I have a requirement to integrate with a 3rd party application for Account data (Account creation). The idea is that Salesforce will be the primary source of truth and the other application will be the secondary, however there is data from the secondary system that must be updated back onto created Account.

For example an Account is created in Salesforce.

  • this account as ready to be picked up by the 3rd party application by means of an integration Status
  • 3rd party application picks this up and processes the record successfully in the secondary system
  • A reference number is generated in the secondary system and needs to be updated on the master account

The 3rd party application has some issues/limitations with middleware, so that's why its a direct integration.

I have 2 solution directions in mind with the basis of creating a Connected App, a custom REST API (there is some additional logic that needs to happen on the account), profile and permissionset for this API user, then either:

  1. Expose the Account data with the REST API
  2. Create a custom object and exposed only the core Accounts field values in a single field

My questions are:

  1. Are both options secure enough or are there any significant advantages of one over the other?
  2. What is the best practice in such a scenario?

1 Answer 1



The external system should use as its running user a user with License = Salesforce Integration.

  • Assign that user a Permission Set License = Salesforce API Integration
  • Create a Permission Set containing CRUD for Account and FLS for the relevant fields (Read on the fields to fetch, Read/Edit for fields to update). Assign that permission set to the integration user.
  • Create a Criteria-based sharing rule so the integration user can only see Accounts ready for integration

Each Enterprise Edition comes with 5 free users that can use License = Salesforce Integration. Additional such users are cheap ($120/year c.a. 2024)

This way, your integration user can only see Accounts it should see and only fields on that account that it should see/update.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .