Salesforce Node

Connect to Salesforce CRM — manage Leads, Accounts, Contacts, Opportunities, and Cases; run SOQL queries; and perform bulk data operations directly from your BizFirstAI workflows.

Authentication: All operations require an OAuth2 AccessToken and InstanceUrl. Tokens expire — configure automatic refresh using a Salesforce Connected App and store credentials in the BizFirst Credentials Manager.

Resources

Lead 6 operations

Create, retrieve, update, delete, and convert sales leads.

lead/create lead/get lead/getAll lead/update lead/delete lead/convert

Account 5 operations

Manage company and organization records in Salesforce.

account/create account/get account/getAll account/update account/delete

Contact 5 operations

Manage individual person records linked to accounts.

contact/create contact/get contact/getAll contact/update contact/delete

Opportunity 5 operations

Track sales deals through stages to close.

opportunity/create opportunity/get opportunity/getAll opportunity/update opportunity/close

Case 4 operations

Log and manage customer support cases.

case/create case/get case/getAll case/update

SOQL 2 operations

Execute custom Salesforce Object Query Language queries.

soql/execute soql/executeWithPagination

Bulk 2 operations

Insert or upsert large record sets via the Salesforce Bulk API.

bulk/create bulk/upsert

Object Relationships

Understanding how Salesforce objects relate to each other helps you build correct workflows:

Lead — a prospective customer not yet associated with an Account. Use lead/convert to promote a Lead into an Account + Contact + Opportunity.
Account — a company or organization. The parent record for Contacts, Opportunities, and Cases.
Contact — an individual person, typically linked to an Account via AccountId.
Opportunity — a potential sales deal linked to an Account. Progresses through stages to Closed Won or Closed Lost.
Case — a customer support ticket linked to an Account and optionally a Contact.

Lead
 └─ lead/convert ──► Account ──► Contacts    (many)
                      │          Opportunities (many)
                      │          Cases         (many)
                      └─ Contact (linked)

Authentication

Field	Type	Description
`InstanceUrl`	string	Your Salesforce org URL, e.g. `https://myorg.my.salesforce.com`
`AccessToken`	string	Valid OAuth2 bearer token. Store in BizFirst Credentials Manager. Tokens expire — configure token refresh in your Connected App settings.

Token Refresh: Salesforce access tokens expire after a session timeout (typically 2 hours for Connected Apps). Configure a refresh token flow in your Salesforce Connected App and register the credential in BizFirst Credentials Manager so tokens are renewed automatically before each workflow execution.

API Governor Limits

Salesforce API Governor Limits vary by edition and apply per 24-hour rolling window:

Developer Edition: 15,000 API calls/24h | Enterprise Edition: 500,000 API calls/24h | Unlimited Edition: 1,000,000 API calls/24h

The Bulk API processes large data sets asynchronously and counts differently against limits. Use Bulk operations for datasets exceeding 1,000 records to conserve REST API quota.

Node Policies & GuardRails

Policy	Detail
Credential storage	Store `AccessToken` in BizFirst Credentials Manager. Never hardcode tokens in workflow configuration.
SOQL injection prevention	Never interpolate raw user input into SOQL query strings. Sanitize or parameterize all dynamic values before constructing queries.
Bulk vs REST selection	Use Bulk API for >1,000 records. Use REST operations for smaller batches where per-record error granularity matters.
Error port handling	Always wire the error port. Salesforce operations can fail due to org-level validation rules, workflow triggers, duplicate rules, and permission sets.
Sandbox testing	Test all workflows against a Salesforce sandbox org before connecting to production. Use a separate credential entry for sandbox vs production.
Soft-delete behavior	Lead, Account, and Contact deletions are soft-deleted and remain in the Salesforce Recycle Bin for 15 days before permanent removal.
Upsert idempotency	Use External ID fields for `bulk/upsert` in recurring sync workflows to ensure operations are safe to re-run without creating duplicate records.