Salesforce Bulk API Source Connector for Confluent Cloud

The fully managed Salesforce Bulk API Source connector for Confluent Cloud pulls records and captures changes from Salesforce.com into Apache Kafka® topics using the Salesforce Bulk Query API.

Note

• This Quick Start is for the fully managed Confluent Cloud connector. If you are installing the connector locally for Confluent Platform, see Salesforce Bulk API Source Connector for Confluent Platform.

• If you are using Salesforce Bulk API 2.0, see the Salesforce Bulk API 2.0 Source Connector for Confluent Cloud.

• If you require private networking for fully managed connectors, make sure to set up the proper networking beforehand. For more information, see Manage Networking for Confluent Cloud Connectors.

• The connector supports Salesforce up to API version 64.0.

Features

The Salesforce Bulk API Source connector provides the following features:

• At least once delivery: The connector guarantees that records are delivered at least once to the Kafka topic. If the connector restarts, there could be duplicate records in the Kafka topic.

• Supported data formats: The connector supports Avro, JSON Schema, Protobuf, or JSON (schemaless) output data. Schema Registry must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf).

• Tasks per connector: Organizations can run multiple connectors with a limit of one task per connector (that is, "tasks.max": "1").

• Supported SObjects: See the following lists for supported and unsupported Salesforce objects. See Confluent Cloud connector limitations for additional information.

Supported SObjects

The following Salesforce objects are supported by this connector:

• Account

• Campaign

• CampaignMember

• Case

• Contact

• Contract

• Event

• Group

• Lead

• Opportunity

• OpportunityContactRole

• OpportunityLineItem

• Period

• PricebookEntry

• Product2

• Task

• TaskFeed

• TaskRelation

• User

• UserRole

Unsupported SObjects

The following Salesforce objects are not supported by this connector:

• Feed (for example, AccountFeed and AssetFeed, etc.)

• Share (for example, AccountBrandShare and ChannelProgramLevelShare, etc.)

• History (for example, AccountHistory, ActivityHistory, etc.)

• EventRelation (for example, AcceptedEventRelation, DeclinedEventRelation, etc.)

• AggregateResult

• AttachedContentDocument

• CaseStatus

• CaseTeamMember

• CaseTeamRole

• CaseTeamTemplate

• CaseTeamTemplateMember

• CaseTeamTemplateRecord

• CombinedAttachment

• ContentFolderItem

• ContractStatus

• EventWhoRelation

• FolderedContentDocument

• KnowledgeArticleViewStat

• KnowledgeArticleVoteStat

• LookedUpFromActivity

• Name

• NoteAndAttachment

• OpenActivity

• OwnedContentDocument

• PartnerRole

• RecentlyViewed

• ServiceAppointmentStatus

• SolutionStatus

• TaskPriority

• TaskStatus

• TaskWhoRelation

• UserRecordAccess

• WorkOrderLineItemStatus

• WorkOrderStatus

• Supports Client Credentials flow: The connector supports authentication using the Client Credentials flow that enables connecting to Salesforce without exposing the user credentials. To use CLIENT_CREDENTIALS grant type, you must enable the Client Credentials flow in your connected Salesforce application and assign an integration user.

• Supports JWT Bearer flow: The connector supports authentication using the JWT Bearer flow, which authenticates using a JSON Web Token (JWT) signed with a private key instead of a username and password. To use the JWT_BEARER grant type, upload a JWT keystore file and provide the corresponding keystore password.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Connect Usage Examples section.

Limitations

Be sure to review the following information.

• For connector limitations, see Salesforce Bulk API Source Connector limitations.

• If you plan to use one or more Single Message Transformations (SMTs), see SMT Limitations.

Set up Salesforce authentication

Important

In accordance with the Salesforce Winter ‘27 release, Confluent will deprecate the OAuth 2.0 username-password flow (salesforce.grant.type=PASSWORD) for Salesforce connectors effective September 15, 2026. Update your connector configurations to use another supported auth grant type.

Salesforce connectors authenticate with Salesforce through a connected application or External Client App (ECA). A connected application is a metadata object in Salesforce that defines the protocol (OAuth), the permissions (scopes), and the security policies (for example, IP relaxation and user authorization) for an external application. The consumer key (client ID) and consumer secret (client secret) that you enter in the connector configuration are the credentials of this connected application.

The connector supports the following OAuth 2.0 grant types. You select the grant type using the salesforce.grant.type configuration property.

• CLIENT_CREDENTIALS: The connector authenticates with only the consumer key and consumer secret of the connected application. User credentials are not transmitted.

• JWT_BEARER: The connector authenticates with a JSON Web Token (JWT) signed with a private key.

Client Credentials flow

The OAuth 2.0 Client Credentials flow enables the connector to connect to Salesforce without exposing user credentials. Salesforce requires an execution user (the Run As user) for this flow. If no Run As user is defined in the connected application policies, authentication fails with an invalid_grant or no client credentials user enabled error.

