1

I have created an Apex REST endpoint and I want to test it using an integration user that I've also just set up. The integration user is using the "Salesforce Integration" User License.

I've created two Permission Sets and added them to the user:

  1. Perm Set License: Salesforce Integration (grants access to the Apex class where the REST endpoint is defined as well as assigns the Connected App)
  2. Perm Set License: Salesforce API Integration (assigns the External Credential Principal Access and grants CRUD on UserExternalCredential)

I created a Connected App and External Credential and set the Connected App's Client Credentials "Run As" user to the integration user. The Connected App grants:

  • Access the identity URL service (id, profile, email, address, phone)
  • Perform requests at any time (refresh_token, offline_access)
  • Manage user data via APIs (api)

I don't have any scopes set on the External Credential.

Upon trying to make a callout to the Apex REST resource, I receive the following error:

HttpRequest req = new HttpRequest();
req.setMethod('GET');
req.setHeader('Content-Type','application/json');
req.setEndpoint('callout:my_named_credential/services/apexrest/my-endpoint-uri');

HttpResponse res = new Http().send(req);
System.debug(res.getStatusCode());
System.debug(res.getBody());

System.CalloutException: The callout couldn't access the endpoint. You might not have the required permissions, or the named credential "my_named_credential" might not exist.

I'm not sure what I've missed in terms of configuration. This configuration works when I make the request using my admin user, but I get that error when trying the integration user.

NOTE: I have found past suggestions to add some degree of access to UserExternalCredentials on the running user. However, this has not resolved the issue (tried all levels of access from Read to Modify All).

15
  • Just to confirm - you also added the Permission Set Feature License for the API user - that step always catches me out Commented Jun 12 at 20:38
  • 2
    @BritishBoyinDC Are you referring to the Salesforce API Integration "Permission Set License Assignment"? If so, yes, that's added to the Integration User.
    – Mike
    Commented Jun 12 at 21:09
  • According to the doc, sfap_api is "reserved for future use". Is there a reason you don't want to use the plainapi scope? Commented Jun 12 at 21:28
  • @DavidCheng Apologies, that was a mistake and I had changed it before testing to api
    – Mike
    Commented Jun 12 at 21:33
  • When you say "Perm Set LIcense ... assigns the Connected App", do you mean that you've assigned the permission set (not license) to the connected app and set "Admin approved users are pre-authorized"? Commented Jun 12 at 21:37

0

You must log in to answer this question.