Overview
This page defines the minimum permission set required by the integration/API user, the dedicated Salesforce account, the Salesforce↔CloudFiles integration authenticates and runs as. It also highlights the reasoning behind why each one is needed.
System Permissions
On the Salesforce Permission Set / Profile UI, these five permissions all live under the System Permissions category.
| Permission (Salesforce UI label) | Why it's needed |
|---|---|
API Enabled (ApiEnabled) | This is the standard permission required for any external system to access Salesforce data through the API at all. Without it, API calls from the integration are rejected outright, before any other permission or object/field access is even considered. |
Modify Metadata Through Metadata API Functions (ModifyMetadata) | Needed to build the customer-side flows and automations that CloudFiles sets up as part of your specific implementation. |
Use Any API Client Application (UseAnyApiAuth) | Allows the integration user to authenticate via the API without being restricted to a specific, pre-whitelisted connected/client application — necessary because the integration authenticates as its own API client. |
View Roles and Role Hierarchy (ViewRoles) | Automatically bundled in by Salesforce when Modify Metadata Through Metadata API Functions is granted — it comes along as a dependency, not something you enable separately. |
View Setup and Configuration (ViewSetup) | Automatically bundled in by Salesforce when Modify Metadata Through Metadata API Functions is granted — it comes along as a dependency, not something you enable separately. |
Apex Class Access
Separately, under the Apex Class Access category, the integration/API user needs access to essentially all of the CloudFiles managed package's Apex classes — these are the controllers that power the integration, so the account needs to be able to invoke them.
Object Level Access
On the Salesforce Permission Set UI, under Object Permissions, the integration/API user's permission set grants Object CRUD on the two objects the integration uses internally to track and process events.
| Object | Access |
|---|---|
cldfs__CloudFilesEvent__c (custom object) | Create, Read, Edit, Delete, View All Records, Modify All Records — full object-level access. |
cldfs__CloudFiles_Event__e (platform event) | Create, Read only. |
For organizations who are using the Document AI product, their integration user will need access on one additional object listed below:
| Object | Access |
|---|---|
cldfs__CloudFiles_DocAI_Run__c (custom object) | Create, Read, Edit, Delete, View All Records, Modify All Records — full object-level access. |
Under Field-Level Security, the permission set also grants Read and Edit access on the following fields of cldfs__CloudFilesEvent__c, which the integration reads from and writes to as it processes events:
| Field | Access |
|---|---|
cldfs__CloudFilesEvent__c.cldfs__Data__c | Read, Edit |
cldfs__CloudFilesEvent__c.cldfs__Object_Type__c | Read, Edit |
cldfs__CloudFilesEvent__c.cldfs__Request_Id__c | Read, Edit |
cldfs__CloudFilesEvent__c.cldfs__Type__c | Read, Edit |