Configure Salesforce

Complete the following steps in Salesforce before you create the connector.

1. Enable the client credentials flow:

   1. If you don’t already have a connected application for the connector, enable connected app creation first. Navigate to Setup > External Client App Settings and enable Allow creation of connected apps. This setting is hidden by default in new Salesforce organizations.

   2. Navigate to Setup > App Manager.

   3. Locate the connected application used for the connector, click the drop-down arrow, and select Edit.

   4. Under API (Enable OAuth Settings), select Enable Client Credentials Flow. This option is often disabled by default for older applications.

   5. Save the application definition.

2. Assign the execution user:

   1. Navigate to Setup > Manage Connected Apps, which is distinct from App Manager.

   2. Click the name of the connected application.

   3. Click Edit Policies.

   4. Scroll to the Client Credentials Flow section.

   5. In Run As, click the search icon and select the dedicated integration user (for example, integration.user@example.com).

      The Run As user must have the API Enabled permission and enough rights to access the objects the connector reads from or writes to.

Configure the connector

Set the following authentication properties in the connector configuration.

Configuration property	Value	Notes
salesforce.grant.type	CLIENT_CREDENTIALS	Select this grant type explicitly.
salesforce.consumer.key	Consumer key of the connected application.	Also called the client ID.
salesforce.consumer.secret	Consumer secret of the connected application.	Also called the client secret.
salesforce.instance	https://<your-domain>.my.salesforce.com	You must use your My Domain URL. The default value https://login.salesforce.com does not work for this grant type.
salesforce.username	Not used.	The execution user is defined in Salesforce.
salesforce.password	Not used.	The execution user is defined in Salesforce.

The client credentials flow requires your My Domain URL, for example, https://<your-domain>.my.salesforce.com, in the salesforce.instance property. When a client credentials request is sent to the generic https://login.salesforce.com endpoint, the Salesforce global router might fail to identify the tenant-specific policies required to look up the Run As user mapping, and authentication fails.

JWT Bearer flow

The OAuth 2.0 JWT bearer flow establishes trust through public-key cryptography and is the recommended authentication method for production environments. The connector signs a JWT with its private key, identifying the Salesforce user in the sub (subject) claim. Salesforce validates the signature using the public certificate uploaded to the connected application and issues an access token. The flow requires no interactive login or password, and is not affected by password expiration policies.

Configure JWT Bearer

Complete the following steps to configure the JWT bearer flow.

1. Generate a private key and certificate: Generate a private key and a self-signed certificate using OpenSSL. The following example sets the certificate validity to 3,650 days (10 years) to reduce maintenance overhead.

   openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 \
      -days 3650 -out public.crt
   

   The command generates the following files:

   • private.key: The private key the connector uses to sign the JWT.

   • public.crt: The public certificate you upload to Salesforce.

2. Create the Java keystore (JKS): The connector requires the private key in a JKS container and cannot read the raw PEM files directly.

   1. Convert the certificate and private key to PKCS12 format:

      openssl pkcs12 -export -in public.crt -inkey private.key \
         -out keystore.p12 -name salesforce-cert
      

      You are prompted to create an export password. This password becomes the keystore password used in the connector configuration.

   2. Import the PKCS12 file into a JKS keystore:

      keytool -importkeystore -srckeystore keystore.p12 \
         -srcstoretype pkcs12 -destkeystore salesforce.jks \
         -deststoretype JKS
      

      Upload the resulting salesforce.jks file when you configure the connector.

Configure the Salesforce connected application

Complete the following steps in Salesforce before you create the connector.

1. If you don’t already have a connected application for the connector, enable connected app creation first. Navigate to Setup > External Client App Settings and enable Allow creation of connected apps. This setting is hidden by default in new Salesforce organizations.

2. Navigate to Setup > App Manager and edit the connected application used for the connector.

3. Under API (Enable OAuth Settings), select Use digital signatures, click Choose File, and upload the public.crt file.

4. Ensure the api, refresh_token, and offline_access OAuth scopes are selected.

5. Pre-authorize users. Navigate to Setup > Manage Connected Apps, click Edit Policies, and change Permitted Users to Admin approved users are pre-authorized. The JWT Bearer flow is automated, and the connector cannot approve a consent screen, so you must be pre-authorized.

6. Assign profiles. In Manage Connected Apps, scroll to Profiles (or Permission Sets) and add the profile of the integration user, for example, a custom integration profile.

Configure the connector

Set the following authentication properties in the connector configuration.

Configuration property	Value	Notes
salesforce.grant.type	JWT_BEARER	Select this grant type explicitly.
salesforce.consumer.key	Consumer key of the connected application.	Also called the client ID.
salesforce.username	Username of the integration user	Sets the sub claim of the JWT. The username must match a user in the assigned profile.
salesforce.jwt.keystore.file	The salesforce.jks file	Upload the file when you configure the connector.
salesforce.jwt.keystore.password	Keystore password	The export password set during the PKCS12 conversion.
salesforce.instance	https://<your-domain>.my.salesforce.com	Use your My Domain URL for best results.
salesforce.password	Not used	Not required for this grant type.
salesforce.consumer.secret	Not used	The signed JWT replaces the consumer secret.

Troubleshoot authentication errors

The following table lists common authentication errors and how to resolve them.

Error	Grant type	Probable cause	Resolution
invalid_grant	CLIENT_CREDENTIALS	No Run As user is defined for the connected application.	Define the execution user in the connected application policies.
invalid_grant	CLIENT_CREDENTIALS	Wrong instance URL.	Set salesforce.instance to your My Domain URL.
invalid_app_access	CLIENT_CREDENTIALS	The user is not admin-approved to access the connected application.	In Manage Connected Apps, open the connected application, click Manage Profiles, and add the profile of the integration user.
invalid_client	All grant types	Wrong consumer key or consumer secret.	Verify the consumer key and consumer secret. Check for trailing spaces.
invalid_grant: audience is invalid	JWT_BEARER	Wrong audience in the JWT claim.	Ensure salesforce.instance matches the audience Salesforce expects, which is typically your My Domain URL.
ConnectException: Connection refused	All grant types	The network blocks the connection.	Check firewall and proxy settings, and verify that the Salesforce URL is reachable.
400 Bad Request	CLIENT_CREDENTIALS	The Client Credentials flow is disabled for the connected application.	In App Manager, edit the connected application and select Enable Client Credentials Flow.
Job creation failed	All grant types	The integration user has insufficient permissions.	Grant the integration user the API Enabled permission and create and read permissions on the target objects.

Quick Start

Use this quick start to get up and running with the Salesforce Bulk API Source connector. The quick start provides the basics of selecting the connector and configuring it to capture records and record changes from Salesforce.

Prerequisites

• Authorized access to a Confluent Cloud cluster on Amazon Web Services (AWS), Microsoft Azure (Azure), or Google Cloud.

• Salesforce account credentials.

• The Confluent CLI installed and configured for the cluster. See Install the Confluent CLI.

• Schema Registry must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf).

• At least one topic must exist in your Confluent Cloud cluster before creating the connector.

• For networking considerations, see Networking and DNS. To use a set of public egress IP addresses, see Public Egress IP Addresses for Confluent Cloud Connectors.

• Kafka cluster credentials. The following lists the different ways you can provide credentials.

  • Enter an existing service account resource ID.

  • Create a Confluent Cloud service account for the connector. Make sure to review the ACL entries required in the service account documentation. Some connectors have specific ACL requirements.

  • Create a Confluent Cloud API key and secret. To create a key and secret, you can use confluent api-key create or you can autogenerate the API key and secret directly in the Cloud Console when setting up the connector.

Using the Confluent Cloud Console

Step 1: Launch your Confluent Cloud cluster

To create and launch a Kafka cluster in Confluent Cloud, see Create a kafka cluster in Confluent Cloud.

Step 2: Add a connector

In the left navigation menu, click Connectors. If you already have connectors in your cluster, click + Add connector.

Step 3: Select your connector

Click the Salesforce Bulk API Source connector card.

Important

At least one topic must exist in your Confluent Cloud cluster before creating the connector.

Step 4: Enter the connector details

Note

• Make sure you have all your prerequisites completed.

• An asterisk ( * ) designates a required entry.

At the Add Salesforce Bulk API Source Connector screen, complete the following:

Topic selection

Select the topic you want to send data to from the Topics list. To create a new topic, click +Add new topic.

Kafka access

1. Select the way you want to provide Kafka Cluster credentials. You can choose one of the following options:

   • My account: This setting allows your connector to globally access everything that you have access to. With a user account, the connector uses an API key and secret to access the Kafka cluster. This option is not recommended for production.

   • Service account: This setting limits the access for your connector by using a service account. This option is recommended for production.

   • Use an existing API key: This setting allows you to specify an API key and a secret pair. You can use an existing pair or create a new one. This method is not recommended for production environments.

   Note

   Freight clusters support only service accounts for Kafka authentication.

2. Click Continue.

Authentication

1. Configure the authentication properties:

   • Salesforce grant type: Grant type that the connector uses for Salesforce authentication: PASSWORD, CLIENT_CREDENTIALS, or JWT_BEARER.

   Salesforce details

   • Salesforce instance: The URL of the Salesforce endpoint to use. The default is https://login.salesforce.com. This directs the connector to use the endpoint specified in the authentication response.

   • Salesforce username: The Salesforce username for the connector to use.

   • Salesforce password: The Salesforce password for the connector to use.

   • Salesforce password token: The Salesforce security token associated with the username.

   • Salesforce consumer key: Client ID (consumer key) for the Salesforce connected app. Required for the JWT_BEARER and CLIENT_CREDENTIALS grant types.

   • Salesforce consumer secret: Client secret (consumer secret) for the Salesforce connected app. The JWT_BEARER grant signs an assertion instead and does not use it.

   • Salesforce JWT keystore file: Keystore file that stores the private key for JWT authentication.

   • Salesforce JWT keystore password: Password that unlocks the JWT keystore file.

2. Click Continue.

Configuration

• Salesforce Object: The Salesforce object to create a topic for.

• Salesforce since: CreatedDate after which the records should be pulled. The time is in UTC and has the required format: yyyy-MM-dd.

Output messages

• Select output record value format: Select the output record value format (data going to the Kafka topic). Valid values are AVRO, JSON, JSON_SR (JSON Schema), or PROTOBUF. Schema Registry must be enabled to use a Schema Registry-based format (for example, Avro, JSON Schema, or Protobuf).

Show advanced configurations

• Schema context: Select a schema context to use for this connector, if using a schema-based data format. This property defaults to the Default context, which configures the connector to use the default schema set up for Schema Registry in your Confluent Cloud environment. A schema context allows you to use separate schemas (like schema sub-registries) tied to topics in different Kafka clusters that share the same Schema Registry environment. For example, if you select a non-default context, a Source connector uses only that schema context to register a schema and a Sink connector uses only that schema context to read from. For more information about setting up a schema context, see What are schema contexts and when should you use them?.

• Poll interval (ms): Set the time in milliseconds to wait for new change events when no data is returned. Default is 500 ms.

• Enable Batching: Enables batching by applying PK-chunking. The default value is TRUE.

Additional Configs

• Value Converter Decimal Format: Specifies the JSON or JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals: BASE64 to serialize DECIMAL logical types as base64 encoded binary data, and NUMERIC to serialize DECIMAL logical type values in JSON or JSON_SR as a number representing the decimal value.

• value.converter.replace.null.with.default: Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter.

• Key Converter Schema ID Serializer: The class name of the schema ID serializer for keys. This is used to serialize schema IDs in the message headers.

• Value Converter Reference Subject Name Strategy: Sets the subject reference name strategy for values. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. You can use this strategy only with PROTOBUF format; the default strategy is DefaultReferenceSubjectNameStrategy.

• value.converter.schemas.enable: Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter.

• errors.tolerance: Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records.

• Value Converter Connect Meta Data: Enables the Connect converter to add its metadata to the output schema. Applies to Avro converters.

• Value Converter Value Subject Name Strategy: Determines how to construct the subject name under which the value schema is registered with Schema Registry.

• Key Converter Key Subject Name Strategy: Determines how to construct the subject name for key schema registration.

• value.converter.ignore.default.for.nullables: When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters.

• Value Converter Schema ID Serializer: The class name of the schema ID serializer for values. This is used to serialize schema IDs in the message headers.

Auto-restart policy

• Enable Connector Auto-restart: Enables the auto-restart behavior of the connector and its task in the event of user-actionable errors. Defaults to true, enabling the connector to automatically restart in case of user-actionable errors. Set this property to false to disable auto-restart for failed connectors. If disabled, you must manually restart the connector.

Connection details

• Max Retry Time in Milliseconds: In case of error when making a request to Salesforce, the connector retries until this time (in milliseconds) elapses.

Transforms

• Single Message Transformations: To add a new SMT, see Add transforms. For more information about unsupported SMTs, see Unsupported transformations.

Processing position

• Set offsets: Click Set offsets to define a specific offset for this connector to begin procession data from. For more information on managing offsets, see Manage offsets.

For all property values and definitions, see Configuration Properties.

• Click Continue.

Sizing

Based on the number of topic partitions you select, you will be provided with a recommended number of tasks.

1. To change the number of tasks, use the Range Slider to select the desired number of tasks.

2. Click Continue.

Review and Launch

1. Verify the connection details by previewing the running configuration.

   Tip

   For information about previewing your connector output, see Data Previews for Confluent Cloud Connectors.

   

2. After you’ve validated that the properties are configured to your satisfaction, click Launch.

   The status for the connector should go from Provisioning to Running.

   

Step 5: Check the Kafka topic

After the connector is running, verify that messages are populating your Kafka topic.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Connect Usage Examples section.

Using the Confluent CLI

Complete the following steps to set up and run the connector using the Confluent CLI.

Important

• Make sure you have all your prerequisites completed.

• At least one topic must exist in your Confluent Cloud cluster before creating the connector.

Step 1: List the available connectors

Enter the following command to list available connectors:

confluent connect plugin list

Step 2: List the connector configuration properties

Enter the following command to show the connector configuration properties:

confluent connect plugin describe <connector-plugin-name>

The command output shows the required and optional configuration properties.

Step 3: Create the connector configuration file

Create a JSON file that contains the connector configuration properties. The following example shows the required connector properties.

{
  "connector.class": "SalesforceBulkApiSource",
  "name": "SalesforceBulkApiSource_0",
  "kafka.auth.mode": "KAFKA_API_KEY",
  "kafka.api.key": "<my-kafka-api-key>",
  "kafka.api.secret": "<my-kafka-api-secret>",
  "kafka.topic": "TestBulkAPI",
  "salesforce.instance": "https://login.salesforce.com",
  "salesforce.username": "<my-username>",
  "salesforce.password": "**************",
  "salesforce.password.token": "************************",
  "salesforce.object": "<SObject-name>",
  "output.data.format": "JSON",
  "tasks.max": "1"
}

Note the following property definitions:

• "connector.class": Identifies the connector plugin name.

• "name": Sets a name for your new connector.

• "kafka.auth.mode": Identifies the connector authentication mode you want to use. There are two options: SERVICE_ACCOUNT or KAFKA_API_KEY (the default). To use an API key and secret, specify the configuration properties kafka.api.key and kafka.api.secret, as shown in the example configuration (above). To use a service account, specify the Resource ID in the property kafka.service.account.id=<service-account-resource-ID>. To list the available service account resource IDs, use the following command:

  confluent iam service-account list
  

  For example:

  confluent iam service-account list
  
     Id     | Resource ID |       Name        |    Description
  +---------+-------------+-------------------+-------------------
     123456 | sa-l1r23m   | sa-1              | Service account 1
     789101 | sa-l4d56p   | sa-2              | Service account 2
  

• ""kafka.topic": Enter a Kafka topic name. A topic must exist before launching the connector.

• ""salesforce.<...>"": Enter the required Salesforce connection details.

• ""salesforce.object"": The SObject that the connector polls for new and changed records.

• "output.data.format": Sets the output Kafka record value format (data coming from the connector). Valid entries are AVRO, JSON_SR, PROTOBUF, or JSON. You must have Confluent Cloud Schema Registry configured if using a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf).

• "tasks.max": Enter the number of tasks in use by the connector. Organizations can run multiple connectors with a limit of one task per connector (that is, "tasks.max": "1").

SMTs: For details about adding SMTs using the Confluent CLI, see the Single Message Transformations documentation.

See Configuration Properties for all property values and descriptions.

Step 4: Load the properties file and create the connector

Enter the following command to load the configuration and start the connector:

confluent connect cluster create --config-file <file-name>.json

For example:

confluent connect cluster create --config-file salesforce-bulk-api-source.json

Example output:

Created connector SalesforceBulkApiSource_0 lcc-aj3qr

Step 5: Check the connector status

Enter the following command to check the connector status:

confluent connect cluster list

Example output:

ID          |            Name              | Status  |  Type
+-----------+------------------------------+---------+-------+
lcc-aj3qr   | SalesforceBulkApiSource_0    | RUNNING | source

Step 6: Check the Kafka topic.

After the connector is running, verify that messages are populating your Kafka topic.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Connect Usage Examples section.

Configuration Properties

Use the following configuration properties with the fully managed connector. For self-managed connector property definitions and other details, see the connector docs in Self-managed connectors for Confluent Platform.

How should we connect to your data?

name

Sets a name for your connector.

• Type: string

• Valid Values: A string at most 64 characters long

• Importance: high

Kafka Cluster credentials

kafka.auth.mode

Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode, whenever possible.

• Type: string

• Valid Values: SERVICE_ACCOUNT, KAFKA_API_KEY

• Importance: high

kafka.api.key

Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.

• Type: password

• Importance: high

kafka.service.account.id

The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.

• Type: string

• Importance: high

kafka.api.secret

Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.

• Type: password

• Importance: high

Which topic do you want to send data to?

kafka.topic

Identifies the topic name to write the data to.

• Type: string

• Importance: high

Schema Config

schema.context.name

Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.

• Type: string

• Default: default

• Importance: medium

How should we connect to Salesforce?

salesforce.grant.type

Grant type the connector uses for Salesforce authentication: PASSWORD, CLIENT_CREDENTIALS, or JWT_BEARER

• Type: string

• Default: PASSWORD

• Importance: high

salesforce.instance

The URL of the Salesforce endpoint to use. The default is https://login.salesforce.com. This directs the connector to use the endpoint specified in the authentication response. For the CLIENT_CREDENTIALS grant type, set this to your org’s My Domain URL (for example https://MyDomainName.my.salesforce.com).

• Type: string

• Default: https://login.salesforce.com

• Importance: high

salesforce.username

The Salesforce username the connector should use.

