> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcollate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce Hybrid Runner

> Connect Salesforce to Collate with our comprehensive database connector guide. Setup instructions, configuration tips, and metadata extraction made easy.

export const ConnectorDetailsHeader = ({name, icon, stage, availableFeatures, unavailableFeatures = [], availableFeaturesCollate = []}) => {
  const showSubHeading = availableFeatures?.length > 0 || unavailableFeatures?.length > 0 || availableFeaturesCollate?.length > 0;
  const totalAvailableFeatures = [...availableFeatures || [], ...availableFeaturesCollate || []];
  return <div className="container">
      <div className="Heading">
        <div className="flex items-center gap-3">
          {icon && <div className="IconContainer">
              <img src={icon} alt={name} noZoom className="ConnectorIcon" />
            </div>}
          <h1 className="ConnectorName">{name}</h1>
          <span className={`StageBadge ${stage === 'PROD' ? 'prod' : 'beta'}`}>
            {stage}
          </span>
        </div>
      </div>
      {showSubHeading && <div className="SubHeading">
          <div className="FeaturesHeading">Feature List</div>
          <div className="FeaturesList">
            {totalAvailableFeatures.map(feature => <div className="FeatureTag AvailableFeature" key={feature}>
                ✓ {feature}
              </div>)}
            {unavailableFeatures.map(feature => <div className="FeatureTag UnavailableFeature" key={feature}>
                ✕ {feature}
              </div>)}
          </div>
        </div>}
    </div>;
};

<ConnectorDetailsHeader icon="/public/images/connectors/salesforce.webp" name="Salesforce" stage="PROD" availableFeatures={["Metadata"]} unavailableFeatures={["Query Usage", "Data Profiler", "Data Quality", "dbt", "Lineage", "Column-level Lineage", "Stored Procedures", "Owners", "Tags", "Sample Data", "Auto-Classification"]} />

This section provides guides and references to use the Salesforce connector.
Configure and schedule Salesforce metadata workflows from the Collate UI:

* [Requirements](#requirements)
* [Metadata Ingestion](#metadata-ingestion)
* [Enable Security](#securing-salesforce-connection-with-ssl-in-collate)
* [Troubleshooting](/ai-2-0/connectors/database/salesforce/troubleshooting)

## Requirements

These are the permissions you will require to fetch the metadata from Salesforce.

* **API Access**: You must have the API Enabled permission in your Salesforce organization.
* **Object Permissions**: You must have read access to the Salesforce objects that you want to ingest.

## Metadata Ingestion

To ingest metadata from Salesforce, you need to create a service connection. The service connects Salesforce with Collate. Once you create a service, Collate automatically starts ingesting metadata.

### Step 1: Add New Service

1. In the left navigation, click **Connections**.
2. On the **Connections** page, click **Add New Service**.

<img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/add-new-service.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=733cef1141ef13d318634aa9f407eb2b" alt="Add New Service" width="2992" height="1256" data-path="public/images/ai-2.0/connectors/metadata-ingestion/add-new-service.png" />

### Step 2: Select a Service and Connector

From the service type dropdown, select **Database Services**, then click the **Salesforce** connector tile.

<img src="https://mintcdn.com/collatedocs/bWmb7UY94lEjxxg4/public/images/ai-2.0/connectors/metadata-ingestion/Database/select-service/salesforce.png?fit=max&auto=format&n=bWmb7UY94lEjxxg4&q=85&s=824e73c74d70297698ddd3eccdc29526" alt="Select Service" width="1900" height="900" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/select-service/salesforce.png" />

### Step 3: Add Service Name and Description

* Enter a unique, descriptive **Service Name**. Collate identifies services by their service name. Enter a name that distinguishes this deployment from other Salesforce services you are ingesting metadata from.
* Optional: Enter a **Description** for the service.

<img src="https://mintcdn.com/collatedocs/bWmb7UY94lEjxxg4/public/images/ai-2.0/connectors/metadata-ingestion/Database/service-name/salesforce.png?fit=max&auto=format&n=bWmb7UY94lEjxxg4&q=85&s=5780e1363a90482cfeb117bd52847295" alt="Add New Service Name" width="1498" height="850" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/service-name/salesforce.png" />

<Note>
  **Note**: The service name cannot be changed after it is set.
</Note>

### Step 4: Configure Connection Options

Specify where ingestion runs, provide your source credentials, and verify the connection.

#### Select Ingestion Runner

Select an **Ingestion Runner**: the runner where the ingestion pipeline will execute.

<img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/select-ingestion-runner.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=1249f828648614445e8a976ea1933487" alt="Add Name and Select Ingestion Runner" width="1444" height="506" data-path="public/images/ai-2.0/connectors/metadata-ingestion/select-ingestion-runner.png" />

#### Enter Connection Details

Enter the connection details for Salesforce. The right-hand panel in the UI displays inline help for each field.

<img src="https://mintcdn.com/collatedocs/kTp2dTyiNAX4Np5A/public/images/ai-2.0/connectors/metadata-ingestion/Database/connection-details/salesforce.png?fit=max&auto=format&n=kTp2dTyiNAX4Np5A&q=85&s=45d2e8ce201b870d82329cb867588ef9" alt="Configure Service Connection" width="1430" height="1542" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/connection-details/salesforce.png" />

<Tip>
  **Tip**: When using a **Hybrid Ingestion Runner**, any sensitive credential fields—such as passwords, API keys, or private keys—must reference secrets using the following format:

  ```
  password: secret:/my/database/password
  ```

  This applies **only to fields marked as secrets** in the connection form (these typically mask input and show a visibility toggle icon).
  For more information about managing secrets in hybrid setups, see the [Hybrid Ingestion Runner Secret Management Guide](/ai-2-0/getting-started/lets-get-started/ingest-your-data/hybrid-ingestion-runner#manage-secrets)
</Tip>

**Authentication**

Collate supports the following Salesforce authentication patterns:

* **OAuth 2.0 client credentials flow**: Use Consumer Key and Consumer Secret without Username or Password. This requires a Salesforce My Domain value in the **Salesforce Domain** field, such as `mycompany.my`. It does not work with the default `login` or `test` domains.
* **OAuth 2.0 password flow**: Use Consumer Key and Consumer Secret together with Username and Password. Use this flow when **Salesforce Domain** is `login` or `test`.
  * **Consumer Key**: Salesforce Consumer Key (Client ID) for OAuth 2.0 authentication.
  * **Consumer Secret**: Salesforce Consumer Secret (Client Secret) for OAuth 2.0 authentication.
* **Username / Password (Legacy)**

  <Warning>
    **Important**: Salesforce is deprecating direct username/password API access. Migrate to OAuth 2.0 using a Connected App (External Client App) to avoid future disruption. See [Salesforce OAuth documentation](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authenticate.htm\&type=5).
  </Warning>

  * **Username**: Username to connect to Salesforce. This user should have the access defined in the requirements.
  * **Password**: Password to connect to Salesforce.
  * **Security Token**: Salesforce Security Token for legacy username/password authentication. Use this only when you are not using Consumer Key and Consumer Secret. You can check [this doc](https://help.salesforce.com/s/articleView?id=sf.user_security_token.htm\&type=5) to get the token.

**Common fields**

* **Organization ID**: Salesforce Organization ID is the unique identifier for your Salesforce identity. You can check out [this doc](https://help.salesforce.com/s/articleView?id=000385215\&type=1) on how to get your Salesforce Organization ID.
  <Tip>
    **Note**: You need to provide the `15` digit organization ID in this section, for example `00DIB000004nDEq`, which you can find by following the steps in the doc above (`Salesforce dashboard -> Setup -> Company Profile -> Company Information -> Salesforce.com Organization Id`).
  </Tip>
  <Tip>
    **Note**: If you want to access Salesforce metadata without a token and only use the organization ID, you need to set up your IP in trusted IP ranges. Go to `Salesforce dashboard -> Setup -> Security -> Network Access -> Trusted IP Ranges` to configure this. You can check [here](https://help.salesforce.com/s/articleView?id=sf.security_networkaccess.htm\&type=5) for details.
  </Tip>
* **Salesforce Object Names**: List the Salesforce object names to ingest. If you leave this blank, Collate ingests all available objects that pass the filter pattern.
* **Database Name**: Optional name to use for the database in Collate. If left blank, the connector uses the default database name.
* **Salesforce API Version**: Follow the steps mentioned [here](https://help.salesforce.com/s/articleView?id=000386929\&type=1) to get the API version. Enter the numeric value in the field, for example `62.0`. The connector defaults to `42.0`. Use a version supported by your Salesforce org and update it when Salesforce retires older API versions.

  The constraint depends on your authentication method:

  * **OAuth 2.0**: Any supported Salesforce API version works, including the default `42.0`.
  * **Username / Password (Legacy)**: Use version `64.0` or lower. Salesforce removed SOAP API login support in version `65.0` and later — using `65.0` or higher with username/password authentication will cause authentication to fail.
* **Salesforce Domain**: Specify the Salesforce domain (subdomain only) to use for authentication. This field accepts only the domain prefix, not the full URL.

  **Common values:**

  * `login` (default) - For production instances (resolves to `https://login.salesforce.com`)
  * `test` - For sandbox instances (resolves to `https://test.salesforce.com`)

  **For Salesforce My Domain:**
  Enter your custom domain prefix, including all subdomain components such as `.my` or `.sandbox.my`, but without `.salesforce.com`.

  **Examples:**

  * If your My Domain URL is `https://mycompany.my.salesforce.com`, enter: `mycompany.my`
  * If your sandbox My Domain URL is `https://mycompany--uat.sandbox.my.salesforce.com`, enter: `mycompany--uat.sandbox.my`
  * If your URL is `https://example-dot-com--uat.sandbox.my.salesforce.com`, enter: `example-dot-com--uat.sandbox.my`

  <Note>
    **Note**:
    **Important:** Do NOT enter the full URL or include `.salesforce.com`. Only enter the subdomain prefix as shown in the examples above.
  </Note>

**SSL Configuration**
To integrate SSL in the metadata ingestion config, add the SSL config under `sslConfig` in the source.

#### Advanced Configuration

Database Services have an Advanced Configuration section, where you can pass extra arguments to the connector and, if needed, change the connection Scheme. This would only be required to handle advanced connectivity scenarios or customizations.

* **Connection Options (Optional)**: Enter the details for any additional connection options that can be sent to database during the connection. These details must be added as Key-Value pairs.
* **Connection Arguments (Optional)**: Enter the details for any additional connection arguments such as security or protocol configs that can be sent during the connection. These details must be added as Key-Value pairs.

#### Test Connection

Once the credentials have been added, click on **Test Connection** and **Save** the changes.

<img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/test-connection.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=3365cff7bb9d82c85a2ff9ab559d6f11" alt="Test Connection" width="1446" height="188" data-path="public/images/ai-2.0/connectors/metadata-ingestion/test-connection.png" />

### Step 5: Configure Ingestion Options

In the **What to Ingest** step, use filter patterns to control which assets Collate ingests from your database service. Filter patterns use regular expressions applied to asset names.

#### How Filter Patterns Work

* **Include**: Add one or more comma-separated regular expressions. Collate ingests only assets whose names match at least one expression. Leave blank to include all assets.
* **Exclude**: Add one or more comma-separated regular expressions. Collate skips any asset whose name matches an expression. Leave blank to exclude nothing.

Rules match asset names using one of five expressions:

* **contains**: matches any name containing the value. For example, `sales` matches `my_sales_data` and `sales_2024`.
* **starts with**: matches names beginning with the value. For example, `prod_` matches `prod_db` and `prod_schema`.
* **ends with**: matches names ending with the value. For example, `_raw` matches `events_raw` and `logs_raw`.
* **is exactly**: matches the exact name only. For example, `analytics` matches only `analytics`.
* **matches regex**: matches names using a regular expression. For example, `^prod_.*_v\d+$` matches `prod_events_v1`.

When both Include and Exclude are set, Exclude takes priority.

<Tip>
  **Tip**: Leave all filter patterns empty to ingest all databases, schemas, and tables available in the source.
</Tip>

**Filter Options**

The Database, Schema, Table, and Stored Procedure sections each include the following filter options:

* **Database**: Controls which databases Collate ingests from the source.
* **Schema**: Controls which schemas within the ingested databases are included.
* **Table**: Controls which tables and views within the ingested schemas are included.
* **Stored Procedure**: Controls which stored procedures are included in metadata ingestion.

Each section provides the following controls:

* **Scan Mode**: You can choose between the following scan modes:
  * **Scan all**: Ingests every asset of that type the connector can access. This is the default.
  * **Only specific**: Enables include rules so only assets matching at least one rule are ingested.
* **Exclude system toggle**: Use this toggle to automatically filter out system-reserved names defined by the connector — for example, **Exclude system databases** for the Databases section.
* **Always exclude**: Add permanent exclusion rules (shown in red). Assets matching these rules are never ingested, regardless of include rules.
* **Preview**: Shows a real-time summary of what will be in scope based on your current rules.
* **Include rules** *(available only in **Only specific** mode)*: Click **+ Add** to define a rule. Added rules appear as chips; an asset is included if it matches any rule.

<Tip>
  **Tip**: If [AutoPilot](/ai-2-0/admin-guide/applications/autopilot) is enabled, usage tracking, data lineage, and other downstream workflows start automatically after the first metadata ingestion completes.
</Tip>

### Step 6: Create & Deploy

Click **Create & Deploy** to deploy the agent and start the first metadata ingestion run. Collate saves the service configuration and immediately begins pulling metadata from the source.

To monitor ingestion progress or view the service you just added, go to **Connections** in the left navigation and select your service.

## Configure Metadata Agent and Schedule Ingestion

The **Metadata Agent** extracts schemas, tables, columns, and other structural metadata from your source and keeps your Collate catalog in sync. It powers discovery, lineage, and governance across your data assets.

When you click **Create & Deploy**, Collate automatically deploys a Metadata Agent for this service and triggers the first ingestion run. View its status and run history from the **Agents** tab on the service detail page.

To configure the additional Metadata Agent and schedule ingestion, follow these steps:

1. In the left navigation, click **Connections** and select your service.

2. Click the **Agents** tab.

3. Click **Add Agent** and select **Metadata** from the dropdown.
   <img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/add-metadata-agent.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=accad7d1c4ddf209781bff851d51d464" alt="Add Metadata Agent" width="2398" height="1144" data-path="public/images/ai-2.0/connectors/metadata-ingestion/add-metadata-agent.png" />
   For some services, the dropdown is not available and clicking **Add Agent** takes you directly to the agent configuration page.

4. On the **Configure Ingestion** page, do the following and click **Next**.

   * **Name this Ingestion**: Enter a unique recognizable name for this ingestion pipeline.

     <img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/metadata-agent-name.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=d5ec1f0f3742cadab8cd54c602c97239" alt="Name this Ingestion" width="1578" height="644" data-path="public/images/ai-2.0/connectors/metadata-ingestion/metadata-agent-name.png" />

   * **Agent Setup**: Configure core parameters for metadata extraction. The following fields are available:

     | Field                                 | Default | Description                                                                                                              |
     | ------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------ |
     | Default Owner                         | —       | Owner applied to all entities when no specific level owner is configured. Accepts a user or team name/email.             |
     | Service Owner                         | —       | Owner assigned to the service entity.                                                                                    |
     | Database Owner                        | —       | Owner assigned to all ingested databases. Accepts a single owner or a per-database name mapping.                         |
     | Database Schema Owner                 | —       | Owner assigned to all ingested schemas. Accepts a single owner or a per-schema name mapping.                             |
     | Table Owner                           | —       | Owner assigned to all ingested tables. Accepts a single owner or a per-table name mapping.                               |
     | Enable Inheritance                    | On      | When on, child entities inherit the owner from their parent when they have no owner configured.                          |
     | Query Log Duration                    | 1       | Number of days to look back in query logs when processing stored procedure results.                                      |
     | Query Parsing Timeout Limit           | 300     | Timeout in seconds for parsing a single query.                                                                           |
     | Number of Threads                     | 1       | Number of threads to use for parallel table ingestion.                                                                   |
     | Incremental Extraction                | Off     | When enabled, subsequent runs only extract entities changed since the last successful run.                               |
     | Successful Pipeline Run Lookback Days | 7       | Number of days to search back for a prior successful run to use as a baseline for incremental extraction.                |
     | Safety Margin Days                    | 1       | Additional days added to the baseline timestamp as a buffer for incremental extraction.                                  |
     | JSON Schema Sample Size               | 10      | Number of rows sampled to infer JSON column schema. Only applies when Extract JSON Schema is enabled in Advanced Config. |

     <img src="https://mintcdn.com/collatedocs/kTp2dTyiNAX4Np5A/public/images/ai-2.0/connectors/metadata-ingestion/Database/database-agent-setup.png?fit=max&auto=format&n=kTp2dTyiNAX4Np5A&q=85&s=429839e5b479082a6909dd2a7734513d" alt="Agent Setup" width="1570" height="1396" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/database-agent-setup.png" />

   * **Filter Patterns**: Apply include or exclude rules to scope which databases, schemas, tables, and stored procedures this agent ingests. For more information about various filter options, see **Step 5: Configure Ingestion Options**.

