Salesforce: Permissions for the graph8 Integration User

graph8 works inside Salesforce as the user who authorised the connection. Salesforce never lets a connected app see more than that user’s own profile and permission sets allow, so any field the connecting user cannot access is silently left out of the sync. This page lists exactly what that user needs, so a Salesforce admin can set up a dedicated integration user in one pass.

Why the connecting user’s permissions matter

• When you click Connect, graph8 receives a token for the Salesforce user who signs in. Every read and write graph8 makes runs as that user.
• The OAuth grant cannot exceed the user’s own permissions. If the user cannot see the Title field on Lead, graph8 cannot read or write job titles. There is no error; the field simply never syncs.
• Salesforce best practice is a dedicated integration user with a minimal profile. That is the right approach, as long as the user is granted the objects and fields below.
• graph8 checks this for you. After connecting, open the Salesforce settings: any field graph8 uses that the connected user cannot access is listed in a banner at the top, and the field appears greyed out in the Fields tab. The sync keeps running with whatever the user can see; nothing is blocked.

Tip

Create a user named something like graph8 Integration with a Salesforce licence, a minimal profile, and the permission set described below. Avoid connecting with a personal account: if that person leaves or their permissions change, the sync changes with them.

Object access

Grant the integration user access to these objects:

Object	Access	Used for
Lead	Read, Create, Edit	Lead sync: pushing qualified leads, pulling leads and their opt-outs
Contact	Read, Create, Edit	Pulling and pushing contacts
Account	Read, Create, Edit	Pulling and pushing companies
Campaign	Read	Pulling leads and contacts by campaign, and adding pushed leads to a campaign
Campaign Member	Read, Create, Edit	Adding pushed leads to the campaign you choose in the Lead sync settings
User	Read	Matching Salesforce record owners to graph8 team members. Salesforce grants this by default; only relevant if your org restricts user visibility
Task, Event	Read, Create, Edit	Only when activity sync is on

Note

If you want graph8 to keep updating leads after a rep converts them, also grant the View and Edit Converted Leads system permission. Without it, Salesforce rejects updates to converted leads.

Field access

Field-level security applies on top of object access. Grant Read and Edit on every field in the tables below for the objects you sync. The Needed for column tells you when a field matters:

• Always: whenever that object is synced.
• Lead sync: the Salesforce Lead sync is on in the Push tab.
• Opt-out suppressions: Suppress from opt-outs is on in the Lead pull settings, so Salesforce Email Opt Out and Do Not Call flags become graph8 suppressions.
• Contact push: a contact push to Salesforce is configured.

Lead

Salesforce field	API name	Needed for
Email	Email	Always
First Name	FirstName	Always
Last Name	LastName	Always
Company	Company	Always
Title	Title	Always
Phone	Phone	Always
Mobile Phone	MobilePhone	Always
Website	Website	Always
Industry	Industry	Always
Street	Street	Always
City	City	Always
State/Province	State	Always
Zip/Postal Code	PostalCode	Always
Country	Country	Always
Lead Status	Status	Always
Lead Source	LeadSource	Always
Lead Owner	OwnerId	Always
Employees	NumberOfEmployees	Always
Email Opt Out	HasOptedOutOfEmail	Lead sync / Opt-out suppressions
Do Not Call	DoNotCall	Lead sync / Opt-out suppressions

Contact

Salesforce field	API name	Needed for
Email	Email	Always
First Name	FirstName	Always
Last Name	LastName	Always
Title	Title	Always
Phone	Phone	Always
Mobile Phone	MobilePhone	Always
Account Name	AccountId	Always
Mailing City	MailingCity	Always
Mailing State/Province	MailingState	Always
Mailing Country	MailingCountry	Always
Contact Owner	OwnerId	Always
Email Opt Out	HasOptedOutOfEmail	Contact push
Do Not Call	DoNotCall	Contact push

Account

Salesforce field	API name	Needed for
Account Name	Name	Always
Website	Website	Always
Industry	Industry	Always
Employees	NumberOfEmployees	Always
Billing City	BillingCity	Always
Billing State/Province	BillingState	Always
Billing Country	BillingCountry	Always
Account Owner	OwnerId	Always

Custom fields you map in the Fields tab need the same field-level access. graph8 does not list them in the banner because it cannot tell a hidden custom field from one that does not exist in your org.

Grant the permissions with a permission set

1. In Salesforce, open Setup and search for Permission Sets in the Quick Find box
2. Click New, name it (for example graph8 Integration), leave License as None, and click Save
3. Under Apps, click Object Settings, then open Leads
4. Click Edit. Under Object Permissions, tick Read, Create and Edit. Under Field Permissions, tick Read Access and Edit Access for every field in the Lead table above, then click Save
5. Repeat step 4 for Contacts, Accounts, Campaigns, Campaign Members and, if activity sync is on, Tasks and Events
6. Back on the permission set, click Manage Assignments → Add Assignment, select the integration user, and click Assign
7. In graph8, go to Settings → Integrations, click the gear icon on the Salesforce card, and click Re-check in the banner. The banner disappears once every field is accessible

Note

You do not need to disconnect and reconnect. Re-check reads the connected user’s current permissions straight from Salesforce.

Download the permission set

A ready-made permission set file that grants exactly these permissions is coming soon; until then, follow the steps above.

Related

• Integrations → - Connect Salesforce and other CRMs