In the portal, it is easy under the setup console, find a specific application, and see all of its Application Permissions. For example:

enter image description here

However, when querying the API for ConnectedApplications, PermissionsSet, ObjectPermissions and others I can't find this data.

What is the best way to fetch the Application Permissions?


1 Answer 1


What you're looking for is within the ConnectedApplication metadata in the scopes field within the oauthConfig field.

You mention "querying" it - but, you won't get any of the scope info with SOQL; however, you can easily retrieve it with the Metadata API retrieve() call (and if needed in apex, can look at utilizing apex-mdapi to interact with the same API).

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">

And within the returned metadata file you'll see scope (added all as an example).

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <contactEmail>[email protected]</contactEmail>
        <consumerKey>the key will be here</consumerKey>

You can check the documentaion for the mapping of values to what you see in the UI, but I've copied below the values you'll get with retrieval.

  • Api - Allows access to the logged-in user’s account over the APIs.
  • Basic — Allows access to the user’s identity URL service, and includes Address, Email, Phone, and Profile.
  • Chatter — Allows access to only the Connect REST API resources.
  • CustomApplications — Allows access to custom applications, such as those using Visualforce.
  • Full — Allows access to all data accessible by the logged-in user.
  • OpenID — Allows access to the logged in user’s unique identifier for OpenID Connect apps.
  • CDPIngest — Allows access to Customer Data Platform (CDP) ingest API services. Customers use these API services to upload and maintain external data sets in the CDP. Available in API version 52.0 and later.
  • CustomPermissions — Allows access to the custom permissions in an organization associated with the connected app, and shows whether the current user has each permission enabled.
  • Pardot — Allows access to Pardot API services on behalf of the user. The full extent of accessible services is managed by the Pardot account. Available in API version 49.0 and later.
  • Lightning — Allows hybrid apps to directly obtain Lightning child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
  • Content — Allows hybrid apps to directly obtain content child sessions through the OAuth 2.0 hybrid app token flow and hybrid app refresh token flow. Available in API version 51.0 and later.
  • RefreshToken — Allows a refresh token to be returned if you’re eligible to receive one, and is synonymous with allowing OfflineAccess.
  • Wave — Allows access to the Analytics REST API resources. Available in API version 35.0 and later.
  • Eclair — Allows access to the Analytics REST API Charts Geodata resource. Available in API version 35.0 and later.
  • Web — Allows usage of the access_token on the web. This usage also includes visualforce, allowing access to Visualforce pages.
  • Thanks Kris, what is the endpoint I should access to get this resoponse? Aug 16, 2021 at 15:36
  • I added an edit to provide the Metadata API doc for the retrieve() call, but what's the context of your request - is it to ingest with an outside application, to be done within Salesforce, etc? Aug 16, 2021 at 15:44
  • Thanks Kris! Actually I want to get all scopes of all applications. I was able to fetch my own applications scopes thru the metadata api at https://<instace-name>.my.salesforce.com/services/metadata/v52.0/components/connectedApps/<app-name>, but I didn't see all applications at https://<instace-name>.my.salesforce.com/services/metadata/v52.0/components/connectedApps Aug 16, 2021 at 15:47
  • correct. That second URL should give you a list of endpoints for each app you can call to get all the scopes for each - though it'll be separate calls for each one. You could group them (25 sub-requests into one) by using composite API Aug 17, 2021 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .