--- schema_version: "1" id: b80cacc891abd4cdfc9e358f6e916bd90e43d4fa5aac5abc902ba61636b906ca title: Common Errors and Warnings in Backup & Recover for Salesforce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/backup_recover_o_errors.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: fde80d4ef96b4418155c087873c3fccab33ee57b4590cd4d588557851292a5d0 description: Understand common issues and get tips for fixing problems when you try to access your account, back up or restore data, set up a Continuous Data Protection (CDP) service, or respond to a Data Privacy request. products: - Security - Salesforce Platform release: "264" --- # Common Errors and Warnings in Backup & Recover for Salesforce Understand common issues and get tips for fixing problems when you try to access your account, back up or restore data, set up a Continuous Data Protection (CDP) service, or respond to a Data Privacy request. - **[Account Access Error Messages](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5)** Get solutions for common account access issues. - **[Backup Error Messages](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5)** Get solutions for common errors encountered during the backup process. - **[Restore Error Messages](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5)** Get solutions for common errors encountered during the restore process. - **[Continuous Data Protection Error Messages](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5)** Get solutions for common errors seen when you use Continuous Data Protection. - **[Data Privacy Error Messages](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_errors.htm&release=264.0.0&type=5)** Get solutions for common errors encountered during Data Privacy operations. ## Account Access Error Messages Get solutions for common account access issues. ### Error Message: Invalid Token Provided. Please refresh this page to sign in. Reason: When the app session expires, you're logged out and taken to the login screen. You get this error when you try to log in again before refreshing the browser. Solution: Refresh the browser and log in again. ### Error Message: Unable to write to storage. Please check your key management service Reason: The Amazon Web Services (AWS) Bring Your Own Key Management Service (BYOKMS) configuration doesn't accept the provided key for write permissions. Solution: Contact AWS to review the Key Management System (KMS) and user configuration. See [Bring Your Own Key Management Service for Recover](https://help.salesforce.com/s/articleView?id=platform.administration_o_backup_recover_byokms.htm&release=264.0.0&type=5 "Encrypting the S3 bucket used to store your data using your AWS Key Management Service (KMS) gives you sole access and management capabilities of the key used to encrypt the bucket. BYOKMS enhances Bring Your Own Key (BYOK) activities. Backups are stored in AWS Simple Storage Service (S3) with a separate S3 bucket for each customer."). ### Error Message: Authentication failed: Please check the authenticated user is active and re-authenticate. Reason: The authenticated user is inactive in Salesforce. Solution: Replace the authenticated user with an active user that has the necessary permissions and access. See [Salesforce Authenticated User Permission Requirements for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_auth_user_perms.htm&release=264.0.0&type=5 "The Authenticated User connects your Backup & Recover application to a client's Salesforce org. Having a dedicated integration user enhances security, improves audit trails, and avoids API concurrency collisions."). ### Error Message: Data source IP restrictions are preventing Own from connecting: Please add the appropriate Own IP(s) to your environment allow list. Reason: IP restrictions prevent Own from connecting to the Salesforce org. Solution: Add the Own IPs to the Salesforce allowlist. See [Own Regions and IP Addresses for Allowlisting](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&release=264.0.0&type=5 "When you limit network traffic to Salesforce, add these IP addresses to the list of Login IP Ranges. This will let Own connect to your environment."). ## Backup Error Messages Get solutions for common errors encountered during the backup process. ### Error Message: ip restricted Reason: Salesforce IP restrictions prevent Own from connecting to the Salesforce org. Solution: Add Own IPs to the Salesforce allowlist. See [Own Regions and IP Addresses for Allowlisting](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&release=264.0.0&type=5 "When you limit network traffic to Salesforce, add these IP addresses to the list of Login IP Ranges. This will let Own connect to your environment."). ### Error Message: inactive user Reason: The user set as the Salesforce authenticated user is inactive in Salesforce. Solution: Replace the authenticated user with an active user that has the necessary permissions and access. See [Salesforce Authenticated User Permission Requirements for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_auth_user_perms.htm&release=264.0.0&type=5 "The Authenticated User connects your Backup & Recover application to a client's Salesforce org. Having a dedicated integration user enhances security, improves audit trails, and avoids API concurrency collisions."). ### Error Message: Invalid Credentials: unable to connect the service to Salesforce Reason 1: The connection to the OAuth app is blocked. Solution: In Salesforce, in Setup, enter Connected Apps in the Quick Find box and select **Connected Apps OAuth Usage**. Make sure that Own for Salesforce isn't blocked. Reason 2: Salesforce IP restrictions prevent Own from connecting to the Salesforce org. Solution: Add the Own IPs to the Salesforce allowlist at the org level and at the profile level of the Salesforce authenticated user. See [Own Regions and IP Addresses for Allowlisting](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&release=264.0.0&type=5 "When you limit network traffic to Salesforce, add these IP addresses to the list of Login IP Ranges. This will let Own connect to your environment."). Reason 3: The Salesforce org uses a custom domain, and the custom domain is defined as the only way to log in to the Salesforce org. Solution: Select the **Use Custom Domain** option before entering the username and password to authenticate the service. See [Set the My Domain Login Policy](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_setting_login_policy.htm&type=5&language=en_US). ### Error Message: User Not Authorized / INSUFFICIENT\_ACCESS: insufficient access rights on