ConnectedApp

You can assign multiple permission sets to the connected app, but you must enter each permission set name on a separate line. You can’t enter the same permission set name more than one time for each connected app.

You can also change a permission set by replacing the current permission set with a new permission set. Make sure that each permission set name assigned to the connected app is unique.

You can delete individual permission sets or remove all permission sets from a connected app by entering an empty permissionSetName string on deployment of the connected app: (<permissionSetName></permissionSetName>).

Enter a user that is part of your org. Otherwise, the user is removed from this field when you deploy the connected app. If you don’t want to specify a user, you can leave this field empty.

You can assign multiple profiles to the connected app, but you must enter each profile name on a separate line. You can’t enter the same profile name more than one time for each connected app.

You can also change profiles by replacing the current profiles with new profiles. Make sure that each profile name assigned to the connected app is unique.

You can also delete individual profiles or remove all profiles from a connected app by entering an empty profileName string on deployment of the connected app: (<profileName></profileName>).

• Get—OAuth authentication is used, and the user is prompted to allow the third-party application to access their information. When you use this access method, the canvas app must initiate the OAuth authentication flow.
• Post—OAuth authentication is used, but when the administrator installs the canvas app, they implicitly allow access for users. Therefore, the user isn’t prompted to allow the third party to access their user information. When you use this access method, the authentication is posted directly to the canvas app URL.

Available in API version 31.0 and later.

• Aura—Reserved for future use.
• AppLauncher—Reserved for future use.
• Chatter—The canvas app can appear in the app navigation list on the Chatter tab.
• ChatterFeed—The canvas app can appear as a Chatter feed item.
• MobileNav—The canvas app can appear in a mobile card in the Salesforce mobile app. Available in API version 31.0 and later.
• None—The canvas app can appear only in the Canvas App Previewer.
• OpenCTI—The canvas app can appear in the call control tool.
• PageLayout—The canvas app can appear on a page layout. When viewed in the Salesforce mobile app, the canvas app appears in the record detail page. Available in API version 31.0 and later.
• Publisher—The canvas app can appear as a global action.
• ServiceDesk—The canvas app can appear in the footer or sidebars of a Salesforce console.
• UserProfile—Reserved for future use.
• Visualforce—The canvas app can appear on a Visualforce page.

• HideShare—The Share button is hidden in the publisher for the related canvas app. Available in API version 30.0 and later.
• HideHeader—The header is hidden in the publisher for the related canvas app. Available in API version 30.0 and later.
• PersonalEnabled—End users can install the app as a canvas personal app. Available in API version 32.0 and later.

• IdpInitiated—Identity provider initiated. Salesforce makes the initial request to start the SSO flow.
• SpInitiated—Service provider initiated. The canvas app starts the SSO flow after it’s invoked.
• None—The canvas app isn’t using SAML SSO. Available in API version 31.0 and later.

In API version 32.0 and later, you can set this field’s value only during creation. After you define and save the value, it can’t be edited. The value must be alphanumeric, can’t contain special characters or spaces, and must be between 8 and 256 characters. Consumer keys must be globally unique.

The value must be alphanumeric (no special characters and no spaces) and a minimum of 8 characters (maximum of 256 characters). If you specify a secret already in use for another connected app in the organization, an error occurs.

Available in API version 32.0 and later.

If set to true, only users with the appropriate profile or permission set can access the app. These users don’t have to approve the app before they can access it. Manage profiles for the app by editing each profile’s Connected App Access list. Manage permission sets for the app by editing each permission set’s Assigned Connected App list. This setting isn’t available in Group Edition. Available in API version 46.0 and later.

If set to false (default), the connected app can’t use the client credentials flow.

Available in API version 56.0 and later.

If the client app can’t keep the client secret confidential and it must use the web server flow, set to true. A client secret is still generated for the connected app, but this setting instructs the web server flow not to require the client_secret parameter in the access token request. We recommend the user agent flow as a more secure option than web server flow without the secret. Available in API version 49.0 and later.

If set to false (default), the connected app can introspect its own tokens. In addition, an OAuth client that directly registers OAuth 2.0 connected apps through the dynamic client registration endpoint can check the tokens for itself and its registered apps. Available in API version 49.0 and later.

Select this option for web-server based apps that can protect client secrets. For apps that can’t protect client secrets, such as mobile apps or apps installed on a user’s computer, we recommend against selecting this option. Available in API version 51.0 and later.

To use this field, isClientCredentialEnabled must be set to true.

Available in API version 56.0 and later.

