Salesforce Headless 360
BetaHeadless Salesforce org admin & integration via a discover/describe/dispatch meta-tool surface — users, Apex deploy, platform events, CDC, named credentials — governed by the org security model.
- Salesforce
- Admin
- DevOps
- Authentication
- OAuth 2.0
- Hosting
- Vendor-hosted endpoint
- Required scopes
- 2
- Data actions
- Read only
How it works
Every agent request passes through Ferentin policy before it reaches Salesforce Headless 360.
Runs on Salesforce infrastructure as a Hosted MCP Server over Streamable HTTP. Every transaction executes as the authenticated user via an External Client App with the mcp_api scope, and respects the full org security model: field-level security, object permissions, sharing rules, profiles, and permission sets. The dispatch / dispatch_readonly split lets policy restrict an agent to read-only operations. This is the admin/DevOps companion to the sobject-* CRM-data hosted servers on the salesforce card.
- AI agentAsks for something
- Ferentin policies
- OAuth 2.0 PKCE
- Field level security
- Object permissions
- Sharing rules
- Salesforce Headless 360 MCP serverAuthorized connection
- Governed resultMasked, logged, returned
What agents can do
4 tools · you choose which ones agents may callEvery tool this server exposes. You choose which ones agents may call.
- Discover APIs
- Describe API
- Dispatch API
- Dispatch read-only API
Permissions requested
The OAuth 2.0 scopes Salesforce Headless 360 asks you to approve when you connect.
| Scope | Access |
|---|---|
| mcp_api | Not rated |
| refresh_token | Not rated |
Before you connect
- Headless 360 presents four meta-tools (discover, describe, dispatch, dispatch_readonly) that fan out to ~100 setup/integration skills — the agent searches for a skill, reads its spec, then dispatches it. This is different from the sobject-* servers, which expose per-object CRUD tools.
- Headless 360 must be activated individually in Setup > MCP Servers before it can be used.
- All operations respect your Salesforce org security model: field-level security, object permissions, sharing rules, permission sets, and user profiles. dispatch executes writes; dispatch_readonly is the read-only variant.
- Only mcp_api and refresh_token scopes are required — do not add api, sfap_api, or einstein_gpt_api.
2 more technical notes
- Sandbox / scratch orgs use the /sandbox/ path prefix: https://api.salesforce.com/platform/mcp/v1/sandbox/platform/headless-360
- If your org uses a custom domain (My Domain), you may need to override the OAuth authorization URL to https://<your-domain>.my.salesforce.com/services/oauth2/authorize
About Salesforce Headless 360
Headless 360 is Salesforce's hosted MCP server for headless setup and integration. Instead of thousands of per-capability tools, it presents an agent with four meta-tools — discover, describe, dispatch, and dispatch_readonly — that fan out to ~100 skills covering user management, Apex trigger deployment, platform events, Change Data Capture, and named-credential configuration.
Frequently asked about Salesforce Headless 360
- What can AI agents do with Salesforce Headless 360 through Ferentin?
- Through Ferentin, agents can use Salesforce Headless 360 for operation discovery, operation describe, operation dispatch, read only dispatch, user management, apex deployment, platform events, change data capture, named credentials and org security enforcement. Every call is checked against your Ferentin policies first.
- How is Salesforce Headless 360 access secured?
- Requests through the Salesforce Headless 360 integration are covered by OAuth 2.0 PKCE, field level security, object permissions, sharing rules, permission sets, jwt access tokens, per user authorization and read only dispatch scoping. These controls are applied by Ferentin, not by Salesforce Headless 360, so they hold across every connected agent.
- What permissions does the Salesforce Headless 360 integration require?
- The Salesforce Headless 360 integration requests 2 OAuth 2.0 scopes: mcp_api; refresh_token
- How do I connect Salesforce Headless 360 to Ferentin?
- Open the Ferentin admin console, add Salesforce Headless 360 as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
- Is the Salesforce Headless 360 integration generally available?
- The Salesforce Headless 360 integration is currently beta on Ferentin.