Salesforce REST/SOQL API
Provides programmatic access to Salesforce CRM data and business logic via REST, SOAP, Bulk, Streaming, and Metadata APIs for querying, creating, and managing records.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
OAuth 2.0 with fine-grained permission sets and profiles. Connected App policies allow IP whitelisting and session timeout controls. Field-level security and record-level sharing rules apply to API calls, meaning agent permissions depend on the running user's profile.
⚡ Reliability
Best When
Your organization is already on Salesforce and you need an agent to read, write, or react to CRM data at scale.
Avoid When
You need a lightweight CRM integration and can't justify the OAuth Connected App setup complexity and per-API-call governor limits.
Use Cases
- • Query and update lead, contact, and opportunity records using SOQL from an agent workflow
- • Bulk-import or bulk-update thousands of records (leads, accounts) using the Bulk API 2.0
- • Subscribe to real-time record change events via Streaming API / Platform Events to trigger downstream agent actions
- • Create and log activity records (tasks, events, calls) automatically after agent-driven outreach
- • Retrieve custom object schemas via Metadata API so an agent can dynamically adapt to a customer's Salesforce configuration
Not For
- • Teams without a Salesforce org — there is no sandbox available without a paid or developer account
- • Simple contact management needs that don't require Salesforce's ecosystem
- • Real-time low-latency use cases requiring sub-50ms responses
Interface
Authentication
Requires creating a Salesforce Connected App in the org to obtain client_id/client_secret. Supports OAuth 2.0 authorization code flow, JWT Bearer for server-to-server, and username-password flow (discouraged for production). Each org has its own token endpoint (instance URL varies). Token refresh is required; access tokens expire in ~2 hours.
Pricing
Developer Edition is free and includes API access, making it viable for agent development and testing. Production API limits depend on org edition and add-on purchases.
Agent Metadata
Known Gotchas
- ⚠ Instance URL is org-specific and must be discovered from the OAuth token response; hardcoding login.salesforce.com for API calls will fail after auth
- ⚠ API version must be included in every request URL (e.g., /services/data/v59.0/); failing to pin a version can cause silent behavior changes after Salesforce releases 3x/year
- ⚠ Governor limits (API call counts, SOQL row limits, heap size) are enforced per org per 24-hour rolling window and can cause 403/500 errors that look transient but are quota exhaustion
- ⚠ SOQL queries must use field API names (not labels); custom fields always end in __c which agents must discover via Describe API before querying
- ⚠ Streaming API (PushTopic / Platform Events) requires a separate CometD long-polling connection and does not work over standard REST polling patterns
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Salesforce REST/SOQL API.
Scores are editorial opinions as of 2026-03-06.