     <img src="https://mintcdn.com/collatedocs/kTp2dTyiNAX4Np5A/public/images/ai-2.0/connectors/metadata-ingestion/Database/database-filter-pattern.png?fit=max&auto=format&n=kTp2dTyiNAX4Np5A&q=85&s=8a0c5fcc3475acf8acc94e6eecb55a11" alt="Filter Patterns" width="1560" height="1030" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/database-filter-pattern.png" />

   * **Scope & Behaviour**: Control how the agent handles metadata during ingestion. Toggle each option on or off based on your needs:

     | Toggle                         | Default | Description                                                                                                                                                            |
     | ------------------------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
     | Include Tables                 | On      | Ingest table metadata from the source. Turn off to skip tables entirely.                                                                                               |
     | Include Tags                   | On      | Ingest tags from the source.                                                                                                                                           |
     | Include Stored Procedures      | On      | Ingest stored procedure metadata.                                                                                                                                      |
     | Include DDL Statements         | Off     | Ingest DDL statements alongside table metadata.                                                                                                                        |
     | Include Owners                 | Off     | Assign owners to ingested entities when the source owner's email matches a user in Collate. Does not overwrite an existing owner.                                      |
     | Include Custom Properties      | Off     | Ingest connector-specific custom properties onto entities.                                                                                                             |
     | Mark Deleted Tables            | On      | Soft-delete tables in Collate when they are removed from the source. Applies only within the currently ingested schema.                                                |
     | Mark Deleted Stored Procedures | On      | Soft-delete stored procedures in Collate when they are removed from the source.                                                                                        |
     | Mark Deleted Schemas           | Off     | Soft-delete schemas and all their child assets when removed from the source.                                                                                           |
     | Mark Deleted Databases         | Off     | Soft-delete databases and all their child assets when removed from the source.                                                                                         |
     | Override Metadata              | Off     | When on, source values overwrite existing descriptions, tags, owners, and display names in Collate. When off, Collate only updates fields that have no existing value. |
     | Enable Debug Log               | Off     | Sets the ingestion log level to DEBUG. Useful for troubleshooting.                                                                                                     |

     <Note>
       **Note**: Available toggles vary by connector. Stored procedure options only appear for connectors that support stored procedures.
     </Note>

     <img src="https://mintcdn.com/collatedocs/kTp2dTyiNAX4Np5A/public/images/ai-2.0/connectors/metadata-ingestion/Database/database-scope-behaviour.png?fit=max&auto=format&n=kTp2dTyiNAX4Np5A&q=85&s=6ada5b2870c990f494d1dac400e73459" alt="Scope & Behaviour" width="1566" height="1436" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/database-scope-behaviour.png" />

   * **Advanced Config**: Optional connector-specific settings such as Include Views and Extract JSON Schema.

     <img src="https://mintcdn.com/collatedocs/kTp2dTyiNAX4Np5A/public/images/ai-2.0/connectors/metadata-ingestion/Database/database-advance.png?fit=max&auto=format&n=kTp2dTyiNAX4Np5A&q=85&s=63ef86d9e746b6d31f0571b599792357" alt="Advanced Config" width="1564" height="352" data-path="public/images/ai-2.0/connectors/metadata-ingestion/Database/database-advance.png" />

5. On the **Schedule Interval** page, set when the agent runs:

   * **Schedule**: Choose a preset interval (Hourly, Daily, Weekly, Monthly) or enter a custom cron expression.
   * **On-Demand**: No automatic schedule; trigger the agent manually when needed.

   <img src="https://mintcdn.com/collatedocs/bv5oe4uRjuorTJO1/public/images/ai-2.0/connectors/metadata-ingestion/schedule.png?fit=max&auto=format&n=bv5oe4uRjuorTJO1&q=85&s=25cc1d78f6f2a8bd115830d034d1d8d1" alt="Schedule Interval" width="1588" height="1044" data-path="public/images/ai-2.0/connectors/metadata-ingestion/schedule.png" />

6. Click **Add** to deploy the agent.

## Securing Salesforce Connection with SSL in Collate

To establish secure connections between Collate and Salesforce, navigate to the `Advanced Config` section. Here, you can provide the CA certificate used for SSL validation by specifying `caCertificate`. Alternatively, if both client and server require mutual authentication, use all three parameters: `ssl_key`, `ssl_cert`, and `ssl_ca`. In this case, `ssl_cert` is used for the client's SSL certificate, `ssl_key` for the private key associated with the SSL certificate, and `ssl_ca` for the CA certificate that validates the server certificate.

<img src="https://mintcdn.com/collatedocs/qybQN_VCNOUNg9nn/public/images/connectors/ssl_connection.png?fit=max&auto=format&n=qybQN_VCNOUNg9nn&q=85&s=e90fd6e04057c3481ac6ca1987423a30" alt="SSL Configuration" height="450px" data-path="public/images/connectors/ssl_connection.png" />

## Troubleshooting

<Columns cols={2}>
  <Card title="Salesforce Troubleshooting" href="/ai-2-0/connectors/database/salesforce/troubleshooting">
    Learn more about how to troubleshoot common Salesforce connector issues and resolve configuration or ingestion errors.
  </Card>
</Columns>
