Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.1.0
info:
title: Salesforce
description: 'Find the resources you need to start building. '
contact: {}
version: '1.0'
jsonSchemaDialect: https://json-schema.org/draft/2020-12/schema
servers:
- url: https://login.salesforce.com
variables: {}
- url: https://id
variables: {}
- url: https://services
variables: {}
- url: '{{url}}{{site}}/services/oauth2'
variables:
url:
default: DefaultParameterValue
site:
default: DefaultParameterValue
paths:
/services/auth/headless/init/registration:
post:
tags:
- Initialize
- Registration
summary: Salesforce Registration - Initialize
description: >-
Submits the registration data to the init/registration endpoint and
returns a request identifier. At the same time, an OTP is sent out to
the end users via email or sms. Registration data is passed in the
request body, and is formatted with JSON, with 5 keys: `userdata`,
`customdata`, `password`, `recaptcha`, and `verificationmethod`. The
first two keys are JSON structures, and the last 3 keys are strings.
This request returns JSON, and includes an identifier (request
identifier).
operationId: Registration-Initialize
parameters: []
requestBody:
description: ''
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/Registration-InitializeRequest'
- examples:
- userdata:
firstName: userFirstName
lastName: userLastName
email: <email>
username: <username>
customdata:
mobilePhone: '+12035408967'
streetAddress: 12 N Lands End Rd
city: Lantana
state: Florida
zip: '20537'
privacyPolicy: true
password: Test123!
recaptcha: <recaptcha-token>
verificationmethod: email
contentMediaType: application/json
example:
userdata:
firstName: userFirstName
lastName: userLastName
email: <email>
username: <username>
customdata:
mobilePhone: '+12035408967'
streetAddress: 12 N Lands End Rd
city: Lantana
state: Florida
zip: '20537'
privacyPolicy: true
password: Test123!
recaptcha: <recaptcha-token>
verificationmethod: email
required: true
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/oauth2/authorize:
post:
tags:
- Authorize
- Registration
summary: Salesforce Registration - Authorize
description: >-
After you send your registration data to initialize, this request allows
you to process that registration data, and as a part of this request you
also verify the users email or sms number. The request itself is a
authorization call for the Code and Credential flow. It includes 3
specific headers: `Auth-Request-Type` which is set to
`user-registration`, `Auth-Verification-Type` which is set to email or
sms, and an Authorization Basic header, which is the base 64 encoded
result of `identifier:otp` where `identifier` is the value returned in
your initialize registration call, and `otp` is the value sent to the
end user via email or sms.
The response from this API is the Auth Code, which is then exchanged for
the Access Token.
operationId: Registration-Authorize
parameters:
- name: Auth-Request-Type
in: header
description: Required for User Registration
required: true
schema:
type: string
examples:
- user-registration
example: example_value
- name: Auth-Verification-Type
in: header
description: Must match init/registration, email or sms
required: true
schema:
type: string
examples:
- email
example: example_value
- name: Authorization
in: header
description: Base64 encoded <Identifier:OTP>
required: true
schema:
type: string
examples:
- Basic <base64Encoded identifier:otp>
example: example_value
requestBody:
content:
application/x-www-form-urlencoded:
encoding: {}
schema:
required:
- response_type
- client_id
- redirect_uri
- scope
type: object
properties:
response_type:
type: string
examples:
- code_credentials
client_id:
type: string
examples:
- '{{vault:salesforce-consumer-key}}'
redirect_uri:
type: string
scope:
type: string
description: Comma seperated list of scopes, optional
contentMediaType: application/x-www-form-urlencoded
examples:
RegistrationAuthorizeRequestExample:
summary: Default Registration-Authorize request
x-microcks-default: true
value:
response_type: example_value
client_id: '500123'
redirect_uri: example_value
scope: example_value
required: false
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
get:
tags:
- Agent
- Flow
- Users
summary: Salesforce User Agent Flow
operationId: UserAgentFlow
parameters:
- name: response_type
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
examples:
- token
example: example_value
- name: client_id
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
examples:
- '{{vault:salesforce-consumer-key}}'
example: '500123'
- name: redirect_uri
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
example: example_value
- name: display
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
examples:
- touch
example: example_value
- name: login_hint
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
example: example_value
- name: nonce
in: query
description: ''
required: true
style: form
explode: true
schema:
type: string
examples:
- awesome
example: example_value
responses:
'200':
description: OK
headers:
Strict-Transport-Security:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: max-age=63072000; includeSubDomains
X-Content-Type-Options:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: nosniff
X-XSS-Protection:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: 1; mode=block
