I'm wondering if anyone could clarify for me the distinction between the connected app Oauth scopes 'full' vs. 'api'.

We have a couple integrations for which I've used 'web' and 'api', and they work fine, but I'm curious what access to resources 'full' would grant to the client app that the other scopes do not.

I have read the available Salesforce docs on this and did not find them to be too illuminating.


1 Answer 1


This help page talks about oauth scopes, which I believe you went through.

api scope grants access to execute rest api, bulk api etc., However it doesn't allow to access other aspects like custom permissions for which you need custom_permissions scope.

Granting full gives all possible access the granting user has access to, except refresh_token which needs to be explicitly requested.

  • Thanks. That helps. I'm wondering if you might be able to provide a sample use case of when I would choose full as opposed to api?
    – Siri Deva
    Commented Mar 7, 2022 at 13:03
  • You would always choose just the scopes you application needs to function. If your application needs just api access, start with api and then later you can add more if required.
    – metasync
    Commented Mar 7, 2022 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .