We have implemented a REST callout that will need to be used by an Einstein Chatbot, but we are having trouble getting the chatbot access to the named credential used for the callout.

The details:

  • The named credential is non-legacy (i.e. Named Credential + External Credential pair), named principal, allows formulas in headers, uses custom headers in the external credential with permission set mappings
  • The APEX class invoked by the chatbot works fine when called from an anonymous block, but returns a System.CalloutException when the chatbot invokes it
  • The CalloutException message is We couldn't access the credential(s). You might not have the required permissions, or the external credential {nameOfCred} might not exist.
  • The permission set sfdc.chatbot.service.permset is named in the permission set mappings of the External Credential

We have made the following modifications to the sfdc.chatbot.service.permset to troubleshoot and none of these has worked:

  • Given read/create/edit access to the object User External Credentials

Any ideas would be extremely welcome!

  • If you go in to the sfdc.chatbot.service.permset and go to the Named Credential Access section of the permset, is your intended named credential in that list? Also, is the bot using the default bot user (not a custom run-as user for the bot)? Mar 15, 2023 at 18:36
  • Hi @Swetha, thanks for your reply. The named credential access section of permission sets only applies to per-user legacy named credentials, whereas this is a new type named principal ones - so instead there is a permission set mapping in the external credential screen (which has a mapping to sfdc.chatbot.service.permset) We are using the basic bot user as a running user for the bot Mar 16, 2023 at 11:36
  • 1
    I see that you have already logged a support case. As suggested in the support case, instead of the default bot user and chatbot permset,can you assign a specific run-as user for the bot and see if that works? Thanks Mar 17, 2023 at 17:26
  • 1
    Hi Swetha - thank you, that seems to work. I thought I could use named credentials with the basic bot but indeed it seems to need a custom user Mar 19, 2023 at 9:41
  • Thanks for confirming @Diego Cominazzini. I'll post this as an answer so it might help others too in the future. Cheers! Mar 20, 2023 at 8:55

1 Answer 1


As mentioned in the comments section, to resolve the issue, you had to assign a specific run-as user(custom bot user)instead of the default bot user and chatbot permset.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .