OauthCustomScope

Represents a permission defining the protected data that a connected app can access from an external entity when Salesforce is the OAuth authorization provider.

This type extends Metadata and inherits its fields.

OauthCustomScope components have the suffix .oauthcustomscope and are stored in the oauthcustomscopes directory.

OAuth custom scopes are available in API version 46.0 and later.

You must have the “Manage Connected Apps” permission to access this object.

• Type: OauthCustomScopeApp[]
• Required: No
• Introduced: API version 49.0
• Description: Represents the name of the connected app to which the custom scope is assigned. If the connected app is part of a package, include the package’s namespace prefix with the connected app’s name. Use the following format: <namespace_prefix>__<connected_app>. Use two underscores (_) between the namespace prefix and connected app’s name.

• Type: string

• Required: Yes

• Description: Required. The description of the permission provided to the connected app by the scope. The custom scope’s description must be unique, can only include alphanumeric characters, and can be up to 60 characters long.

  You can enter a custom label in place of a description. An advantage of using a custom label is that you can maintain reusable text in a single location and translate the text into multiple languages. See Custom Labels.

• Type: string
• Required: Yes
• Description: Required. Use when referring to the OAuth custom scope from a program.

• Type: boolean
• Required: No
• Description: Required. Indicates whether this component is protected () or not (false). Protected components cannot be linked to or referenced by components created in the installing org.

• Type: boolean
• Required: No
• Description: Indicates whether the object is included in the connected app’s OpenID Connect discovery endpoint. The default setting is false. For more information, see OpenID Connect Discovery Endpoint.

• Type: string
• Required: Yes
• Description: Required. The primary label for the custom scope record. This label must be unique and begin with a letter. It can include only alphanumeric characters and underscores. It can’t contain spaces.

• Type: string
• Required: Yes

The following is an example of an OAuthCustomScope component. In this example, basicScope is the name of custom scope entity being retrieved.

1<?xml version="1.0" encoding="UTF-8"?>
2<OauthCustomScope xmlns="http://soap.sforce.com/2006/04/metadata">
3    <assignedTo>
4        <connectedApp>MyOrgNamespace__TestApp</connectedApp>
5    </assignedTo>
6    <description>Example of a basic custom scope</description>
7    <developerName>basicScope</developerName>
8    <masterLabel>basicScope</masterLabel>
9    <isProtected>false</isProtected>
10    <isPublic>true</isPublic>
11</OauthCustomScope>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3<types>
4<members>basicScope</members>
5<name>OauthCustomScope</name>
6</types>
7<version>49.0</version>
8</Package>

An OAuth custom scope tells an external entity about a connected app’s permissions to access protected data. The OAuth custom scope you create in your Salesforce org corresponds to the same custom scope defined in your external entity and assigned to the resource.

For example, you define an Order Status custom scope in your external entity that allows access to customer order status data in your order system’s API. In Salesforce, you create an OAuth custom scope that you also name Order Status. You assign this custom scope to the connected app requesting access to the order status API. When the external entity receives the connected app’s request to access a customer’s order status, it validates the connected app’s access token and Order Status scope. With a successful validation, the app can access the customer order status information in the order system’s API.

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.