Content-Security-Policy:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: upgrade-insecure-requests
X-Robots-Tag:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: none
Cache-Control:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: must-revalidate,no-cache,no-store
Vary:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: Accept-Encoding
Content-Encoding:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: gzip
Connection:
content:
text/plain:
schema:
type: string
contentMediaType: text/plain
example: close
content:
text/html; charset=UTF-8:
schema:
type: string
examples:
- >2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01
Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<script>
function redirectOnLoad() {
if (this.SfdcApp && this.SfdcApp.projectOneNavigator) {
SfdcApp.projectOneNavigator.handleRedirect('<my-domain>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch');
} else
if (window.location.replace){
window.location.replace('<my-domain>>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch');
} else {
window.location.href
='<my-domain>>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch';
}
}
redirectOnLoad();
</script>
</head>
</html>
<!-- Body events -->
<script type="text/javascript">function
bodyOnLoad(){if(window.PreferenceBits){window.PreferenceBits.prototype.csrfToken="null";};}function
bodyOnBeforeUnload(){}function bodyOnFocus(){}function
bodyOnUnload(){}</script>
</body>
</html>
<!--
...................................................................................................
...................................................................................................
...................................................................................................
...................................................................................................
-->
contentMediaType: text/html; charset=UTF-8
example: >2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<script>
function redirectOnLoad() {
if (this.SfdcApp && this.SfdcApp.projectOneNavigator) {
SfdcApp.projectOneNavigator.handleRedirect('<my-domain>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch');
} else
if (window.location.replace){
window.location.replace('<my-domain>>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch');
} else {
window.location.href
='<my-domain>>?ec=302&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3D<token>%26display%3Dtouch&display=touch';
}
}
redirectOnLoad();
</script>
</head>
</html>
<!-- Body events -->
<script type="text/javascript">function
bodyOnLoad(){if(window.PreferenceBits){window.PreferenceBits.prototype.csrfToken="null";};}function
bodyOnBeforeUnload(){}function bodyOnFocus(){}function
bodyOnUnload(){}</script>
</body>
</html>
<!--
...................................................................................................
...................................................................................................
...................................................................................................
...................................................................................................
-->
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/oauth2/token:
post:
tags:
- Exchange
- Registration
- Tokens
summary: Salesforce Registration - Token Exchange
description: >-
This exchanges the auth code returned in the Authorize Request for an
access token and refresh token. This follows the standard Auth Code
flow/Webserver Code Flow pattern. The Code is the return form the
Authorization call.
operationId: Registration-TokenExchange
parameters: []
requestBody:
content:
application/x-www-form-urlencoded:
encoding: {}
schema:
required:
- code
- grant_type
- client_id
- redirect_uri
type: object
properties:
code:
type: string
description: Auth Code from the Authorize response
examples:
- <code>
grant_type:
type: string
examples:
- authorization_code
client_id:
type: string
examples:
- '{{vault:salesforce-consumer-key}}'
redirect_uri:
type: string
contentMediaType: application/x-www-form-urlencoded
examples:
RegistrationTokenexchangeRequestExample:
summary: Default Registration-TokenExchange request
x-microcks-default: true
value:
code: example_value
grant_type: example_value
client_id: '500123'
redirect_uri: example_value
required: false
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/auth/headless/forgot_password:
post:
tags:
- Initialize
- Password
summary: Salesforce Forgot Password - Initialize
operationId: ForgotPassword-Initialize
parameters: []
requestBody:
description: ''
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/ForgotPassword-InitializeRequest'
- examples:
- username: <username>
recaptcha: <recaptcha token>
contentMediaType: application/json
example:
username: <username>
recaptcha: <recaptcha token>
required: true
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/auth/headless/init/passwordless/login:
post:
tags:
- Initialize
- Login
summary: Salesforce Passwordless Login - Initialize
description: >-
Submits the passwordless login data to the init/passwordless/login
endpoint and returns a request identifier. At the same time, an OTP is
sent out to the end users via email or sms. Passwordless login data is
passed in the request body, and is formatted with JSON, with 3 keys:
`username`, `recaptcha`, and `verificationmethod`. All 3 keys are
strings.
