Skip to main content
Gruppi* Salesforce Administrators *Domanda di Juan Jose Sierra Ortega
Juan Jose Sierra Ortega (saidor) ha fatto una domanda in * Salesforce Administrators *
20 mag, 22:39

question about notification received by mail

Hi team,

We recently received the Salesforce notification about the retirement of the SOAP API login() method, and we are trying to understand if any users or integrations in our org are still using this type of authentication.

While reviewing LoginHistory, we found some records with:

  • LoginType = "Other Apex API"
  • ApiType = "SOAP Enterprise"

but it is still unclear to us if this really confirms the usage of SOAP login() authentication.

Is there a reliable way to validate whether a specific user or integration is still authenticating through SOAP login() instead of OAuth or Connected Apps?

We would also like to know if LoginHistory is enough for this analysis or if Salesforce recommends using another tool or log source to confirm it.

Thanks in advance. 

 

question about notification received by mail@Salesforce Flow Automation @* Customer Success * @* Known Issues * @* Salesforce Developers * @Flow for Nonprofit Admins

 

 

 

3 risposte
  1. Hari Vignes M E (Victoria's Secret & Co)
    21 mag, 04:32

    Hi @Juan Jose Sierra Ortega, 

     

    Here’s a response you can post back to the developer’s question:

    The records you’re seeing in LoginHistory with LoginType = "Other Apex API" and ApiType = "SOAP Enterprise" do indicate that the SOAP API is being used, but they don’t necessarily confirm that the login()

     method itself is being called. The SOAP API can be used for other operations as well, so LoginHistory alone isn’t a definitive way to prove usage of the deprecated login() authentication. 

     

    To reliably check whether integrations are still using SOAP login():

    • Audit your integration code/configurations: Look for explicit calls to login() in any custom integrations, middleware, or legacy scripts.
    • Connected Apps & OAuth: Modern integrations should be registered as Connected Apps and use OAuth flows. If you don’t see a Connected App associated with the integration, that’s a red flag it may still be using SOAP login().
    • Event Monitoring (Login Events): If you have Event Monitoring enabled, the LoginEvent logs provide more granular details about authentication methods used. This is more reliable than LoginHistory for distinguishing SOAP login from OAuth.
    • Disable SOAP login in a sandbox: As a test, you can temporarily disable legacy authentication in a sandbox and see which integrations fail. This helps identify dependencies before production impact.

    Salesforce’s recommendation is to migrate all integrations to OAuth-based authentication via Connected Apps. LoginHistory is useful for spotting API usage patterns, but for precise validation, Event Monitoring and code/config reviews are the best approach. 

     

    If this helps, please mark this as best answer. 

     

    Thanks!

Scrivi una risposta...
0/9000