• Type: string

• Importance: high

salesforce.password

The Salesforce password the connector should use.

• Type: password

• Importance: high

salesforce.password.token

The Salesforce security token associated with the username.

• Type: password

• Importance: high

salesforce.consumer.key

Client ID (consumer key) for the Salesforce connected app. Required for the JWT_BEARER and CLIENT_CREDENTIALS grant types.

• Type: password

• Importance: high

salesforce.consumer.secret

Client secret (consumer secret) for the Salesforce connected app. The JWT_BEARER grant signs an assertion instead and does not use it.

• Type: password

• Importance: medium

salesforce.jwt.keystore.file

Keystore file that stores the private key for JWT authentication

• Type: password

• Default: [hidden]

• Importance: medium

salesforce.jwt.keystore.password

Password that unlocks the JWT keystore file

• Type: password

• Importance: medium

salesforce.object

The Salesforce object to create topic for.

• Type: string

• Importance: high

poll.interval.ms

How often to query Salesforce for new records.

• Type: int

• Default: 30000 (30 seconds)

• Valid Values: [8700,…,300000]

• Importance: medium

salesforce.since

CreatedDate after which the records should be pulled. Note that the time is in UTC and has required format: yyyy-MM-dd.

• Type: string

• Importance: medium

batch.enable

Enable batching by applying PK-chunking. The default value is TRUE.

• Type: boolean

• Default: true

• Importance: low

Connection details

request.max.retries.time.ms

In case of error when making a request to Salesforce, the connector will retry until this time (in ms) elapses. The default value is 30000 (30 seconds). Minimum value is 1 sec

• Type: long

• Default: 30000 (30 seconds)

• Valid Values: [1000,…,250000]

• Importance: low

Output messages

output.data.format

Sets the output Kafka record value format. Valid entries are AVRO, JSON_SR, PROTOBUF, or JSON. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF

• Type: string

• Default: JSON

• Importance: high

Number of tasks for this connector

tasks.max

Maximum number of tasks for the connector.

• Type: int

• Valid Values: [1,…]

• Importance: high

Additional Configs

header.converter

The converter class for the headers. This is used to serialize and deserialize the headers of the messages.

• Type: string

• Importance: low

producer.override.compression.type

The compression type for all data generated by the producer. Valid values are none, gzip, snappy, lz4, and zstd.

• Type: string

• Importance: low

producer.override.linger.ms

The producer groups together any records that arrive in between request transmissions into a single batched request. More details can be found in the documentation: https://docs.confluent.io/platform/current/installation/configuration/producer-configs.html#linger-ms.

• Type: long

• Valid Values: [100,…,1000]

• Importance: low

value.converter.allow.optional.map.keys

Allow optional string map key when converting from Connect Schema to Avro Schema. Applicable for Avro Converters.

• Type: boolean

• Importance: low

value.converter.auto.register.schemas

Specify if the Serializer should attempt to register the Schema.

• Type: boolean

• Importance: low

value.converter.connect.meta.data

Allow the Connect converter to add its metadata to the output schema. Applicable for Avro Converters.

• Type: boolean

• Importance: low

value.converter.enhanced.avro.schema.support

Enable enhanced schema support to preserve package information and Enums. Applicable for Avro Converters.

• Type: boolean

• Importance: low

value.converter.enhanced.protobuf.schema.support

Enable enhanced schema support to preserve package information. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.flatten.unions

Whether to flatten unions (oneofs). Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.generate.index.for.unions

Whether to generate an index suffix for unions. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.generate.struct.for.nulls

Whether to generate a struct variable for null values. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.int.for.enums

Whether to represent enums as integers. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.latest.compatibility.strict

Verify latest subject version is backward compatible when use.latest.version is true.

• Type: boolean

• Importance: low

value.converter.object.additional.properties

Whether to allow additional properties for object schemas. Applicable for JSON_SR Converters.

• Type: boolean

• Importance: low

value.converter.optional.for.nullables

Whether nullable fields should be specified with an optional label. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.optional.for.proto2

Whether proto2 optionals are supported. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.scrub.invalid.names

Whether to scrub invalid names by replacing invalid characters with valid characters. Applicable for Avro and Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.use.latest.version

Use latest version of schema in subject for serialization when auto.register.schemas is false.

• Type: boolean

• Importance: low

value.converter.use.optional.for.nonrequired

Whether to set non-required properties to be optional. Applicable for JSON_SR Converters.

• Type: boolean

• Importance: low

value.converter.wrapper.for.nullables

Whether nullable fields should use primitive wrapper messages. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

value.converter.wrapper.for.raw.primitives

Whether a wrapper message should be interpreted as a raw primitive at root level. Applicable for Protobuf Converters.

• Type: boolean

• Importance: low

errors.tolerance

Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records.

• Type: string

• Default: none

• Importance: low

key.converter.key.schema.id.serializer

The class name of the schema ID serializer for keys. This is used to serialize schema IDs in the message headers.