This request returns JSON, and includes an identifier (request
identifier).
operationId: PasswordlessLogin-Initialize
parameters: []
requestBody:
description: ''
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/PasswordlessLogin-InitializeRequest'
- examples:
- username: <username>
recaptcha: <recaptcha-token>
verificationmethod: email or sms
contentMediaType: application/json
example:
username: <username>
recaptcha: <recaptcha-token>
verificationmethod: email or sms
required: true
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/oauth2/userinfo:
get:
tags:
- Get
- Info
- Users
summary: Salesforce Get User Info
description: >-
This requests uses an access token to get user information from
Salesforce using the standard `/userinfo` endpoint.
operationId: GetUserInfo
parameters:
- name: Authorization
in: header
description: Replace <token> with your access token
required: true
schema:
type: string
examples:
- Bearer <Token>
example: example_value
- name: Content-Type
in: header
description: ''
required: true
schema:
const: application/json
type: string
examples:
- application/json
example: example_value
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/oauth2/revoke:
post:
tags:
- Revoke
- Tokens
summary: Salesforce Revoke Token
description: >-
This calls the standard revoke endpoint, passing in your access token.
This endpoint should be called as part of your logout process to
invalidate the access and refresh token.
operationId: RevokeToken
parameters: []
requestBody:
content:
application/x-www-form-urlencoded:
encoding: {}
schema:
required:
- token
type: object
properties:
token:
type: string
description: Replace with a valid access token or refresh token.
contentMediaType: application/x-www-form-urlencoded
examples:
RevoketokenRequestExample:
summary: Default RevokeToken request
x-microcks-default: true
value:
token: CAUQAA
required: false
responses:
'200':
description: ''
headers: {}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/data/v64.0/apps/oauth/usage:
get:
tags:
- Oauth
- Usage
summary: Salesforce Oauth Usage
description: "Lists all the external client apps for the current org. See [OAuth Usage](https://developer.salesforce.com/docs/atlas.en-us.246.0.chatterapi.meta/chatterapi/connect_resources_usage.htm)."
operationId: OAuthUsage
parameters:
- name: page
in: query
description: >-
Number of the page you want returned. Starts at 0. If you don’t
specify a value or if you specify 0, the first page is returned.
required: true
style: form
explode: true
schema:
type: integer
contentEncoding: int32
examples:
- 0
example: 10
- name: pageSize
in: query
description: Number of usage entries per page. Defaults to 100.
required: true
style: form
explode: true
schema:
type: integer
contentEncoding: int32
examples:
- 100
example: 10
- name: Authorization
in: header
description: Replace <token> with your access token
required: true
schema:
type: string
examples:
- Bearer <token>
example: example_value
responses:
default:
description: ''
headers: {}
content:
text/plain:
schema:
type: string
examples:
- |-
{
"apps": [
{
"accessTokenFormat": "<accessTokenFormat>",
"availableActions": "disable, enable",
"description": "<description>",
"developerName": "<developerName>",
"identifier": "<identifier>",
"isFromPackage": bool,
"usageDetailsUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users"
}
],
"currentPageUrl": "/services/data/<version>/apps/oauth/usage?page=0&pageSize=100",
"nextPageUrl": "/services/data/<version>/apps/oauth/usage?page=1&pageSize=100"
}
contentMediaType: text/plain
example: |-
{
"apps": [
{
"accessTokenFormat": "<accessTokenFormat>",
"availableActions": "disable, enable",
"description": "<description>",
"developerName": "<developerName>",
"identifier": "<identifier>",
"isFromPackage": bool,
"usageDetailsUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users"
}
],
"currentPageUrl": "/services/data/<version>/apps/oauth/usage?page=0&pageSize=100",
"nextPageUrl": "/services/data/<version>/apps/oauth/usage?page=1&pageSize=100"
}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/data/v64.0/apps/oauth/usage//users:
get:
tags:
- Applications
- Oauth
- Users
summary: Salesforce Oauth App Users
description: "Lists all users for the external client app indicated by the app ID. See [OAuth Users by App ID](https://developer.salesforce.com/docs/atlas.en-us.246.0.chatterapi.meta/chatterapi/connect_resources_usage_app_id_users.htm)."
