Is there an API Name for the field "User Password expires in" under Password Policies?

Question

I am doing a flow that will notify users when their passwords are about to expire in SF. I have to subtract 7 from the number I set in "User Password expires in" as apart of that automation. Is there a way i can call that field with an API name and do a formula by subtracting 7 so If I change that field to 60 I wont have to hardcode the number in the flow?

Answer 1

I'm not sure whether it's possible to extract that information from Password Policies but in case you can't do that, I'd recommend using Custom Metadata Types.

It's possible to use them in Flows and it's explained in the Use Custom Metadata Types in Flow Unit of the Custom Metadata Types Basics.

You could for instance create a general purpose Custom Metadata Type called OrgConfig with one additional custom text field Value for which later you could define a record with a MasterLabel of PasswordPolicyLength and a Value of 7. Then, in your Flow, you would be able to query a PasswordPolicyLength record of your OrgConfig and use its value instead of 7.

The advantage of this solution over hardcoding values is that it's much easier to change the value of your Custom Metadata record than to create new version of the Flow.

Answer 2

It's passwordExpiration under ProfilePasswordPolicy and only accessible through the Metadata API.

You see an example of what gets returned in the Metadata API taken from the documentation

<?xml version="1.0" encoding="UTF-8"?>
<ProfilePasswordPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
    <forgotPasswordRedirect>true</forgotPasswordRedirect>    
    <lockoutInterval>30</lockoutInterval>
    <maxLoginAttempts>0</maxLoginAttempts>
    <minimumPasswordLength>7</minimumPasswordLength>
    <minimumPasswordLifetime>false</minimumPasswordLifetime>
    <obscure>false</obscure>
    <passwordComplexity>1</passwordComplexity>
    <passwordExpiration>365</passwordExpiration> //Number of days
    <passwordHistory>0</passwordHistory>
    <passwordQuestion>1</passwordQuestion>
    <profile>platformportal</profile> //profile name
</ProfilePasswordPolicy>

While that answers your question, Przemyslaw's suggestion is a better alternative as, even though it seems repetitive to have to change information in two places, it'll make your flow much less complex and straightforward.

If you rely on the Metadata API, you'll have to presumably use some invocable apex that utilizes apex-mdapi and parse it out per profile. Not to mention that if there's no Profile Password Policy, you'll need to look at Settings, which returns SecuritySettings that has passwordPolicies at the org-level.