Introduction
The CloudFiles: Unlock Document flow action removes the protection from a PDF from a Salesforce flow and saves an unlocked copy. The original file is left as it was.
Use it when a client sends a password-protected PDF that your team, or a later step such as Document AI, cannot open. The PDF can be a Salesforce File or a file in connected external storage.
What this action does
The action reads the PDF in Source, removes its encryption and saves the result as a new file. It runs synchronously, so its outputs are available to the next element in the flow.
Unlocking removes everything at once: the password needed to open the PDF, the password that controls editing, and every restriction on printing, form filling and editing. There is no option to keep some of them.
A PDF that only restricts editing, and opens without a password, is unlocked without one. A PDF that is not protected at all is still copied, and Was Protected comes back False.
This action makes an external callout, so a record-triggered flow cannot run it in a path that runs immediately. Add a Run Asynchronously path to the flow and place the action there.
Input Parameters
In Flow Builder, add an Action element, search for “CloudFiles: Unlock Document” in the CloudFiles category, and select it. Then configure the inputs below.
| Parameter | Type | Description |
|---|---|---|
| Source | cldfs__Resource | The PDF to unlock. |
| Password (Optional) | Text | The password that opens the PDF. |
| Destination (Optional) | cldfs__Resource | Where to save the unlocked copy. Empty saves it next to the Source. |
| File Name (Optional) | Text | The name of the unlocked copy. Empty keeps the Source's name. |
| Context (Optional) | Text | Any text, passed back in the Document Unlocked event and in the Error Event for a failure. |
Source
The PDF to unlock, as an Apex-defined variable of class cldfs__Resource. Create the variable in the Toolbox (New Resource, Resource Type Variable, Data Type Apex-Defined, Apex Class cldfs__Resource), set its values in an Assignment element, and pass it to Source. Parameter names are case sensitive.
To unlock a Salesforce File:
- library -
salesforce - id - The ContentDocumentId of the file.
To unlock a file in external storage:
- library - The storage type, for example
sharepointorgoogle. - driveId - The id of the drive the file is in.
- id - The id of the file.
Password (Optional)
The password that opens the PDF. The PDF's editor password works too. Leave it empty when the PDF opens without a password.
If the PDF needs a password and none is given, the action returns PASSWORD_REQUIRED. If the password is wrong, it returns WRONG_PASSWORD. Passwords are used exactly as given, spaces included.
Destination (Optional)
Where the unlocked copy is saved, as a cldfs__Resource.
- Empty - The copy is saved next to the Source. A Salesforce File's copy is linked to the same records as the original. A file in external storage is saved in the same folder.
- A folder or a record - The copy is saved there. For Salesforce, set library to
salesforceand id to the Id of the record the copy should be attached to. For external storage, set library, driveId and the folder's id. - A file - Set type to
fileas well, and that file is overwritten with the unlocked copy. A Salesforce File gets a new version and keeps its links. Leave File Name empty in this case, or the action returnsINVALID_INPUT.
To unlock the original file itself rather than save a copy, pass the Source again as the Destination with type set to file.
A Salesforce File that is not linked to any record cannot be unlocked with an empty Destination, because nobody else could see the copy. The action returns INVALID_INPUT. Set a Destination for these files.
File Name (Optional)
The name of the unlocked copy. Leave it empty to keep the Source's name. A name without an extension gets .pdf added.
If the folder already holds a file with that name, the copy is either saved under a new name, with Renamed On Conflict set to True, or not saved, with Error Code set to NAME_CONFLICT. Which one happens depends on the storage and its file conflict setting in CloudFiles. Salesforce Files can hold two files with the same name, so there the copy is saved alongside the existing file.
Context (Optional)
Any text you want back in the Document Unlocked event, and in the Error Event when a PDF fails, for example the Id of the record that started the flow. A flow that listens for CloudFiles Events can use it to tell which run the event came from. Read it with Get Event Details.
Output Parameters
The action returns these values to the flow:
- File (cldfs__Resource) - The saved copy: its id (the ContentDocumentId for a Salesforce File), name, library and driveId.
- File URL (Text) - A link to the saved copy. For a Salesforce File it opens the file's page in Lightning.
- Was Protected (Boolean) - Whether the Source was protected.
Falsemeans the copy is the same as the original. - Renamed On Conflict (Boolean) -
Truewhen the copy was saved under a different name because the name was taken. - Error Code (Text) - Empty when the copy was saved. Otherwise one of the codes below.
- Error Message (Text) - What went wrong, starting with the error code.
A failed file does not stop the flow. Add a Decision after the action that checks Error Code: when it is empty the copy was saved, and when it is not, File and File URL are empty.
| Error Code | When it happens |
|---|---|
| INVALID_INPUT | Source is empty or a folder, File Name is set with a file Destination, or a Salesforce File with an empty Destination is not linked to any record. |
| PASSWORD_REQUIRED | The PDF needs a password to open and Password is empty. |
| WRONG_PASSWORD | Password does not open the PDF. |
| NOT_A_PDF | The Source is not a valid PDF. |
| UNSUPPORTED_ENCRYPTION | The PDF is protected in a way that cannot be removed, such as with a certificate instead of a password. |
| FILE_TOO_LARGE | The Source is larger than 450 MB. |
| FILE_NOT_FOUND | The Source or the Destination does not exist. |
| ACCESS_DENIED | The integration user cannot reach the file, the folder or the storage connection. |
| NAME_CONFLICT | A file with the same name already exists in the folder and the copy could not be renamed. |
| STORAGE_WRITE_FAILED | The unlocked copy could not be saved. Safe to retry. |
| INTERNAL_ERROR | Something unexpected went wrong. Safe to retry. |
Each saved copy also raises a Document Unlocked event carrying File, Was Protected and your Context. A failure raises an Error Event with ErrorEventType document-unlocked, carrying the Error Code. Both can be read with Get Event Details.
CloudFiles never writes the password to its logs, error messages or events. A password typed directly into the action is saved in the flow, though, so anyone who can open the flow can read it.
See it in action
Here is a flow that unlocks a protected contract attached to an Account, using the password the client shared.
ContentDocumentLink, filtered on LinkedEntityId Equals the Account Id, returns the contract's ContentDocumentId.cldfs__Resource variable's library to salesforce and its id to the ContentDocumentId.Contract (unlocked).pdf. Destination is left empty, so the copy is attached to the same Account.The unlocked copy appears on the Account next to the original and opens without a password.
