Security and the API

Client apps must log in using valid credentials. After validating, the server provides the client app with a:

• sessionId that is set into the session header so that all subsequent calls to the Web service are authenticated
• URL address (serverUrl) for the client app's web service requests

Salesforce supports only the Transport Layer Security (TLS) protocol and frontdoor.jsp. Ciphers must have a key length of at least 128 bits.

As an org’s Salesforce admin, you control which features and views are available to users by configuring profiles and permission sets and assigning users to them. To access the API to issue calls and receive the call results, a user must have the API Enabled permission. Client apps can query or update only those objects and fields to which they have access via the permissions of the logged-in user.

To create, edit, or delete a profile, from Setup, enter Profiles in the Quick Find box, then select Profiles. To create, edit, or delete a permission set, from Setup, enter Permission Sets in the Quick Find box, then select Permission Sets.

For more information about tokens, see Reset Your Security Token in Salesforce Help.

When a user’s password is changed, the user’s security token is automatically reset. To log in after the reset, the user adds the generated security token to the end of the password. Or the user enters the new password after you add the user’s IP address to the org’s list of trusted IP addresses.

If single sign-on (SSO) is enabled, users who access the API or a desktop client can’t log in unless their IP address is included on your org’s list of trusted IP addresses or on their profile, if their profile has IP address restrictions set. The delegated authentication authority usually handles login lockout policies for users with the Uses Single Sign-On permission. However, if the security token is enabled, your login lockout settings determine how many times a user can try to log in with an invalid security token before getting locked out. For more information, see Setting Login Restrictions and Setting Password Policies in Salesforce Help.

Sharing refers to the act of granting read or write access to a user or group so that they can view or edit a record owned by other users, if the default access levels don’t permit such access. All API calls respect the sharing model.

The following table describes the types of access levels.

Not all access levels are available for every object. See the Fields table for each object to learn which access levels are available, as well as other sharing details specific to that object.

For more information about sharing in general, see Salesforce Help.

Certain objects can be created or deleted only in the Salesforce user interface. Other objects are read-only—client apps cannot create(), delete(), or update() such objects. Similarly, certain fields within some objects can be specified on create() but not on update(). Other fields are read-only—client apps cannot specify field values in create() or update() calls. For more information, see the respective object descriptions in Object Basics.

Editing API access for a package is done in the Salesforce user interface. For more information, see Manage API and Dynamic Apex Access in Packages in Salesforce Help.

API access for a package affects the API requests originating from components within the package; it determines the objects that the API requests can access. If the API access for a package is not defined, then the objects that the API requests have access to are determined by the user's permissions.

The API access for a package never allows users to do more than the permissions granted to the user. API access in a package only reduces what the user's permissions allow.

Choosing Restricted for the API Access setting in a package affects the following:

• API access in a package overrides the following user permissions:
  • Author Apex
  • Customize Application
  • Edit HTML Templates
  • Edit Read Only Fields
  • Manage Billing
  • Manage Call Centers
  • Manage Categories
  • Manage Custom Report Types
  • Manage Dashboards
  • Manage Letterheads
  • Manage Package Licenses
  • Manage Public Documents
  • Manage Public List Views
  • Manage Public Reports
  • Manage Public Templates
  • Manage Users
  • Transfer Record
  • Use Team Reassignment Wizards
  • View Setup and Configuration
  • Weekly Export Data
• If Read, Create, Edit, and Delete access are not selected in the API access setting for objects, users do not have access to those objects from the package components, even if the user has the “Modify All Data” and “View All Data” permissions.
• A package with Restricted API access can’t create new users.
• Salesforce denies access to Web service and executeanonymous requests from an AppExchange package that has Restricted access.

To manage API access to packages, see “Manage API and Dynamic Apex Access in Packages” in Salesforce Help.

For security reasons, Salesforce restricts the outbound ports you can specify to one of the following:

• 80: This port only accepts HTTP connections.
• 443: This port only accepts HTTPS connections.
• 1024–66535 (inclusive): These ports accept HTTP or HTTPS connections.

The port restriction applies to any feature where a port is specified, for example outbound messages, AJAX proxy, or single-sign on.