operationId: OAuthAppUsers
parameters:
- name: page
in: query
description: Page number for the usage information. Defaults to 0.
required: true
style: form
explode: true
schema:
type: integer
contentEncoding: int32
examples:
- 0
example: 10
- name: pageSize
in: query
description: Number of usage entries per page. Defaults to 100.
required: true
style: form
explode: true
schema:
type: integer
contentEncoding: int32
examples:
- 100
example: 10
- name: Authorization
in: header
description: Replace <token> with your access token
required: true
schema:
type: string
examples:
- Bearer <token>
example: example_value
responses:
default:
description: ''
headers: {}
content:
text/plain:
schema:
type: string
examples:
- |-
{
"currentPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users?page=0&pageSize=100",
"nextPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users?page=1&pageSize=100",
"users": [
{
"accessTokenFormat": "<accessTokenFormat>",
"appDeveloperName": "<appDeveloperName>",
"appIdentifier": "<identifier>",
"initialConnectionAt": "<timestamp>",
"lastUsedAt": "<timestamp>",
"revocationUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/<userIdentifier>/tokens",
"useCount": integer,
"userIdentifier": "<userIdentifier>",
"username": "<username>"
}
]
}
contentMediaType: text/plain
example: |-
{
"currentPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users?page=0&pageSize=100",
"nextPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/users?page=1&pageSize=100",
"users": [
{
"accessTokenFormat": "<accessTokenFormat>",
"appDeveloperName": "<appDeveloperName>",
"appIdentifier": "<identifier>",
"initialConnectionAt": "<timestamp>",
"lastUsedAt": "<timestamp>",
"revocationUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/<userIdentifier>/tokens",
"useCount": integer,
"userIdentifier": "<userIdentifier>",
"username": "<username>"
}
]
}
deprecated: false
security: []
servers:
- url: https://login.salesforce.com
variables: {}
x-api-evangelist-processing:
PascalCaseOperationSummaries: true
ChooseTags: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
parameters: []
/services/data/v64.0/apps/oauth/usage///tokens:
get:
tags:
- Applications
- Oauth
- Tokens
- Users
summary: Salesforce Oauth App Users Tokens
description: "Lists all tokens for a user of the external client app. See [Refresh Token by User and App](https://developer.salesforce.com/docs/atlas.en-us.246.0.chatterapi.meta/chatterapi/connect_resources_usage_app_id_user_id_tokens.htm)."
operationId: OAuthAppUsersTokens
parameters:
- name: Authorization
in: header
description: Replace <token> with your access token
required: true
schema:
type: string
examples:
- Bearer <token>
example: example_value
responses:
default:
description: ''
headers: {}
content:
text/plain:
schema:
type: string
examples:
- |-
{
"currentPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/<userIdentifier>/tokens",
"tokens": [
{
"accessTokenFormat": "<accessTokenFormat>",
"appDeveloperName": "<appDeveloperName>",
"appIdentifier": "<identifier>",
"initialConnectionAt": "<timestamp>",
"lastUsedAt": "<timestamp>",
"revocationUrl": "/services/data/<version>/apps/oauth/usage/tokens/<tokenIdentifier>",
"useCount": integer,
"userIdentifier": "<userIdentifier>",
"username": "<username>"
}
]
}
contentMediaType: text/plain
example: |-
{
"currentPageUrl": "/services/data/<version>/apps/oauth/usage/<identifier>/<userIdentifier>/tokens",
"tokens": [
{
"accessTokenFormat": "<accessTokenFormat>",
"appDeveloperName": "<appDeveloperName>",
"appIdentifier": "<identifier>",
"initialConnectionAt": "<timestamp>",
"lastUsedAt": "<timestamp>",
"revocationUrl": "/services/data/<version>/apps/oauth/usage/tokens/<tokenIdentifier>",
"useCount": integer,
"userIdentifier": "<userIdentifier>",
"username
# --- truncated at 32 KB (9004 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/salesforce/refs/heads/main/openapi/_original/salesforce-openapi.yml