noombat
Start for free

Integrations · Salesforce

Connect Salesforce to noombat

A one-way, read-only connection. noombat reads your CRM on a schedule and writes nothing back. A Salesforce admin completes the setup in about 20 minutes.

Talk to usAll integrations

Direction

noombat reads from it

Access

A read-only integration user with a permission set of its own

Time

About 20 minutes

Who

A System Administrator

Cost on your side

Usually nothing: five Salesforce Integration licences come with Enterprise, Unlimited and Performance

Before you start

What to have ready.

  • System Administrator access to your Salesforce org.
  • Enterprise, Unlimited or Performance edition: API access is included, and so are five free Salesforce Integration user licences. Beyond five they cost about $10 per user per month.
  • Professional edition: API access is a paid add-on there. Talk to us before setting up and we work out the route together.

What noombat reads

What noombat reads from Salesforce, and why.

Accountthe companies you sell to
Contactthe people at those companies
Leadprospects you have yet to qualify
Opportunitypipeline and revenue outcomes
OpportunityContactRolewho was involved in each deal
RecordTypehow you classify records
Campaign and CampaignMemberoptional, if you track campaigns
Task and Eventcalls and meetings; visibility follows the related record
Userrecord owners, for attribution
EmailMessagelogged emails; access follows the parent record

Setup

6 steps, about 20 minutes.

  1. 1Create the integration user
  2. 2Assign the permission set licence
  3. 3Create the read-only permission set
  4. 4Create the External Client App
  5. 5If you use Einstein Activity Capture
  6. 6Send us the connection details
  1. 1

    Create the integration user about 3 minutes

    A dedicated account keeps noombat's access separate from any person: auditable on its own, unaffected by staff changes, revocable in one click.

    Setup > Users > New User

    • Name: noombat Integration
    • Email: integrations@noombat.ai. We monitor this inbox and handle the verification emails.
    • User License: Salesforce Integration
    • Profile: Minimum Access, API Only Integrations
  2. 2

    Assign the permission set licence about 1 minute, and the most-missed step

    The Integration user licence needs a companion permission set licence before CRM objects can be granted to it. Without it, step 3 fails with "The user license doesn't allow the permission: Read Accounts".

    Setup > Users > (the noombat user) > Permission Set License Assignments > Edit

    Tick Salesforce API Integration and save.

  3. 3

    Create the read-only permission set about 8 minutes

    Setup > Permission Sets > New

    • Label: noombat Read-Only
    • License: Salesforce API Integration, the permission set licence from step 2. With the user licence selected instead, the CRM objects disappear from Object Settings.

    Under System Permissions:

    • API Enabled: required; without it, queries fail even with a valid connection.
    • Access Activities: lets the user read calls and meetings on your records.
    • View All Users: a read-only user list, so records can be attributed to owners.
    • View Setup and Configuration: optional; if it refuses to enable on this licence, skip it.
    • Modify All Data and View All Data: please leave both off. We do not want them.

    Under Object Settings, for each object in the list above: tick Read and View All, and leave Create, Edit and Delete off. Field-level security stays yours: exclude any sensitive field and we never receive it.

    Finally, assign the permission set to the noombat user:

    Permission Set > Manage Assignments > Add Assignment

  4. 4

    Create the External Client App about 6 minutes

    This registers noombat as an application in your org and produces the Consumer Key and Secret we connect with. Salesforce no longer allows creating classic Connected Apps; External Client App is the current mechanism.

    Setup > External Client App Manager > New External Client App

    • Enable OAuth Settings: yes
    • Callback URL: https://noombat.ai/api/oauth/salesforce/callback
    • OAuth scope: "Manage user data via APIs (api)", exactly this one
    • Permitted Users: Admin approved users are pre-authorized

    Then, on the app's policies:

    • Policies > OAuth Policies: tick Enable Client Credentials Flow and set the noombat integration user as the Run As user.
    • Policies > Permitted Users > Manage Permission Sets: add the noombat Read-Only permission set, so the pre-authorisation includes our user.
  5. 5

    If you use Einstein Activity Capture about 1 minute

    Einstein Activity Capture stores captured emails and meetings outside the Salesforce database, where no API can read them. One setting brings the emails back in reach.

    Setup > Einstein Activity Capture > Settings

    Enable Sync Email as Salesforce Activity. Captured emails then become Task and EmailMessage records that reports, automations and noombat can read. Meetings captured only by Einstein stay outside the API; meetings logged as Salesforce Events by reps or a booking tool are read normally. If most of your meetings live only in Einstein, tell us and we plan around it.

  6. 6

    Send us the connection details about 2 minutes

    • Your My Domain login URL, e.g. yourco.my.salesforce.com
    • The Consumer Key and Consumer Secret, from the app's Settings > OAuth Settings. Salesforce emails you a verification code first, then reveals both values.
    • The integration user's username
    • Whether this is Production or a Sandbox

    Once the details arrive we run a read-only verification the same day, connecting as the integration user and checking that each object returns what it should, and confirm back to you. If anything is off, we name the exact setting to adjust; the table below lists everything it could be.

