# Salesforce Models API connection

Salesforce Models API lets AI features generate text through a Salesforce connection using a configured application or operator identity.

*Release 3.3 · admin, developer, operator*

**Settings › AI › Accounts** · **Settings › AI › Connections** · **Settings › AI › Features** · **Settings › General Settings › Salesforce**

## What it is

**Salesforce Models API** lets INSIDE AI features request text generation through Salesforce. The selected connection and identity policy determine whose Salesforce credentials the request uses. This is separate from running a Salesforce Agentforce agent.

## Who uses it and why

Administrators and developers agree the Salesforce model, connection and identity policy with Powerfront. Operators use the configured AI feature; where **Context User** applies, their verified Salesforce identity can be used for execution.

## Where to find it

Powerfront manages the account options in **Settings › AI › Accounts** and dedicated connections in **Settings › AI › Connections**. Powerfront also manages the website integration in **Settings › General Settings › Salesforce**.

You select the prepared AI account on the relevant feature in **Settings › AI › Features**, using the **Settings** role with **AI** access or the **Developer** role.

## How it works

1. The AI account selects **Salesforce Connection** and a Salesforce model.
2. Before sending a request, INSIDE resolves the configured identity. **Context User** uses a suitable verified operator identity when available. Otherwise, its configured fallback supplies the identity before execution.
3. **Chat Generations** preserves message roles. **Generations** combines the instructions and messages into one text prompt.
4. Salesforce returns generated text, which INSIDE converts into the feature's result.

When **Enable AiFlow tools** is on, INSIDE can ask the model for a single structured function request. It checks the function name, arguments and expected format before executing the tool. A malformed required tool request fails rather than being treated as a valid action.

Contradictory conversation or operator identities are rejected. Eligible application or configured-user credentials can be refreshed once after an authentication rejection. A rejected operator request does not automatically switch to another user's identity.

## Configure it

Ask Powerfront to prepare the Salesforce model and either the website integration or a dedicated AI connection. Agree **Salesforce Identity** and **Context User Fallback**, including what should happen when no operator identity is available.

New account forms start with **Context User** and an **App Credentials** fallback. When no identity policy is saved on the account, the website integration uses **Configured User**; a dedicated connection supplies its own identity policy, which defaults to **App Credentials**. An account that selects **Context User** without saving a fallback uses **App Credentials**. Accounts with no identity policy inherit the connection's fallback. Confirm the effective policy with Powerfront before relying on it.

Ask Powerfront to choose **Models Capability** to match the selected model and confirm **Enable AiFlow tools** if the feature uses functions or rich content. New account forms select it, but saved configurations without that option leave emulation off.

### Settings

| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Salesforce Identity | Settings › AI › Accounts | website | Context User in new account forms; when not saved, Configured User for the website integration or the dedicated connection's identity policy, which defaults to App Credentials | Powerfront, on request | Selects whether execution uses the available operator Salesforce identity or configured connection credentials. |
| Context User Fallback | Settings › AI › Accounts | website | App Credentials in new account forms and when the account selects Context User without a saved fallback; inherits the connection policy when the account has no identity policy | Powerfront, on request | Chooses the configured identity used before a request when no usable operator identity is available. |
| Models Capability | Settings › AI › Accounts | website | Chat Generations | Powerfront, on request | Uses role-based chat messages or a single flattened generation prompt. |
| Enable AiFlow tools | Settings › AI › Accounts | website | On in new account forms; Off when absent from saved configuration | Powerfront, on request | Allows validated tool-call emulation for AiFlow functions and supported rich-content handling. |
| Salesforce Connection | Settings › AI › Accounts | website | Not set: a connection must be selected before execution | Powerfront, on request | Selects the website Salesforce integration or a dedicated Salesforce AI connection. |

### Permissions

| Permission | Lets you |
|---|---|
| AI | With the Settings role, allows selection of a prepared account in Features; the Developer role can also access Features. |

## Limits and good to know

- This integration accepts text. Images and files are rejected.
- Tool calls are emulated through validated text output. They are not native Salesforce Models tool calls.
- Structured replies must match the requested format. Extra prose or invalid structured values can cause a failure.
- **Bypass User** does not bypass Salesforce user access in the Models path; it resolves to application authentication.
- The default Models request timeout is 120 seconds. Powerfront can change it within supported bounds.
- This path returns model text after generation finishes; do not assume native streaming of generated tokens.

## Depends on and works with

### This feature uses

- **Requires** [AI accounts and shared defaults](AIP-001.md): An AI account must select the Salesforce model, connection and execution identity policy.
- **Configured in** [AI model catalogue](AIP-002.md): Model configuration selects the Salesforce Models provider and model.
- **Configured in** [Shared AI service connections](AIP-013.md): A dedicated Salesforce AI connection supplies authentication configuration.
- **Configured in** [Salesforce connection and operator setup](CRM-010.md): When the website Salesforce connection is selected, its authentication and verified operator sessions determine the available execution identity.
- **Works better with** [AI functions and required inputs](AI-016.md): Explicit tool emulation lets supported model responses request configured functions.
- **Works better with** [Rich content in AI replies](AI-026.md): Enabled rich replies can use validated Salesforce structured output when tool emulation supports the requested format.
- **Related** [AI agent service connections](AI-024.md): Salesforce Models generates text with a selected model, while Agentforce runs a configured Salesforce agent.

### Used by

- **Enhances** [AI model provider selection](AIP-003.md): Salesforce Models API is another provider choice.
- **Enhances** [Shared AI service connections](AIP-013.md): Salesforce AI Connection supplies reusable credentials for Salesforce AI accounts.

## FAQ and troubleshooting

### Why does a feature work for one operator but not another?

It may use **Context User**. Ask Powerfront to check each operator's verified Salesforce session and the configured fallback.

### Why do tool-enabled requests fail?

Check **Enable AiFlow tools** with Powerfront. The model must also return a valid request for an allowed function. Text-only generation does not supply native tool calling.

### Why is an uploaded image rejected?

This Salesforce Models integration supports text only. Use a separately configured feature with verified support for the required content type.

### Does Context User Fallback take over after any Salesforce error?

No. It is an identity choice before execution when the operator identity is unavailable. It is not a general retry policy for failed requests.

### Is Salesforce Models the same as Salesforce Agentforce?

No. Models provides text generation. Agentforce runs a configured Salesforce agent through a separate execution option, although both can share connection and identity support.