allows users to do more than the permissions granted to the user. API access in a package only reduces what the user's permissions allow.

Choosing Restricted for the API Access setting in a package affects the following:

• API access in a package overrides the following user permissions:
  • Author Apex
  • Customize Application
  • Edit HTML Templates
  • Edit Read Only Fields
  • Manage Billing
  • Manage Call Centers
  • Manage Categories
  • Manage Custom Report Types
  • Manage Dashboards
  • Manage Letterheads
  • Manage Package Licenses
  • Manage Public Documents
  • Manage Public List Views
  • Manage Public Reports
  • Manage Public Templates
  • Manage Users
  • Transfer Record
  • Use Team Reassignment Wizards
  • View Setup and Configuration
  • Weekly Export Data
• If Read, Create, Edit, and Delete access are not selected in the API access setting for objects, users do not have access to those objects from the package components, even if the user has the “Modify All Data” and “View All Data” permissions.
• A package with Restricted API access can’t create new users.
• Salesforce denies access to Web service and executeanonymous requests from an AppExchange package that has Restricted access.

To manage API access to packages, see “Manage API and Dynamic Apex Access in Packages” in the Salesforce online help.

For security reasons, Salesforce restricts the outbound ports you may specify to one of the following:

• 80: This port only accepts HTTP connections.
• 443: This port only accepts HTTPS connections.
• 1024–66535 (inclusive): These ports accept HTTP or HTTPS connections.

The port restriction applies to any feature where a port is specified, for example outbound messages, AJAX proxy, or single-sign on.