External Credential

PUT and DELETE are available in version 58.0 and later.

JSON example for creating an external credential (POST)

1{
2   "developerName": "SampleAws",
3   "masterLabel": "SampleAwsLabel",
4   "authenticationProtocol": "AwsSv4",
5   "authenticationProtocolVariant": "AwsSv4_STS",
6   "parameters": [
7      {
8         "parameterName": "AwsService",
9         "parameterType": "AuthParameter",
10         "parameterValue": "dynamodb"
11      },
12      {
13         "parameterName": "AwsRegion",
14         "parameterType": "AuthParameter",
15         "parameterValue": "us-west-2"
16      },
17      {
18         "parameterName": "AwsAccountId",
19         "parameterType": "AuthParameter",
20         "parameterValue": "sampleAccountId"
21      },
22      {
23         "parameterName": "AwsStsExternalId",
24         "parameterType": "AuthProviderUrlQueryParameter",
25         "parameterValue": "sampleExternalId"
26      },
27      {
28         "parameterName": "AwsStsDuration",
29         "parameterType": "AuthProviderUrlQueryParameter",
30         "parameterValue": "1000"
31      }
32   ],
33   "principals": [
34      {
35         "principalName": "SamplePrincipal",
36         "principalType": "NamedPrincipal",
37         "sequenceNumber": 1
38      }
39   ],
40   "customHeaders": [
41      {
42         "headerName": "SampleHeader",
43         "headerValue": "SampleHeaderValue",
44         "sequenceNumber": 1
45      }
46   ]
47}

JSON example for updating an external credential (PUT)

1{
2   "developerName": "SampleOAuth",
3   "masterLabel": "SampleOAuthLabel",
4   "authenticationProtocol": "OAuth",
5   "authenticationProtocolVariant": "JwtBearer",
6   "parameters": [
7      {
8         "id": "0puxxxxxxxxxxxxxxx",
9         "parameterName": "SigningCertificate",
10         "parameterType": "SigningCertificate",
11         "parameterValue": "SampleCertificate"
12      },
13      {
14         "parameterName": "AuthProviderUrl",
15         "parameterType": "AuthProviderUrl",
16         "parameterValue": "www.identityprovider.com"
17      },
18      {
19         "parameterDescription": "Expiration Time",
20         "parameterName": "exp",
21         "parameterType": "JwtBodyClaim",
22         "parameterValue": "{!Text(FLOOR((NOW() - DATETIMEVALUE( \"1970-01-01 00:00:00\" )) * 86400 + 120))}"
23      },
24      {
25         "parameterName": "Scope",
26         "parameterType": "AuthParameter",
27         "parameterValue": "SampleScope"
28      }
29   ],
30   "principals": [
31      {
32         "principalName": "SamplePerUserPrincipal",
33         "principalType": "PerUserPrincipal",
34         "sequenceNumber": 1,
35         "parameters": [
36            {
37               "parameterName": "Scope",
38               "parameterType": "AuthParameter",
39               "parameterValue": "SamplePrincipalGroupScope"
40            }
41         ]
42      }
43   ],
44   "customHeaders": [
45      {
46         "headerName": "SampleHeader",
47         "headerValue": "SampleHeaderValue",
48         "sequenceNumber": 1
49      }
50   ]
51}

Properties

Name	Type	Description	Required or Optional	Available Version
authentication​Protocol	String	Authentication protocol of the external credential. Values are: AwsSv4 Basic Custom Jwt OAuth	Required	58.0
authentication​ProtocolVariant	String	Authentication protocol variant of the external credential. Values are: AwsSv4_STS—AWS Signature Version 4 with Security Token Service. ClientCredentialsClientSecret—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s request body. ClientCredentialsClientSecretBasic—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s authorization header, as with Basic authentication. ClientCredentialsJwtAssertion—OAuth 2.0 Client Credentials JSON Web Token assertion. JwtBearer—OAuth 2.0 JSON Web Token bearer flow. NoAuthentication—No authentication. RolesAnywhere—AWS Signature Version 4 with Identity and Access Management (IAM) Roles Anywhere. If specified, the authentication protocol variant must match the actual protocol variant of the external credential.	Optional	58.0
customHeaders	Credential Custom Header Input[]	List of credential custom headers.	Optional	58.0
developerName	String	Fully qualified developer name of the external credential.	Required for POST Optional for PUT	58.0
masterLabel	String	External credential label.	Required	58.0
parameters	External Credential Parameter Input[]	List of external credential parameters.	Optional depending on authenticationProtocol and authenticationVariant	58.0
principals	External Credential Principal Input[]	List of principals the credential has.	Optional	58.0