• Basic—Allows access to your identity URL service (the same behavior as deploying Address, Email, Phone, and Profile).
• Api—Allows access to the logged-in user’s account over the APIs.
• Web—Allows use of the access_token on the web. This usage also includes visualforce, allowing access to Visualforce pages.
• Full—Allows access to all data accessible by the logged-in user.
• Chatter—Allows access to only the Connect REST API resources.
• CustomApplications—Provides access to custom applications, such as those using Visualforce.
• RefreshToken—Allows a refresh token to be returned if you’re eligible to receive one (the same behavior as deploying OfflineAccess).
• OpenID—Allows access to the logged-in user’s unique identifier for OpenID Connect apps.
• Profile—Allows access to the logged-in user’s profile (the same behavior as deploying Basic).
• Email—Allows access to the logged-in user’s email address (the same behavior as deploying Basic).
• Address—Allows access to the logged-in user’s street address (the same behavior as deploying Basic).
• Phone—Allows access to the logged-in user’s phone number value (the same behavior as deploying Basic).
• OfflineAccess—Allows the app to interact with the user’s data while the user is offline and get a refresh token (the same behavior as deploying RefreshToken).
• CustomPermissions—Allows access to the custom permissions in an organization associated with the connected app and shows whether the current user has each permission enabled.
• Wave—Allows access to the Analytics REST API resources. Available in API version 35.0 and later.
• Eclair—Allows access to the Analytics REST API Charts Geodata resource. Available in API version 35.0 and later.
• Pardot—Allows access to Pardot API services on behalf of the user. The full extent of accessible services is managed by the Pardot account. Available in API version 49.0 and later.
• Lightning—Allows hybrid apps to directly obtain Lightning child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
• Content—Allows hybrid apps to directly obtain content child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
• CDPIngest—Allows access to Customer Data Platform ingest API services. Customers use these API services to upload and maintain external data sets in the Customer Data Platform. Available in API version 52.0 and later.
• Chatbot—Allows access to Einstein Bot API services. Available in API version 54.0 and later.

When retrieving metadata, valid values are:

• Api—Allows access to the logged-in user’s account over the APIs.
• Basic—Allows access to the user’s identity URL service, and includes Address, Email, Phone, and Profile.
• Chatter—Allows access to only the Connect REST API resources.
• CustomApplications—Allows access to custom applications, such as those using Visualforce.
• Full—Allows access to all data accessible by the logged-in user.
• OpenID—Allows access to the logged-in user’s unique identifier for OpenID Connect apps.
• CDPIngest—Allows access to Customer Data Platform ingest API services. Customers use these API services to upload and maintain external data sets in the Customer Data Platform. Available in API version 52.0 and later.
• Pardot—Allows access to Pardot API services on behalf of the user. The full extent of accessible services is managed by the Pardot account. Available in API version 49.0 and later.
• Lightning—Allows hybrid apps to directly obtain Lightning child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
• Content—Allows hybrid apps to directly obtain content child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
• RefreshToken—Allows a refresh token to be returned if you’re eligible to receive one and is synonymous with allowing OfflineAccess.
• Wave—Allows access to the Analytics REST API resources. Available in API version 35.0 and later.
• Eclair—Allows access to the Analytics REST API Charts Geodata resource. Available in API version 35.0 and later.
• Web—Allows usage of the access_token on the web. This usage also includes visualforce, allowing access to Visualforce pages.
• Chatbot—Allows access to Einstein Bot API services. Available in API version 54.0 and later.

• ENFORCE (default)—Enforces the IP restrictions configured for the org, such as the IP ranges assigned to a user profile.
• BYPASS_2FACTOR—Allows a user running the app to bypass the org’s IP restrictions when either of these conditions is true.
  • The app has a list of allowed IP ranges and is using the web server OAuth authorization flow. Requests coming from only these IPs are allowed.
  • The app doesn’t have a list of allowed IP ranges, but it uses the web server authentication flow. And the user successfully completes identity verification if accessing Salesforce from a new browser or device.
• BYPASS—Allows a user to run this app without org IP restrictions.
• ENFORCE_RELAXREFRESH—Enforces the IP restrictions configured for the org, such as the IP ranges assigned to a user profile. However, this option bypasses these restrictions when the connected app uses refresh tokens to get access tokens.

If refresh tokens are provided, users can continue to access the OAuth-enabled connected app without having to reauthorize when the access token expires, as defined by the session timeout value. The connected app exchanges the refresh token with an access token to start a new session. The Refresh Token policy is evaluated only during usage of the issued refresh token and doesn’t affect a user’s current session. Refresh tokens are required only when a user’s session has expired or isn’t available. For example, you set a refresh token policy to expire the token after 1 hour. If a user uses the app for 2 hours, the user isn’t forced to reauthenticate after 1 hour. However, the user is required to authenticate again when the session expires and the client attempts to exchange its refresh token for a new session.

SamlEncryptionType

• AES_128—128–bit key
• AES_256—256–bit key
• Triple_Des—Triple Data Encryption Algorithm

• PostBinding
• RedirectBinding

• Unspecified (default)—No format given.
• EmailAddress—Used if the subject type is the user’s name or a federation ID (an ID internal to the SP).
• Persistent—Used with the user ID and persistent ID subject types.
• Transient—Used when the subject type is a custom attribute and can change every time the user logs in.

• SHA1
• SHA256

• Username—The user’s Salesforce name.
• FederationId—The user’s identifier at the service provider. Get this value from the service provider.
• UserId—The user’s Salesforce identifier.
• PersistentID—A persistent opaque identifier that is specific to the identity provider and a service provider.
• CustomAttr—The identifier is taken from a custom field value in samlSubjectCustomAttr.

• Block—Makes the connected app inaccessible to your org’s users. Blocking an app ends all current user sessions with the connected app and prevents all new sessions.
• RaiseSessionLevel—Requires users to verify their identity with multi-factor authentication when they log in to the connected app. This setting applies to authorization flows that include a user approval step for API logins. These flows are the OAuth 2.0 refresh token flow, web server flow, and user-agent flow. All other flows, such as the JSON Web Token (JWT) bearer token flow, don’t include a user approval step. For flows without a user approval step, API logins with the High Assurance session security level are blocked.