Permissions a scan needs
Which user licence and which permissions the Vulkro integration user needs to read each kind of Salesforce metadata, and why. Vulkro only reads: a scan changes nothing in your org.
Each row says how sure we are of the answer:
- Documented: stated in Salesforce's Metadata API documentation.
- Seen: seen on a real org, with the error and the change that fixed it.
- Expected: our best reading, not yet confirmed on a clean org. If your org behaves differently, the scan's coverage report shows it in Salesforce's own words.
The two permission sets
| Set | API name | Who needs it | Grants |
|---|---|---|---|
| Vulkro read | Vulkro_Read | Every connection | API Enabled, View Setup and Configuration, View Roles and Role Hierarchy, View All Users, View Health Check, View Event Log Files, Modify Metadata Through Metadata API Functions. |
| Vulkro code read | Vulkro_Code_Read | Only when Code Source is Org Metadata (code read from the org, not Git) | Author Apex, Customize Application, and what Salesforce adds with Customize Application: Manage Custom Permissions, Manage Translation, View Setup and Configuration, View Roles and Role Hierarchy. |
Salesforce requires Modify Metadata for any Metadata API read. Vulkro never deploys anything.
Two more permissions are optional, and you add them by hand if you want these checks: Manage Users for login history across all users, and Manage Multi-Factor Authentication in API for per-user MFA registration. Do not grant Manage Multi-Factor Authentication in User Interface: Vulkro does not need it and reports it as over-privilege.
Recommended setup: Vulkro read plus Code Source set to Git (Org Settings > Code Source). The scan then reads code from the repository, and the integration user holds no Apex or admin rights in the org. Org settings, users, permissions and sharing are still read from the org.
Vulkro recognises both sets by name and reports each as one informational item listing what it grants, not as over-privilege. A set with one of these names that grants anything more is reported like any other set.
User licence
| Question | Answer | How sure |
|---|---|---|
| Can a Salesforce Integration licence user (API only) hold Vulkro read? | Yes: every permission in Vulkro read is available on the Salesforce API Integration permission set licence. | Expected |
| Can that user read Apex with Vulkro code read? | One org needed a licence change for the API-only user before the code retrieve worked. Author Apex may not be offered on the Integration licence. A Salesforce licence user (Minimum Access - Salesforce profile) works. | Seen |
| With Code Source set to Git, is the Integration licence enough? | Yes, the code retrieve does not run. | Expected |
Per metadata type
"When read" says whether the type is always read from the org, or only when Code Source is Org Metadata (from Git otherwise).
| Metadata type | When read | Needs (beyond API Enabled) | Error without it | How sure |
|---|---|---|---|---|
| Any Metadata API call (list, retrieve) | Always | Modify Metadata Through Metadata API Functions (or Modify All Data) | "use of the Metadata API requires a user with the ModifyAllData or ModifyMetadata permissions" | Documented |
Settings (Security, Session) | Always | Modify Metadata, View Setup and Configuration | Partial or empty retrieve | Documented (Modify Metadata), Expected (View Setup) |
SharingRules | Always | Modify Metadata and sharing administration rights, usually Manage Sharing | "You do not have the proper permissions to access SharingRules." | Seen (refused even with View Setup and Configuration, Customize Application and Author Apex), Expected (Manage Sharing as the fix) |
ApexClass | Org Metadata only | Author Apex | "Entity type 'ApexClass' is not available in this organization" | Seen |
ApexTrigger | Org Metadata only | Author Apex | Same as ApexClass | Expected |
ApexPage | Org Metadata only | Author Apex | Same as ApexClass | Expected |
ApexComponent | Org Metadata only | Author Apex | Same as ApexClass | Expected |
AuraDefinitionBundle | Org Metadata only | Modify Metadata | Not seen | Expected |
LightningComponentBundle | Org Metadata only | Modify Metadata | Not seen | Expected |
Flow | Org Metadata only | Modify Metadata (Manage Flow may also be needed for some flow types) | Not seen | Expected |
ConnectedApp | Org Metadata only | Customize Application | "You do not have the proper permissions to access ConnectedApp" | Seen |
NamedCredential | Org Metadata only | Customize Application | Not seen | Expected |
RemoteSiteSetting | Org Metadata only | Customize Application | Not seen | Expected |
CustomSite | Org Metadata only | Customize Application | Retrieve refused | Seen |
ExperienceBundle | Org Metadata only | Customize Application, plus Setup > Digital Experiences > Settings > Enable ExperienceBundle Metadata API | Retrieve refused or empty | Seen (permission), Documented (setting) |
Network | Org Metadata only | Customize Application (Create and Set Up Experiences may also apply) | Not seen | Expected |
Profile | Org Metadata only | Modify Metadata, View Setup and Configuration. A retrieve returns only the parts of a profile that match the other types in the same retrieve. | Partial file | Documented (partial content), Expected (permissions) |
PermissionSet | Org Metadata only | Same as Profile | Partial file | Documented (partial content), Expected (permissions) |
CustomObject | Org Metadata only | Modify Metadata | Not seen | Expected |
Salesforce adds Manage Custom Permissions, Manage Translation and View Roles and Role Hierarchy automatically when Customize Application is enabled. They are listed in Vulkro code read so the set saves as packaged.
Checking your org
Before the first scan, the connect wizard checks each type as the connected user and shows anything Salesforce refuses as "Not readable", with the fix from this page. After each scan, Org Settings > Connection shows what Vulkro could read, and every page names what was not read.