Troubleshooting

What you might see, and the fix.

Every row is a failure we have met or verified. If yours is missing, send it over.

What you seeWhyFix
"Can't assign permission set. The user license doesn't allow the permission: Read Accounts"The user does not have the Salesforce API Integration permission set licence yet.Step 2: assign the permission set licence on the user first, then the permission set.
Account, Contact and other CRM objects are missing from the permission set's Object SettingsThe permission set's License field is set to Salesforce Integration (the user licence) or another entry.Step 3: recreate the permission set with License = Salesforce API Integration.
Task, Event, User or EmailMessage are missing from Object SettingsExpected: these follow other permissions in Salesforce's model.Step 3: see the box on the four objects you will not find.
invalid_grant: "no client credentials user enabled"The Client Credentials flow is off on the app, or no Run As user is set.Step 4: OAuth Policies, enable the Client Credentials Flow and set the integration user as Run As.
invalid_app_access: "user is not admin approved to access this app"The app is restricted to pre-authorised users, and the integration user is missing from its list.Step 4: Policies > Permitted Users > Manage Permission Sets, add the noombat permission set.
The token works, and every query fails with INVALID_SESSION_IDThe app carries the wrong OAuth scope (usually the sfap_api lookalike), or API Enabled is missing.Step 4: the scope must be "Manage user data via APIs (api)". Step 3: tick API Enabled.
Queries work, and record counts are a fraction of what you expectView All is missing on some objects, so sharing rules filter what the user sees.Step 3: tick View All, and Read, on each object in the list.

Security and data

The questions a security review asks.

Is this read-only?

Yes, and Salesforce itself enforces it. The permission set grants Read only, with no Create, Edit or Delete on any object, so the platform rejects any write attempt. We also ask you to leave Modify All Data and View All Data off.

The Salesforce API Integration licence lists Modify All Data. Does noombat get that?

No. That list is a catalogue. Salesforce's documentation says it directly: "For users to access additional license functionality, they must both be assigned the permission set license and a permission set containing the feature permissions." The user has what your permission set enables, which is Read plus View All. You can verify on the user record: Modify All Data appears nowhere.

What does noombat read, and why?

Accounts, contacts and leads (who you sell to), opportunities (pipeline and revenue), and the calls, meetings and emails logged on those records. noombat keeps a read-only mirror, scores your market against it, and connects the companies it names to the meetings and revenue that follow. History matters: the scoring learns from what already happened, which is why a forward-only feed such as a webhook is too little.

Can we keep specific fields private?

Yes. Field-level security stays entirely in your hands: exclude any field from the permission set's field permissions and we never receive it. The connection works without non-essential fields.

What does this cost on the Salesforce side?

Usually nothing. Enterprise, Unlimited and Performance editions include five free Salesforce Integration user licences, API-only users made for exactly this; beyond five they cost about $10 per user per month. Professional edition sells API access as an add-on, so talk to us before setting up.

Could we send a webhook instead?

A webhook pushes one object's changes in real time and stops there: it sends changes from today on, while noombat learns from the existing history; each object needs an automation built and kept on your side; and a receiver ends up calling the API for the full record anyway. We add webhooks on top of API access for time-sensitive events when a customer asks.

How do we revoke access?

At once, from your side, in either of two ways: freeze or deactivate the integration user, or revoke the External Client App. Access ends immediately and nothing on our side can restore it. If the Consumer Secret is ever compromised, rotate it in the app settings.

Can we audit what noombat reads?

Yes. Every API call runs as the single dedicated integration user, so your login history and event logs show what was read and when, attributable to noombat alone. The account has no UI access: the Salesforce Integration licence is API-only, so there is no password to phish and no screen to look at.

Is our data safe with noombat?

Your data is kept apart from every other customer's, in a schema of its own, encrypted in transit and at rest, read through connections that write nothing back, and deleted when we part ways. Data-processing terms written for a security review, for teams in the EU and in the US. We walk through them with your security team on request.

Checked against Salesforce's own documentation. Last updated . Questions, or a policy in the way: integrations@noombat.ai

Bring your Salesforce admin and we do it together.

A 30-minute call on your market, and the setup above on a screen share if you want it.

Talk to usSee the product

Other integrations

noombat reads from it

HubSpot

A private app with read scopes only. No user seat, one token, and a rotation or a deletion cuts access at once.

About 10 minutes · A super admin

noombat reads from it

Pipedrive

A dedicated integration user with the fewest write permissions Pipedrive allows and one API token. Regenerate the token and access ends at once.

About 15 minutes · A Pipedrive admin

noombat reads from it

Attio

An access token with read scopes and an optional webhook. noombat mirrors your book and writes nothing back.

About 10 minutes · A workspace admin

All integrations · checked 10 October 2026