# Salesforce: Permissions for the graph8 Integration User

> The Salesforce objects and fields the user who connects graph8 must be able to see and edit, and how to grant them with a permission set.

Source: https://docs.graph8.com/settings/salesforce-integration-user-permissions/

graph8 works inside Salesforce as the user who authorised the connection. Salesforce never lets a connected app see more than that user's own profile and permission sets allow, so any field the connecting user cannot access is silently left out of the sync. This page lists exactly what that user needs, so a Salesforce admin can set up a dedicated integration user in one pass.

## Why the connecting user's permissions matter

- When you click **Connect**, graph8 receives a token for the Salesforce user who signs in. Every read and write graph8 makes runs as that user.
- The OAuth grant cannot exceed the user's own permissions. If the user cannot see the **Title** field on Lead, graph8 cannot read or write job titles. There is no error; the field simply never syncs.
- Salesforce best practice is a dedicated integration user with a minimal profile. That is the right approach, as long as the user is granted the objects and fields below.
- graph8 checks this for you. After connecting, open the Salesforce settings: any field graph8 uses that the connected user cannot access is listed in a banner at the top, and the field appears greyed out in the **Fields** tab. The sync keeps running with whatever the user can see; nothing is blocked.

> **Tip:**
> Create a user named something like **graph8 Integration** with a Salesforce licence, a minimal profile, and the permission set described below. Avoid connecting with a personal account: if that person leaves or their permissions change, the sync changes with them.

## Object access

Grant the integration user access to these objects:

| Object | Access | Used for |
|---|---|---|
| Lead | Read, Create, Edit | Lead sync: pushing qualified leads, pulling leads and their opt-outs |
| Contact | Read, Create, Edit | Pulling and pushing contacts |
| Account | Read, Create, Edit | Pulling and pushing companies |
| Campaign | Read | Pulling leads and contacts by campaign, and adding pushed leads to a campaign |
| Campaign Member | Read, Create, Edit | Adding pushed leads to the campaign you choose in the Lead sync settings |
| User | Read | Matching Salesforce record owners to graph8 team members. Salesforce grants this by default; only relevant if your org restricts user visibility |
| Task, Event | Read, Create, Edit | Only when activity sync is on |

> **Note:**
> If you want graph8 to keep updating leads after a rep converts them, also grant the **View and Edit Converted Leads** system permission. Without it, Salesforce rejects updates to converted leads.

## Field access

Field-level security applies on top of object access. Grant **Read** and **Edit** on every field in the tables below for the objects you sync. The **Needed for** column tells you when a field matters:

- **Always**: whenever that object is synced.
- **Lead sync**: the Salesforce Lead sync is on in the **Push** tab.
- **Opt-out suppressions**: **Suppress from opt-outs** is on in the Lead pull settings, so Salesforce **Email Opt Out** and **Do Not Call** flags become graph8 suppressions.
- **Contact push**: a contact push to Salesforce is configured.

### Lead

| Salesforce field | API name | Needed for |
|---|---|---|
| Email | `Email` | Always |
| First Name | `FirstName` | Always |
| Last Name | `LastName` | Always |
| Company | `Company` | Always |
| Title | `Title` | Always |
| Phone | `Phone` | Always |
| Mobile Phone | `MobilePhone` | Always |
| Website | `Website` | Always |
| Industry | `Industry` | Always |
| Street | `Street` | Always |
| City | `City` | Always |
| State/Province | `State` | Always |
| Zip/Postal Code | `PostalCode` | Always |
| Country | `Country` | Always |
| Lead Status | `Status` | Always |
| Lead Source | `LeadSource` | Always |
| Lead Owner | `OwnerId` | Always |
| Employees | `NumberOfEmployees` | Always |
| Email Opt Out | `HasOptedOutOfEmail` | Lead sync / Opt-out suppressions |
| Do Not Call | `DoNotCall` | Lead sync / Opt-out suppressions |

### Contact

| Salesforce field | API name | Needed for |
|---|---|---|
| Email | `Email` | Always |
| First Name | `FirstName` | Always |
| Last Name | `LastName` | Always |
| Title | `Title` | Always |
| Phone | `Phone` | Always |
| Mobile Phone | `MobilePhone` | Always |
| Account Name | `AccountId` | Always |
| Mailing City | `MailingCity` | Always |
| Mailing State/Province | `MailingState` | Always |
| Mailing Country | `MailingCountry` | Always |
| Contact Owner | `OwnerId` | Always |
| Email Opt Out | `HasOptedOutOfEmail` | Contact push |
| Do Not Call | `DoNotCall` | Contact push |

### Account

| Salesforce field | API name | Needed for |
|---|---|---|
| Account Name | `Name` | Always |
| Website | `Website` | Always |
| Industry | `Industry` | Always |
| Employees | `NumberOfEmployees` | Always |
| Billing City | `BillingCity` | Always |
| Billing State/Province | `BillingState` | Always |
| Billing Country | `BillingCountry` | Always |
| Account Owner | `OwnerId` | Always |

Custom fields you map in the **Fields** tab need the same field-level access. graph8 does not list them in the banner because it cannot tell a hidden custom field from one that does not exist in your org.

## Grant the permissions with a permission set

1. In Salesforce, open **Setup** and search for **Permission Sets** in the Quick Find box
2. Click **New**, name it (for example `graph8 Integration`), leave **License** as **None**, and click **Save**
3. Under **Apps**, click **Object Settings**, then open **Leads**
4. Click **Edit**. Under **Object Permissions**, tick **Read**, **Create** and **Edit**. Under **Field Permissions**, tick **Read Access** and **Edit Access** for every field in the Lead table above, then click **Save**
5. Repeat step 4 for **Contacts**, **Accounts**, **Campaigns**, **Campaign Members** and, if activity sync is on, **Tasks** and **Events**
6. Back on the permission set, click **Manage Assignments → Add Assignment**, select the integration user, and click **Assign**
7. In graph8, go to **Settings → Integrations**, click the gear icon on the Salesforce card, and click **Re-check** in the banner. The banner disappears once every field is accessible

> **Note:**
> You do not need to disconnect and reconnect. **Re-check** reads the connected user's current permissions straight from Salesforce.

### Download the permission set

A ready-made permission set file that grants exactly these permissions is coming soon; until then, follow the steps above.

## Related

- [Integrations →](https://docs.graph8.com/settings/integrations/) - Connect Salesforce and other CRMs