Connecting to Salesforce (extractor)
Important
Any references to third-party products or services do not constitute Celonis Product Documentation nor do they create any contractual obligations. This material is for informational purposes only and is subject to change without notice.
Celonis does not warrant the availability, accuracy, reliability, completeness, or usefulness of any information regarding the subject of third-party services or systems.
The Celonis Salesforce extractor transfers operational data from your Salesforce instances into the Celonis Platform for process mining, visual analysis, and transformation. Connecting your Salesforce environment allows you to map, analyze, and optimize customer-facing workflows, such as isolating pipeline bottlenecks in Lead-to-Cash cycles or tracking contract execution delays.
The Salesforce extractor offers:
Select one of the three supported authentication protocols to connect your Salesforce instance:
Authentication method | Description | API / Technical details | Further information |
|---|---|---|---|
OAuth with Username/Password | Single sign-on via OAuth authentication. It uses the | Uses the Salesforce Platform REST API (latest version).
| For step-by-step app registration policies, see the Salesforce Connected Apps Hub. |
Stored credentials | Authentication using standard stored credentials. To configure this, you need a username and a password that has your Salesforce security token appended directly to the end of it. | Uses the Salesforce Platform SOAP API (version 63.0). | For required extraction API endpoints, see Salesforce data extraction endpoints. |
Salesforce client credentials | OAuth 2.0 authentication using a client ID and client secret directly from your Salesforce host tenant. | Requires an active client credentials flow within your Salesforce instance. | See: Salesforce - Configure a Client Credential Flow. |
To extract data from a Salesforce instance, configure user credentials with read and extraction access for the target process data. Create a custom profile in Salesforce with the following permissions enabled, then assign this profile to your dedicated extraction user account:
Administrative permissions:
API Enabled
API Only User (optional)
Approve uninstalled connect app permissions
Standard object permissions:
Select Read permissions for all objects you want to extract.
Select View all permissions for all objects you want to extract.
Custom object permissions:
Select Read permissions for all objects you want to extract.
For more information about users, profiles, and roles in Salesforce, see: Salesforce Help Center - Manage Users.
Watch this video for an overview of the configuration workflow:
To configure the extractor:
From your data pool diagram, select Data Connections.
Select Add Data Connection and select Connect to Data Source.
Select Cloud - Salesforce.
Configure the Basic Connection Details:
Name: Enter a unique identification string that references the source system and business process (for example,
Salesforce_Prod_LeadToCash).Salesforce Instance Type: Select either Production or Sandbox depending on the landscape you want to access.
Select your Authentication method and provide the corresponding credentials:
Authentication method
Required inputs / actions
OAuth with Username/Password
Log in via the standard OAuth flow. (Uses the Salesforce Platform REST API and jwt-bearer grant).
Stored Credentials
Enter your username and password.
Note: You must append your Salesforce security token directly to the end of your password. (Uses SOAP API v63.0).
Client Credentials
Enter the Client ID and Client Secret generated from your Salesforce host tenant. (Requires an active client credentials flow).
(Optional) Configure a Proxy service if your architecture uses middleware:
Tip
Using middleware provides an extra layer of security between your Salesforce instance and the Celonis Platform.
Authorize URL: Enter your corporate proxy authorization endpoint (for example,
https://proxy.internal.company.com/oauth/authorize).Token URL: Enter the gateway endpoint used to request security tokens (for example,
https://proxy.internal.company.com/oauth/token).Data URL: Enter the base routing URL used to route the extracted API data streams (for example,
https://proxy.internal.company.com/api/v63.0).
Select Save.
When the Salesforce authorization window opens, select Allow to complete the connection.
Once the connection between your Salesforce tenant and the Celonis Platform is active, manage connection parameters and extraction schedules by selecting Options:
 |
Review the extraction constraints and known behaviors for the Salesforce extractor before deploying your data pipeline:
The Salesforce Bulk API is unsupported for data extraction streams.
Salesforce API restrictions limit change history tracking to a maximum of 20 attributes per object. For example, when extracting the Opportunity object for an Order-to-Cash process pipeline, prioritize core process state attributes (such as `StageName` and `Amount`) to ensure critical event data transitions are captured within this limit.
The Salesforce extractor automatically calls specific REST API endpoints to stream process data into the Celonis Platform. Network security teams can use this directory to audit outbound traffic or configure gateway routing rules:
Endpoint | Description |
|---|---|
| Retrieves the list of available API versions. |
| Retrieves the list of all Salesforce objects. |
| Retrieves metadata for a specific object. |
| Retrieves all records, including deleted or archived ones, to calculate the number of records to be extracted. |
| Retrieves the actual data for extraction. |