All the Locked Doors
Module 1 of 7 in the chapter Salesforce as an API Provider, chapter 8 of the Integration Architect course. Each module stands on its own. Next: REST First
The question this module answers: What are all the ways into Salesforce, and how do you find out which ones are being used?
Part 1 ended with a pattern for every arrow. Now we turn the arrows around and look at Salesforce as the server. Every call-in from chapter 7 has to come through a door.
Think of Salesforce as a building with locked doors. You’re a process outside of Salesforce. You could be a server, a mobile phone, a gateway, your own middleware. You want to reach into the box called Salesforce core and get things, put things, update things. Salesforce won’t come out and find you. You have to reach in. You have to start the connection.
How Many Doors?
Section titled “How Many Doors?”Count the doors the way I do, one row for every endpoint you can call, and Salesforce has well over 100 of them. We keep that count in our own catalog: on Winter ‘27, between 107 and 120 live doors, depending on how strictly you count. Salesforce’s own API Library (opens in a new tab) answers a different question. It groups the doors into products, and it lists 56 APIs (both checked 2026-11-07).
Neither number is the one to remember. What matters is this: my rule of thumb is that about 99% of what you can do in Salesforce through a browser, you can do from outside through an API. When I made my video tour of the APIs in 2023, I put it this way: anything you see in Salesforce, you can also access through one of the APIs. So when someone asks “can we get to that from outside?”, the answer is almost always yes. The real question is which door, and who holds the key.
And Salesforce is working on the last 1%. Its Winter ‘27 developer guide puts it this way: “Every major Salesforce capability is available as an API, a Model Context Protocol (MCP) tool, or a CLI command. Any authenticated caller can use it, whether that’s an app, a human, or an AI agent” (The Salesforce Developer’s Guide to the Winter ‘27 Release (opens in a new tab), 2026-10-05, checked 2026-10-31). Salesforce calls this a headless architecture: the capability without the screen. The direction is clear. The goal is 100%, everything you can do in a browser, available to a program or an AI agent through a door. That’s why the newest doors, the MCP servers, are built for agents. Chapter 22 (coming soon) is about them.
Our public guide, The API Guide, lists the documented doors one by one, each with a link to Salesforce’s own guide. Every door in the right-hand column of the next picture is in it.
Every way in. Four kinds of caller, four kinds of door.
The Doors a Browser Uses
Section titled “The Doors a Browser Uses”Start with the doors people walk through, because they’re doors too.
- Sign in. A person goes to the login page, authenticates, and is sent on to the org’s own address, its My Domain. Everything they click after that is a request to that server.
- The phone. A computer telephony integration, the thing that pops up the right customer when a call comes in, runs as JavaScript inside the browser page. It comes in through the same door the person did.
- Experience Cloud sites. Portals and communities, which can sit on your own domain. Steve Trucking’s Retail Partners sign in to theirs.
- Public pages. A site page can be set up with no sign-in at all. There’s no person to check, only a guest user.
- Web forms. Web-to-Lead and Web-to-Case turn a form on any website into a record. No sign-in either.
- Email. Email-to-Case turns an email into a case, and Apex email services let your own code handle mail sent to an address Salesforce gives you.
The last three have something in common: nobody signs in. So what protects you from someone pointing a script at your web form and pounding on it?
I had a client whose web-to-case form had a broken CAPTCHA. The spam started coming in at about 10,000 cases an hour. Every one of them was a real case, so every one went through assignment rules and landed with an agent. It filled up their whole case management system. One broken check on one public form, and the support team was buried.
Salesforce’s own setting for this is in Web-to-Case setup: “Require reCAPTCHA Verification (Recommended)”. With it turned on, “requests without reCAPTCHA verification don’t generate cases” (Turn On and Customize Web-to-Case (opens in a new tab), checked 2026-10-31). An open door still needs a guard. Steve Trucking’s delivery-problem form on its public website gets one.
The Doors a Client Uses
Section titled “The Doors a Client Uses”Now the other side: a client that isn’t a person. When I say client, I don’t mean a customer. I mean the client in client and server, from chapter 2: a server, a process, a phone app, anything that makes the call.
A client program takes two steps. First it stops at the token server and proves who it is. You set that up in chapter 4: an External Client App, and an integration user it runs as. What it gets back is a token, a long string it carries in the header of every call. Then, with the token, it goes to a door.
The doors themselves come in two kinds.
Salesforce’s doors, with a version in the address. These are Salesforce’s own APIs, and each one is versioned:
- REST, the one most programs use: records, queries, describes. The next three modules.
- GraphQL and the UI API, for asking for exactly what you need, or for everything a screen shows. Module 4.
- Bulk, for moving large amounts of data. Chapter 10.
- Pub/Sub, for events. Chapter 11.
- Metadata and Tooling, for configuration and code rather than records.
- Connect, for features like files, feeds and many of the industry clouds.
- SOAP, the older XML door. It’s still on the exam, and people still use it. In my 2024 class, one student called in by SOAP to start territory management, and another kept ten-year-old .NET code running on it. Chapter 17 tells the story.
- The newest door: Salesforce Hosted MCP Servers, generally available since April 2026, for AI agents (announcement (opens in a new tab)). Chapter 22.
Your own doors, with no Salesforce version. When you write a custom Apex REST or Apex SOAP service, Salesforce doesn’t version it. It is you who’s releasing it, so it’s you who versions it. Module 5 is about building one.
Steve Trucking already uses several of these. Redrock’s system reads deliveries through REST. The crews’ mobile app signs each person in and calls REST. Every week, the analytics team’s Snowflake export pulls from Salesforce through the Bulk API. Three clients, each with its own key.
