Salesforce Order Management

This documentation for the Salesforce Order Management integration describes the technical capabilities of this integration, including authorization, scopes/permissions, and utilized endpoints. For more information on how to integrate Salesforce Order Management, visit our connection instructions.

Version

This integration utilizes the Salesforce Order Management REST API v53.0.

Base URL

The base URL used for all Salesforce Order Management API endpoints contains the Instance URL:

https://INSTANCE_URL.salesforce.com/services/data/v53.0

Endpoints Utilized

DataGrail uses the following endpoints to authorize and test the connection:

Method	Endpoint	Purpose	Docs
GET	https://login.salesforce.com/services/oauth2/authorize	Request authorization (production)
POST	https://login.salesforce.com/services/oauth2/token	Get and refresh access token (production)
GET	https://login.salesforce.com/services/oauth2/userinfo	Retrieve user info (production
GET	https://test.salesforce.com/services/oauth2/authorize	Request authorization (sandbox)
POST	https://test.salesforce.com/services/oauth2/token	Get and refresh access token (sandbox)
GET	https://test.salesforce.com/services/oauth2/userinfo	Retrieve user info (sandbox)

---

Authentication & Authorization

The DataGrail Salesforce Order Management integration connects using OAuth 2.0 with the following credentials: Client ID and Client Secret.

Sensitive Credentials

Publicly exposing your API credentials can allow unauthorized access to Salesforce Order Management API endpoints by a third party. DataGrail stores your API credentials encrypted and protected.

Scopes

The Salesforce Order Management integration requires specific scopes that must be granted in order to function for a given capability.

Scope	Base	Access	Deletion
refresh_token	✅
api		✅	✅

Base Scopes

All base scopes must be granted in order to connect the integration with DataGrail. The remaining scopes are only required if enabling those capabilities

---

Limits

Limits in Salesforce Order Management are calculated using the leaky bucket algorithm. All requests that are made after rate limits have been exceeded are throttled and an HTTP 429 Too Many Requests error is returned. Requests succeed again after enough requests have emptied out of the bucket.

• DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
• DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).

---

Capabilities

Access

DataGrail's Salesforce Order Management integration provides Synchronous Access capabilities for the following supported identifier category: Email.

Data Interactions

For Access requests, DataGrail will take the following actions:

1. Search Salesforce for matching records using the Data Subject email.
2. For each matching record whose sObject type is enabled in your integration configuration, retrieve the full sObject record.
3. If reference retrieval is enabled for a record type, retrieve allowed referenced records (for example, Account) based on the sObject's reference fields.

By default, DataGrail collects records from these Salesforce OMS objects:

Salesforce OMS Objects

• Account
• AlternativePaymentMethod
• CardPaymentMethod
• Contact
• DigitalWallet
• FulfillmentOrder
• Order
• OrderDeliveryGroup
• OrderDeliveryGroupSummary
• OrderSummary
• Payment
• PaymentAuthorization
• Refund.

Need Custom Objects?

Please contact support@datagrail.io if you would like to use a custom set of Salesforce Order Management objects for access and deletion.

Endpoints Utilized

Method	Endpoint	Purpose	Docs
GET	/search	Search for matching records
GET	/sobjects/sobject_name/object_id	Retrieve an sObject record
GET	/sobjects/sobject_name/describe/	Retrieve sObject metadata (used to find reference fields)

---

Deletion

DataGrail's Salesforce Order Management integration provides Synchronous Deletion capabilities for the following supported identifier category: Email.

Data Interactions

For Deletion requests, DataGrail will take the following actions:

1. Run the Access workflow to identify matching records (see Access).
2. For each matching record, verify that anonymization is enabled and rules are configured for the record's sObject type.

• If rules exist, send an update request to the record URL with anonymized field values.
• If no rules exist for a record type, DataGrail skips updates for that record.

note

• Salesforce Order Management Deletion requests do not delete records. DataGrail anonymizes records by updating configured fields.
• If Salesforce returns 400 (update not allowed) or 404 (record not found), DataGrail treats the record as completed and logs a warning.

Endpoints Utilized

Method	Endpoint	Purpose	Docs
GET	/search	Search for matching records
GET	/sobjects/sobject_name/object_id	Retrieve an sObject record
PATCH	/sobjects/sobject_name/object_id	Anonymize an sObject record
GET	/sobjects/sobject_name/describe/	Retrieve sObject metadata (used to find reference fields)

---