ConnectedApp

You can assign multiple permission sets to the connected app, but you must enter each permission set name on a separate line. You can’t enter the same permission set name more than one time for each connected app.

You can also change a permission set by replacing the current permission set with a new permission set. Make sure that each permission set name assigned to the connected app is unique.

You can delete individual permission sets or remove all permission sets from a connected app by entering an empty permissionSetName string on deployment of the connected app (<permissionSetName></permissionSetName>).

Enter a user that is part of your org. Otherwise, the user is removed from this field when you deploy the connected app. If you don’t want to specify a user, you can leave this field empty.

You can assign multiple profiles to the connected app, but you must enter each profile name on a separate line. You can’t enter the same profile name more than one time for each connected app.

You can also change profiles by replacing the current profiles with new profiles. Make sure that each profile name assigned to the connected app is unique.

You can also delete individual profiles, or remove all profiles from a connected app by entering an empty profileName string on deployment of the connected app (<profileName></profileName>).

• Get—OAuth authentication is used, and the user is prompted to allow the third-party application to access their information. When you use this access method, the canvas app must initiate the OAuth authentication flow.
• Post—OAuth authentication is used, but when the administrator installs the canvas app, they implicitly allow access for users. Therefore, the user isn’t prompted to allow the third party to access their user information. When you use this access method, the authentication is posted directly to the canvas app URL.

This field is available in API version 31.0 and later.

• Aura—Reserved for future use.
• AppLauncher—Reserved for future use.
• Chatter—The canvas app can appear in the app navigation list on the Chatter tab.
• ChatterFeed—The canvas app can appear as a Chatter feed item.
• MobileNav—The canvas app can appear in a mobile card in the Salesforce app. This value is available in API version 31.0 and later.
• None—The canvas app can appear only in the Canvas App Previewer.
• OpenCTI—The canvas app can appear in the call control tool.
• PageLayout—The canvas app can appear on a page layout. When viewed in the Salesforce app, the canvas app appears in the record detail page. This value is available in API version 31.0 and later.
• Publisher—The canvas app can appear as a global action.
• ServiceDesk—The canvas app can appear in the footer or sidebars of a Salesforce console.
• UserProfile—Reserved for future use.
• Visualforce—The canvas app can appear on a Visualforce page.

• HideShare—The Share button is hidden in the publisher for the related canvas app.

  Available in API version 30.0 and later.

• HideHeader—The header is hidden in the publisher for the related canvas app.

  Available in API version 30.0 and later.

• PersonalEnabled—End users can install the app as a canvas personal app.

  Available in API version 32.0 and later.

• IdpInitiated—Identity provider initiated. Salesforce makes the initial request to start the SSO flow.
• SpInitiated—Service provider initiated. The canvas app starts the SSO flow after it’s invoked.
• None—The canvas app isn’t using SAML SSO.

This field is available in API version 31.0 and later.

In API version 32.0 and later, you can set this field’s value only during creation. After you define and save the value, it can’t be edited. The value must be alphanumeric, can’t contain special characters or spaces, and must be between 8 and 256 characters. Consumer keys must be globally unique.

The value must be alphanumeric (no special characters and no spaces) and a minimum of 8 characters (maximum of 256 characters). If you specify a secret already in use for another connected app in the organization, an error occurs.

This field is available in API version 32.0 and later.

If set to true, only users with the appropriate profile or permission set can access the app. These users don’t have to approve the app before they can access it. Manage profiles for the app by editing each profile’s Connected App Access list. Manage permission sets for the app by editing each permission set’s Assigned Connected App list. This setting is not available in Group Edition. Available in API version 46.0 and later.

• Address—Allows access to the logged-in user’s street address (the same behavior as deploying Basic).
• Api—Allows access to the logged-in user’s account over the APIs.
• Basic—Allows access to your identity URL service (the same behavior as deploying Address, Email, Phone, and Profile).
• Chatter—Allows access to only the Chatter REST API resources.
• CustomApplications—Provides access to custom applications, such as those using Visualforce.
• CustomPermissions—Allows access to the custom permissions in an organization associated with the connected app, and shows whether the current user has each permission enabled.
• Email—Allows access to the logged-in user’s email address (the same behavior as deploying Basic).
• Full—Allows access to all data accessible by the logged-in user.
• OfflineAccess—Allows the app to interact with the user’s data while the user is offline, and get a refresh token (the same behavior as deploying RefreshToken).
• OpenID—Allows access to the logged-in user’s unique identifier for OpenID Connect apps.
• Phone—Allows access to the logged-in user’s phone number value (the same behavior as deploying Basic).
• Profile—Allows access to the logged-in user’s profile (the same behavior as deploying Basic).
• RefreshToken—Allows a refresh token to be returned if you’re eligible to receive one (the same behavior as deploying OfflineAccess).
• Wave—Allows access to the Analytics REST API resources. Available in API version 35.0 and later.
• Web—Allows use of the access_token on the web. This usage also includes visualforce, allowing access to Visualforce pages.

When retrieving metadata, valid values are:

• Api—Allows access to the logged-in user’s account over the APIs.
• Basic—Allows access to the user’s identity URL service, and includes Address, Email, Phone, and Profile.
• Chatter—Allows access to only the Chatter REST API resources.
• CustomApplications—Allows access to custom applications, such as those using Visualforce.
• Full—Allows access to all data accessible by the logged-in user.
• OpenID—Allows access to the logged in user’s unique identifier for OpenID Connect apps.
• RefreshToken—Allows a refresh token to be returned if you are eligible to receive one, and is synonymous with allowing OfflineAccess.
• Wave—Allows access to the Analytics REST API resources. Available in API version 35.0 and later.
• Web—Allows usage of the access_token on the web. This usage also includes visualforce, allowing access to Visualforce pages.

SamlEncryptionType

• AES_128—128–bit key.
• AES_256—256–bit key.
• Triple_Des—Triple Data Encryption Algorithm.

• PostBinding
• RedirectBinding

• Unspecified—No format given. This option is the default.
• EmailAddress—Used if the subject type is the user’s name ora federation ID (an ID internal to the SP).
• Persistent—Used with the user ID and persistent ID subject types.
• Transient—Used when the subject type is a custom attribute and can change every time the user logs in.

• Username—The user’s Salesforce name.
• FederationId—The user’s identifier at the service provider. Get this value from the service provider.
• UserId—The user’s Salesforce identifier.
• PersistentID—A persistent opaque identifier that is specific to the identity provider and a service provider.
• CustomAttr—The identifier is taken from a custom field value in samlSubjectCustomAttr.