The Map
Section titled “The Map”Over 100 doors is too many to hold in your head, so I group them by what the caller is doing. Ten sets cover them all, and every door on the map says where in the course it’s taught. The first four sets are this chapter: records one at a time, many in one call, asking for a shape, and your own doors. The rest have chapters of their own.
The doors into Salesforce, in sets. Blue is this chapter.
Salesforce has its own short version of this, a page called Which API Do I Use? (opens in a new tab) (Salesforce Help, checked 2026-10-31). It lists twelve of the main APIs with three facts each: the protocol (REST, SOAP, GraphQL, or gRPC for Pub/Sub), the data format, and whether the answer comes back at once or later. Read it beside the map. It’s where I send people who ask which door to use, and it’s the first place to look when a new one appears.
Ask the Org Which Doors It Has
Section titled “Ask the Org Which Doors It Has”You don’t have to guess. With a token, ask:
GET /services/data/returns every API version the org still serves.GET /services/data/v68.0/returns the REST doors on that version.
Chapter 3 taught that a version is a promise: it acts the same until it’s retired. Here’s what that promise costs a caller who stays behind. We asked one org the same question on five versions, on 2026-10-31:
| API version | Released | Top-level REST doors |
|---|---|---|
| 31.0 | 2014 | 32 |
| 40.0 | 2017 | 42 |
| 50.0 | 2020 | 47 |
| 60.0 | 2024 | 51 |
| 68.0 | Winter ‘27 | 57 |
When I made the video tour in 2023, version 31 showed about 34 doors and version 58 about 50. The count only goes one way. A program on version 31 still sees today’s accounts and today’s deliveries. It just can’t see them in any new way, and 25 of today’s doors aren’t there for it at all. You want your version at the bottom of that list, not the top.
And the top of the list is closing. Versions 31.0 to 40.0 are deprecated from Summer ‘27 and retired in Summer ‘28. After that, a call to them fails: the REST API answers 410 GONE (Salesforce Platform API Versions 31.0 through 40.0 Retirement (opens in a new tab), checked 2026-10-31).
Who’s Still Using an Old Door?
Section titled “Who’s Still Using an Old Door?”Chapter 3 told the story of a team that got Salesforce’s warning: calls were still coming in on versions about to be retired, and they had to find out who was making them. In 2024, I called it a crazy little report you had to dig for. Today it has a name.
Salesforce’s answer is the API Total Usage event log. In Salesforce’s words, it “consolidates API request information across the SOAP, Bulk, and REST APIs, including version information” (same article). Each line is one call, and it tells you:
- Which version and which door: the API family, the resource called, the API version.
- Who: the user, and the app name where the caller came through one.
- From where: the caller’s IP address.
That’s enough to go from “something is calling version 38” to “it’s the weekly export, running as this user, through this app”, and from there to the team that owns it.
Two things to plan for:
- The free log only covers a day. Every org with API access gets the API Total Usage log for the previous 24 hours. With Event Monitoring, it’s kept 30 days (same article). Without it, if you’re hunting old callers, download it every day, or a weekly job will slip past you. You can browse and download it in Setup, under Security, Event Monitoring, Event Log Browser.
- Your own doors aren’t on the list. Salesforce’s retirement “does not impact… Custom Apex REST & SOAP Web Services” (same article). That’s good news, and it’s also a responsibility. Nobody will retire your old versions for you, and nobody will warn you who’s still calling them.
Watch it on video
Section titled “Watch it on video”In 2023 I made two videos on this: a tour of the doors into Salesforce, and a summary of all its APIs, sorted by what they work on. The notes under the videos say what’s still right and what’s changed since.
What an Architect Decides Here
Section titled “What an Architect Decides Here”- Which set each caller belongs in, then which door. Start from the map: what is the caller doing?
- Which door each caller uses. For every arrow coming in, name the door: REST, Bulk, Pub/Sub, GraphQL, your own Apex service. The rest of this chapter, and the next three, help you choose.
- Which doors are open with nobody signing in. Public pages, web forms and email addresses. Each one needs a guard: reCAPTCHA on forms, a guest user with almost nothing, rules on what email can create.
- The version every caller is on, written down. Put it in the landscape inventory from chapter 5, beside the door and the integration user. When Salesforce announces a retirement, you look it up instead of hunting.
- How you’ll find the callers you didn’t write down. Download the API Total Usage log on a schedule, or have Event Monitoring keep it for you.
Explore
Section titled “Explore”- Which API Do I Use? (opens in a new tab): Salesforce Help, twelve main APIs with protocol, format and timing (checked 2026-10-31)
- API Library (opens in a new tab): Salesforce Developers, the front door to Salesforce’s APIs (checked 2026-11-07)
- The API Guide: our own list of the documented doors, each with a link to Salesforce’s guide
- Salesforce Platform API Versions 31.0 through 40.0 Retirement (opens in a new tab): Salesforce Help, with the dates, the errors and how to find old callers (checked 2026-10-31)
- API Total Usage event type (opens in a new tab): Object Reference for the Salesforce Platform, Winter ‘27, every field in the log (checked 2026-11-07)
- Turn On and Customize Web-to-Case (opens in a new tab): Salesforce Help, the reCAPTCHA setting (checked 2026-10-31)
- Salesforce Hosted MCP Servers Are Now Generally Available (opens in a new tab): Salesforce Developers Blog, April 2026
- Salesforce Documents by Release: every release’s guides, for when a version’s behavior matters
- Salesforce Developers Blog, The Salesforce Developer’s Guide to the Winter ’27 Release (opens in a new tab), checked 2026-11-07.