Salesforce

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads accounts, opportunities, cases (with their comments) and published Knowledge articles from a Salesforce org, so commercial and service agents can answer from the account and case history. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Salesforce, version 1.0.0
Reads	Salesforce: Sales Cloud and Service Cloud (REST API, SOQL) (the vendor's documentation)
Family	CRM
Kind	CRM
Ways to connect	OAuth approval
Scopes	Read: api
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	Contact, Content
Hosts it may contact	{org}.my.salesforce.com, {org}.sandbox.my.salesforce.com, login.salesforce.com, test.salesforce.com
Vendor API versions	REST API v61.0
Lowest engine version	0.46.0

What it reads

• Accounts: name, type, industry, website, billing city and country, description.
• Opportunities: name, account name, stage, amount, close date, probability, type, next step, description.
• Cases: case number, subject, account name, status, priority, origin, type, description, and every comment on the case.
• Knowledge articles: published (Online) versions only: title, article number, summary, URL name, language, last published date, and any rich-text fields you name in knowledge_fields. One document per article; a new version replaces the old one.
• Only the objects you name in objects (accounts, opportunities, cases, knowledge). A whole org is never the default.
• Changes only: each object is queried by SystemModstamp after the last cursor, oldest first, and paged by nextRecordsUrl.

It does not read attachments, files, or any object you do not name.

How to connect

1. In Salesforce, make a connected app with a digital certificate and the api scope, and pre-authorise the integration user for it.
2. Give that user a read-only permission set over Account, Opportunity, Case and your Knowledge object.
3. In LightHouse, open Setup and admin, Connectors, choose Salesforce, and give instance_url (your My Domain, https://<name>.my.salesforce.com; a sandbox is https://<name>.sandbox.my.salesforce.com), username and objects.
4. Paste the connected app’s consumer key, then the PEM of the private key. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (SALESFORCE_CREDENTIAL by default) with instance_url, client_id, username and certificate. The deployment signs a two-minute assertion with the key (the OAuth 2.0 JWT bearer flow, RFC 7523) and Salesforce answers a session token. No client secret and no password exist anywhere, and the key never leaves your account.

Permissions

• Scope requested: api. Salesforce has no read-only OAuth scope: api lets the user’s own permissions decide, so read-only is the integration user’s profile, not something the scope can enforce.
• What the collector does: GET queries, plus one POST to /services/oauth2/token for the session token. It issues SOQL SELECT statements only. Its read-only test proves that on every change.
• One host: the token is asked for at the org’s own My Domain and every read goes there. An answer that names another instance is refused before anything is read, and the fetcher refuses any URL off that host. The two Salesforce login addresses (login.salesforce.com, test.salesforce.com) appear only as the audience of the signed assertion and are never contacted.

Limits

• instance_url must be a My Domain: https://<name>.my.salesforce.com (optionally .sandbox., .develop. or .scratch. before .my.).
• Targets REST API v61.0.
• Batches of 200 to 2,000 records (page_size, default 2,000). Reads count against your org’s daily API allowance.
• Deletions are found by listing ids every six hours; a deleted record or an archived article is removed from the corpus then, not at once.
• A refused or failed page fails the pull, which tries again on the next run and never advances the cursor past what it did not read.
• Knowledge: set knowledge_object if yours is not Knowledge__kav.

Data handling

• Records contain personal data (people’s names, account and case text). Documents carry the label you give the source.
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.
• The private key is used only to sign the assertion. It is never put in a request, a log line or an error message.

Troubleshooting

What you see	What it means	What to do
credential variable 'SALESFORCE_CREDENTIAL' is not set	The deployment holds no credential for this source	Connect Salesforce again in LightHouse
the salesforce credential has no client_id	The credential lacks a field (named in the message)	Re-enter it with all four fields
instance_url is https://<name>.my.salesforce.com	The URL is not a My Domain	Use your My Domain, not login.salesforce.com
the Salesforce certificate holds no readable private key	The PEM is not an unencrypted private key	Paste the PEM of the key, without a passphrase
Salesforce answered no session token	The connected app or user was refused	Check the certificate on the connected app and the user’s pre-authorisation
Salesforce answered for another instance; nothing was read	The token came from a different org	Check instance_url is the org the app belongs to
HTTP 403 or HTTP 404 on a listing	The user cannot see that object	Give the user read access; the deletion check is skipped meanwhile

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	REST API v61.0	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only