Start free trial

Connect Data 360 to Formentic

A Salesforce admin does this once. It gives Formentic two read-only scopes, and nothing else.

  • 7 steps
  • About 12 minutes
  • Done once, in the Salesforce org that holds Data 360
  1. Open External Client App Manager
  2. Name the app
  3. Turn on OAuth
  4. Select two scopes
  5. Choose who it runs as
  6. Make usage readable
  7. Paste them in Formentic

What Formentic asks for

Manage user data via APIsapiNeeded so Salesforce will exchange the sign-in for a Data 360 token. Formentic only reads.
Perform SQL queries on Data Cloud datacdp_query_apiRuns the read-only queries that return credit consumption figures and asset metadata.

Never: Profile data · Ingestion · Segments · Full access and refresh tokens. Formentic reads consumption figures and asset metadata, never customer personal data, and changes nothing in your org. The user the app runs as sets the outer limit (step 5).

Before you start. Data 360 needs Digital Wallet set up in your org (Enterprise or Unlimited edition). Open Setup and search for Digital Wallet. If you cannot find it, book a setup call and we will check it with you.

Open External Client App Manager

In the Salesforce org that holds Data 360, open Setup, search for External Client App Manager and choose New External Client App. If your org still allows Connected Apps, App Manager, New Connected App works the same way.

Name the app

Any name you will recognise later, and a contact email on your side. Leave Distribution State on Local. We suggest:

App nameFormentic Credits

Turn on OAuth with the Client Credentials flow

Open the API (Enable OAuth Settings) section and tick Enable OAuth. Salesforce insists on a callback URL even though this flow never uses it, so enter:

Callback URLhttps://formentic.com/oauth/callback

Then, under flow enablement, tick Enable Client Credentials Flow.

Select exactly two scopes

Under OAuth scopes, move these two across and nothing else:

Manage user data via APIs(api)
Perform SQL queries on Data Cloud data(cdp_query_api)
Leave Full access (full), Access all Data Cloud API resources (cdp_api), refresh_token and every profile, ingestion, segment and calculated-insight scope unticked. This flow does not need a refresh token.

Choose who the app runs as

Save the app, open its Policies tab and click Edit. Open OAuth Policies and tick Enable Client Credentials Flow again. In Run As, enter the Salesforce Username of a dedicated integration user (not their email address). Salesforce also requires an OAuth Start URL, which this flow never uses, so enter:

OAuth Start URLhttps://formentic.com

Leave Start Page on OAuth. Give the integration user a read-only Data 360 permission set, then save.

This is your real safeguard: whatever that user cannot see, Formentic cannot see, whatever the scopes allow.

Make your usage data readable

Credits reads the usage tables that Digital Wallet fills in. In Setup, search for Digital Wallet and open Digital Wallet Setup. Under Add the Data Lake Object to a Data Space, add TenantEnrichedUsageEvent to your default data space.

It can take a few minutes to appear. Without this step Credits connects, but finds no usage to show.

Paste them in Formentic

Sign in, open Workspace › Connections › Data 360 and paste your My Domain URL, Consumer Key and Consumer Secret. Formentic makes one read-only test call and shows which scopes were accepted. This also starts your 14-day Credits trial.

Doing this for a colleague? Don’t send the Consumer Secret by email or chat. Ask them to make you an Admin in Formentic so you can paste it yourself, or paste it together on a call.
Log in to paste themNew to Formentic? Start free trial
If something goes wrong
“Enter a valid execution user for the OAuth client credentials flow”Run As needs the Salesforce Username of the user (Setup, Users), not their email address.
“OAuth Start URL: Complete this field”Enter https://formentic.com in step 5. This flow never uses it, but Salesforce requires it.
“invalid subject token”The api scope is missing. Add it under Settings, OAuth Settings, then try again in a few minutes.
Connected, but no usage appearsDo step 6: the TenantEnrichedUsageEvent table must be in a data space.
Would you rather do this together?

Book a setup call and one of us goes through every step with you on a video call. You type the keys yourself, we never ask you to share them.