• Type: string

• Default: io.confluent.kafka.serializers.schema.id.PrefixSchemaIdSerializer

• Importance: low

key.converter.key.subject.name.strategy

How to construct the subject name for key schema registration.

• Type: string

• Default: TopicNameStrategy

• Importance: low

value.converter.decimal.format

Specify the JSON/JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals:

BASE64 to serialize DECIMAL logical types as base64 encoded binary data and

NUMERIC to serialize Connect DECIMAL logical type values in JSON/JSON_SR as a number representing the decimal value.

• Type: string

• Default: BASE64

• Importance: low

value.converter.flatten.singleton.unions

Whether to flatten singleton unions. Applicable for Avro and JSON_SR Converters.

• Type: boolean

• Default: false

• Importance: low

value.converter.ignore.default.for.nullables

When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters.

• Type: boolean

• Default: false

• Importance: low

value.converter.reference.subject.name.strategy

Set the subject reference name strategy for value. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. Note that the subject reference name strategy can be selected only for PROTOBUF format with the default strategy being DefaultReferenceSubjectNameStrategy.

• Type: string

• Default: DefaultReferenceSubjectNameStrategy

• Importance: low

value.converter.replace.null.with.default

Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter.

• Type: boolean

• Default: true

• Importance: low

value.converter.schemas.enable

Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter.

• Type: boolean

• Default: false

• Importance: low

value.converter.value.schema.id.serializer

The class name of the schema ID serializer for values. This is used to serialize schema IDs in the message headers.

• Type: string

• Default: io.confluent.kafka.serializers.schema.id.PrefixSchemaIdSerializer

• Importance: low

value.converter.value.subject.name.strategy

Determines how to construct the subject name under which the value schema is registered with Schema Registry.

• Type: string

• Default: TopicNameStrategy

• Importance: low

Auto-restart policy

auto.restart.on.user.error

Enable connector to automatically restart on user-actionable errors.

• Type: boolean

• Default: true

• Importance: medium

Frequently asked questions

Find answers to frequently asked questions about the Salesforce Bulk API Source connector for Confluent Cloud.

Authentication and connection

Why am I getting 401 Unauthorized or INVALID_SESSION_ID errors intermittently?

Salesforce session management issues cause these authentication errors:

org.apache.kafka.connect.errors.ConnectException: Exception encountered while calling salesforce
Caused by: com.sforce.soap.partner.fault.UnexpectedErrorFault: INVALID_SESSION_ID

Common causes:

• External login scripts or processes that use the same Salesforce user account can invalidate the connector’s session.

• Salesforce’s shared-session behavior might allow multiple logins with the same credentials can conflict.

• Session timeout or expiration based on Salesforce security policies.

Resolution:

• Use dedicated service accounts: Create a dedicated Salesforce user account exclusively for the connector to avoid session conflicts.

• Verify credentials: Verify that your Salesforce credentials (password, security token, consumer key/secret) remain current and have not expired.

• Check Salesforce session settings: Review your Salesforce organization’s session timeout and security policies in Setup > Session Settings.

• Monitor connector logs: The connector automatically attempts to reconnect and re-authenticate. If errors persist, check for underlying authentication issues.

For more information, see How to bypass INVALID_SESSION_ID Error within Salesforce Bulk API Source Connector.

Data ingestion and schema

Why is my connector running but not processing any data?

The Salesforce Bulk API Source connector requires both CreatedDate and LastModifiedDate fields to incrementally query data from Salesforce objects. If your Salesforce object lacks these fields, the connector runs without processing any data.

Common objects without required fields:

• GroupMember: Missing both CreatedDate and LastModifiedDate

• UserRole: Missing CreatedDate

• PermissionSetAssignment: Missing LastModifiedDate

• CaseHistory: Missing LastModifiedDate

Resolution:

• Verify object support: Verify that your Salesforce object has both CreatedDate and LastModifiedDate fields before configuring the connector. See Supported and Unsupported SObjects for a list of supported and unsupported SObjects.

• Alternative approaches: For objects without these fields, consider:

  • Using the Salesforce CDC Source connector if change data capture is enabled for the object.

  • Using the Salesforce Platform Event Source connector for event-based data.

  • Using the Salesforce Bulk API 2.0 Source connector, which may offer additional support for custom queries in future releases.

Note

Detailed log analysis at the TRACE level identifies this limitation, rather than explicit error messages.

Why are some fields missing after I updated my Salesforce object definition?

When you add new fields to a Salesforce object, the connector might not immediately recognize them. The connector caches the Salesforce object metadata during the authentication and handshake phase at connector startup.

To ensure the connector processes new fields:

1. Restart the connector: This refreshes the cached Salesforce object metadata and ensures the connector recognizes newly added fields.

