Salesforce

Description

Integration with Salesforce through its REST API (version v59.0). The family covers the record lifecycle: create, read by id, update, upsert by external id, delete, and query anything with SOQL.

Like the Salesforce API itself, the nodes are generic: instead of one node per entity, you name the sObject (Account, Contact, Lead, Opportunity, Case, or any custom object ending in __c) in a parameter, and the same node covers your whole org.

Authentication is handled by the credentials module (provider salesforce) using the OAuth2 password grant. The token is fetched once, cached in memory for about two hours, and refreshed automatically when it expires.

Operations

Create Record Create a record of any sObject.

Get Record Read a record by its id, choosing fields.

Update Record Update fields on an existing record.

Upsert Record Create or update by an external id field.

SOQL Query Run a SOQL query and get the records array.

Delete Record Delete a record by its id.

Nodes at a glance

Node	Internal name	HTTP call
Salesforce: Create record	`salesforceCreateRecord`	`POST /sobjects/{sobject}`
Salesforce: Get record	`salesforceGetRecord`	`GET /sobjects/{sobject}/{id}`
Salesforce: Update record	`salesforceUpdateRecord`	`PATCH /sobjects/{sobject}/{id}`
Salesforce: Upsert record	`salesforceUpsertRecord`	`PATCH /sobjects/{sobject}/{extField}/{extValue}`
Salesforce: SOQL query	`salesforceQuery`	`GET /query?q=...`
Salesforce: Delete record	`salesforceDeleteRecord`	`DELETE /sobjects/{sobject}/{id}`

Every path is relative to {instance_url}/services/data/v59.0, and instance_url comes back with the token — you never type it.

Configuration

Every node shares the credential; five of the six also share the sobject parameter. The rest is documented on each operation page.

Parameter	Type	Required	Description
credentials_id	credentials	Yes	Salesforce credential (provider `salesforce`)
sobject	text	Yes (except SOQL query)	API name of the object: `Account`, `Contact`, `Lead`, `Opportunity`, `Case`, `MyObject__c`…

Credentials

Provider: salesforce. Create it in Credentials → Add → Salesforce.

Field	Description
`login_url`	`https://login.salesforce.com` for production, `https://test.salesforce.com` for a sandbox. Optional — defaults to production
`client_id`	Consumer Key of your Connected App
`client_secret`	Consumer Secret of your Connected App
`username`	The Salesforce user the flow runs as
`password`	The user’s password concatenated with the security token, with no separator
`timeout`	Optional. Request timeout in milliseconds (default `30000`)

The Test button requests the OAuth2 token and, on success, shows the instance_url it resolved to — a quick way to confirm you are pointing at the right org.

Important: OAuth2 password grant

This is the part that fails most often on the first attempt.

The engine posts grant_type=password to {login_url}/services/oauth2/token and then calls the API with Authorization: Bearer {access_token}.
password is the password plus the security token, glued together. If your password is Sales2026! and the token is AbCd1234EfGh, the field contains Sales2026!AbCd1234EfGh. The token is emailed to the user from Setup → Reset My Security Token and changes every time the password changes.
The Connected App must have the password grant enabled and the OAuth scopes api (and usually refresh_token). Depending on the org, the user profile may also need “Password and Security Token” relaxed IP restrictions.
For a sandbox, set login_url to https://test.salesforce.com and remember the username has the sandbox suffix (user@company.com.sandboxname).
The token is cached in memory for about two hours and shared by all the nodes of the flow, so Salesforce’s login limits are not hit on every call. On a 401 the node fetches a fresh token and retries the call once, transparently.

Important: choosing the sObject

sobject is a free-text field, not a dropdown, and its value goes straight into the URL. It must be the object’s API name, which is case-sensitive in practice and is not always the label you see in Salesforce:

What you manage in Salesforce	`sobject`
Accounts (companies)	`Account`
Contacts	`Contact`
Leads	`Lead`
Opportunities	`Opportunity`
Cases (support)	`Case`
Custom objects	The API name ending in `__c`, e.g. `Subscription__c`

The value is not validated before the call: a wrong name comes back as a 404 from Salesforce. Field names follow the same rule — LastName, Company, StageName, and custom fields ending in __c. Check them under Setup → Object Manager → Fields & Relationships.

Output

Each node returns its result in data plus a _meta object with the module version and timing. Because Salesforce answers 204 No Content to PATCH and DELETE, the update, upsert and delete nodes build the confirmation object themselves:

{
  "data": { "id": "0015g00000AbCdEFGH", "success": true },
  "_meta": { "moduleVersion": "1.0.0", "success": true, "id": "0015g00000AbCdEFGH", "totalMs": 380 }
}

The SOQL query node returns the records array directly in data, ready to iterate.

On failure the node stops the branch and returns an error object instead:

{
  "data": {},
  "error": {
    "message": "Required fields are missing: [LastName] (REQUIRED_FIELD_MISSING)",
    "type": "validation",
    "status": 400
  }
}

Salesforce reports errors as an array of { message, errorCode }; the node flattens the first entry into that single readable message.

API Used

Salesforce REST API v59.0 — https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/

Notes

Dynamic variables such as {{data.email}} are resolved in every parameter, including the JSON ones and the SOQL query, because the text is resolved first and parsed afterwards.
Retries are automatic, capped at 3 attempts with exponential backoff, for network errors, timeouts, 429/503 (honouring Retry-After) and 5xx. Validation (400), 404 and authentication errors are not retried.
The default request timeout is 30 seconds; raise it with the timeout field in the credential.
Secrets are never written in full to the logs — only a masked form.
Salesforce ids come in two forms, 15 characters (case-sensitive) and 18 characters (case-safe). Both work in the nodes.

Error handling

Situation	Retryable	What to do
Validation (400)	No	Salesforce explains why in `message` (`REQUIRED_FIELD_MISSING`, `INVALID_FIELD`, a validation rule…). Fix the data.
Not found (404)	No	The record or the sObject does not exist. Check the id and the API name.
Authentication (401/403)	No	After one automatic retry with a fresh token it still fails: review the Connected App, the user, the password + security token, or the profile permissions.
Rate limit (429/503)	Yes	`Retry-After` is honoured and the call retried.
Server (5xx)	Yes	Temporary Salesforce error; retried automatically.
Network / Timeout	Yes	Transient issue; retried automatically.