I have created an Apex REST endpoint and I want to test it using an integration user that I've also just set up. The integration user is using the "Salesforce Integration" User License.
I've created two Permission Sets and added them to the user:
- Perm Set License: Salesforce Integration (grants access to the Apex class where the REST endpoint is defined as well as assigns the Connected App)
- Perm Set License: Salesforce API Integration (assigns the External Credential Principal Access and grants CRUD on UserExternalCredential)
I created a Connected App and External Credential and set the Connected App's Client Credentials "Run As" user to the integration user. The Connected App grants:
- Access the identity URL service (id, profile, email, address, phone)
- Perform requests at any time (refresh_token, offline_access)
- Manage user data via APIs (api)
I don't have any scopes set on the External Credential.
Upon trying to make a callout to the Apex REST resource, I receive the following error:
HttpRequest req = new HttpRequest();
req.setMethod('GET');
req.setHeader('Content-Type','application/json');
req.setEndpoint('callout:my_named_credential/services/apexrest/my-endpoint-uri');
HttpResponse res = new Http().send(req);
System.debug(res.getStatusCode());
System.debug(res.getBody());
System.CalloutException: The callout couldn't access the endpoint. You might not have the required permissions, or the named credential "my_named_credential" might not exist.
I'm not sure what I've missed in terms of configuration. This configuration works when I make the request using my admin user, but I get that error when trying the integration user.
NOTE: I have found past suggestions to add some degree of access to UserExternalCredentials
on the running user. However, this has not resolved the issue (tried all levels of access from Read to Modify All).
sfap_api
is "reserved for future use". Is there a reason you don't want to use the plainapi
scope?api