2. Verify field visibility: Ensure the Salesforce user has field-level security permissions to access the new fields.

3. Check topic messages: Review messages in your Kafka topic to confirm all expected fields are being ingested.

Note

The connector does not automatically detect schema changes. You must manually restart the connector after modifying the Salesforce object definition. For fully managed connectors, make any minor configuration change ,such as batch size or timeout, and re-deploy the connector to restart the tasks.

Can I query multiple Salesforce objects with a single connector instance?

No, the Salesforce Bulk API Source connector currently supports only one Salesforce object (SObject) per connector instance.

Workaround:

Deploy multiple connector instances, one for each Salesforce object you want to query. Each connector can write to a different Kafka topic.

Why am I getting 400 Bad Request errors related to field access permissions?

The connector fails with a 400 Bad Request error when it attempts to query fields that the Salesforce user does not have read access to:

Salesforce Bulk API Source Connector is failing with 400 Bad Request error related to field access permissions

Common causes:

• The Salesforce object has new fields, but the connector’s Salesforce user does not have read permissions for these fields.

• Field-level security settings in Salesforce prevent the connector from accessing certain fields.

Resolution:

1. Grant field-level read permissions: In Salesforce, navigate to Setup > Security > Field-Level Security and grant the connector’s user account read access to all fields that need to be ingested.

2. Review object permissions: Ensure the connector’s user profile has appropriate object and field-level permissions.

3. Restart the connector: After updating permissions, restart the connector to pick up the changes.

Warning

Salesforce schema changes cause this issue to recur. If you do not control the deployment of new fields, proactively monitor for field additions and grant permissions to prevent streaming interruptions.

Performance and configuration

How do I avoid hitting Salesforce API limits?

Salesforce enforces daily API limits based on your organization’s edition and license type. Be aware of the following Bulk API specific limits:

• Daily API limit: Varies by Salesforce edition (typically 15,000 to 1,000,000 API calls per 24 hours)

• Concurrent Bulk API job limit: Up to 5 concurrent jobs per user (may vary based on Salesforce edition)

Best practices:

• Configure polling interval: Increase the poll.interval.ms property to reduce the frequency of API calls. The default is 30000 ms (30 seconds). Consider setting it to 300000 ms (five minutes) or higher based on your data freshness requirements.

• Monitor API usage: Use Salesforce Setup Console (Setup > System Overview > API Usage) to monitor your current API usage and remaining limits.

• Use appropriate connector types: For real-time data changes, consider using Salesforce CDC Source connector which uses the Streaming API instead of REST/Bulk API.

• Limit the number of connectors: Since each connector instance can only handle one Salesforce object, deploying many connectors can quickly exhaust API limits. Plan your connector deployments accordingly.

Common error:

Organization total events daily limit exceeded

This error occurs when the Salesforce organization exceeds its daily API limit. Restart the connector once the limit resets.

For more information, see Salesforce API Limits.

Why am I getting Read timed out (SocketTimeoutException) errors?

Read timeout errors occur when the connector cannot retrieve data from Salesforce within the configured timeout period:

java.net.SocketTimeoutException: Read timed out

Common causes:

• The Salesforce object contains a very large number of records.

• Complex Salesforce object relationships or triggers that slow down query execution.

• Network latency between Confluent Cloud and Salesforce.

• Salesforce server-side performance issues.

Resolution:

• Increase polling interval: Increase the poll.interval.ms property to give Salesforce more time between queries.

• Verify Salesforce performance: Check with your Salesforce administrators to ensure the object and any associated triggers or workflows are performing optimally.

• Compare with other objects: If you have multiple connectors querying different Salesforce objects from the same organization, compare their performance. If only one object experiences timeouts, the issue is likely specific to that object’s configuration or data volume.

• Consider Bulk API 2.0: The Salesforce Bulk API 2.0 Source connector may offer better performance for large data volumes. It includes a configurable result.max.rows property that can help reduce the amount of data retrieved per API call.

Troubleshooting

How do I troubleshoot connector failures or check connector logs?

For fully managed connectors in Confluent Cloud:

1. Check connector status: In the Confluent Cloud Console, navigate to your connector and check its status and any error messages displayed.

2. Review connector metrics: Monitor metrics such as records processed, errors, and throughput in the Confluent Cloud Console.

3. Access connector logs: Connector logs are available through the Confluent Cloud Console. Navigate to your connector and click on the Logs tab to view detailed error messages and stack traces.

4. Common log locations: For API access to logs, see the Confluent Cloud API documentation.

For assistance, contact Confluent Support with your connector ID, cluster ID, and relevant error messages.

Next Steps

For an example that shows fully managed Confluent Cloud connectors in action with Confluent Cloud for Apache Flink, see the Cloud ETL Demo. This example also shows how to use Confluent CLI to manage your resources in Confluent Cloud.