cross-reference id. Reason 1: The Salesforce authenticated user doesn't have the "Modify All Data" Permission in Salesforce. Solution: Verify that the authenticated user has the “Modify All Data” permission. Also make sure that the authenticated user has appropriate access to the specified object and all referenced objects. Reason 2: A Sandbox environment was refreshed recently, and now the backups are failing. Solution: Select the failed Sandbox service. Under **Options**, select the **Re-authenticate Service** option. Log in with the Salesforce authenticated user’s username and password. If you have a custom domain, select the **Use Custom Domain** option before you enter the credentials. After you authenticate, a new Sandbox service box appears on the Backup page. If you don't see the service on the Backup page, make sure the service isn't on the Archived page. If it's archived, you can unarchive it by clicking on the service, then going to **Options**, then **General**. After the service is unarchived, it returns to active-backup status. ### Error Message: Sorry, this Salesforce Org has already been taken. Reason: The Salesforce org is already connected as a service with another active user account. Solution: If you can't contact the owner of the account or believe this message is in error, contact Own Customer Support at [https://support.owndata.com/](https://support.owndata.com/). ### Error Message: Invalid Query Locator Reason 1: More than 10 threads are being requested by the user at a given time. Solution: Assign a dedicated Salesforce authenticated user that only makes requests related to Backup & Recover. If one Salesforce org has a Data service and a Metadata service, consider assigning a separate dedicated authenticated user for each service. See [INVALID\_QUERY\_LOCATOR' Error](https://help.salesforce.com/s/articleView?id=000384958&type=1&language=en_US). Reason 2: A thread request started by Backup & Recover has expired in Salesforce and is no longer responding to further queries. Solution: In this case, the warning is temporary and doesn’t require any action. ### Error Message: Failed to process query: OPERATION TOO LARGE Reason: The Salesforce authenticated user doesn't have "View All Data" and "Modify All Data" permissions, and the query has exceeded 100,000 distinct IDs. Solution: Verify that the authenticated user has the "View All Data" and “Modify All Data” permissions. In addition, check to see if the authenticated user has appropriate access to the specified object and all referenced objects. ### Error Message: MALFORMED\_QUERY Reason: The Salesforce authenticated user doesn't have "View All Data" and "Modify All Data" permissions. Solution: Verify that the authenticated user has the "View All Data" and “Modify All Data” permission. In addition, check to see if the authenticated user has appropriate access to the specified object and all referenced objects. ### Error Message: Failed downloading files Reason: Corrupted files or empty files. This can happen when plugins running in the background extract the files to external storage. Solution: Use failed file report to review the list of failed files. Remove corrupted or empty files from your environment. Other error messages and next steps for failed file downloads: Error message: Failed file download error message: File not found Possible cause: We couldn't find the file in your Salesforce org. Next steps: Contact Salesforce Customer Support. Error message: Failed file download error message: Failed to download file Possible causes: - The downloaded file is empty even though it was expected to have content. - Salesforce returned an error. - The downloaded file checksum doesn't match the source file checksum. Next steps: - Use the failed file report to identify the IDs of the failed records. Query the records to replicate the error. - If the error persists (for example, in Workbench), contact Salesforce Customer Support. Workbench is free to use, but it's not an official Salesforce product. Failed file download error message: Internal Error Possible cause: An error occurred during the backup processing or upload. Next steps: Contact Own Customer Support at [https://support.owndata.com/](https://support.owndata.com/). ### Error Message: Some objects could not be backed up: Auth Provider (for MetaData Service). Reason: The Manage Auth. Providers definition is set to "Raise session to High Assurance". Solution: In Salesforce, in Setup, enter Connected Apps in the Quick Find box and select **Connected Apps OAuth Usage**. Click **Install** for the Own for Salesforce Metadata App or the Salesforce Sandbox Metadata App. Click **Manage App Policies** and edit the App. Under **High assurance session required**, select **Raise the session level to high assurance** and save your changes. In Setup, enter Session Settings in the Quick Find box and select **Session Settings**. Under Session Security Levels, make sure that Multi-Factor Authentication and Username Password are on the High Assurance list. Return to your Own account and re-authenticate the service. ### Error Message: API\_DISABLED\_FOR\_ORG Reason 1: The Salesforce org doesn't support API access. API access is available for orgs with Enterprise, Unlimited, Performance, or Developer editions. In this scenario, Backup & Recover can back up the Data service but not the Metadata service. Solution: Contact Salesforce Customer Support if you believe your organization should have API access. Reason 2: The Salesforce authenticated user doesn't have the API feature enabled. Solution: Verify that the authenticated user’s profile in Salesforce has the “API Enabled” permission. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: REQUEST\_LIMIT\_EXCEEDED Reason: The API quota has been exceeded. Solution: Contact Salesforce Customer Support if you believe that your account hasn't exceeded API call limits. For more information, see [Implementation Considerations](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/implementation_considerations.htm). ### Error Message: QUERY\_TIMEOUT "Salesforce Error: QUERY\_TIMEOUT Your query request was running for too long" Reason 1: The object is too large to be queried via the REST API and needs to use the Bulk API. Solution: Contact Salesforce Customer Support. Reason 2: Unlisted Chatter Groups are enabled in the Salesforce org, but the Salesforce authenticated user doesn't have the "Manage Unlisted Groups" permission. This error sometimes occurs for Feed Items and Feed Attachments. Solution: Enable the "Manage Unlisted Groups" permission on the profile of the Salesforce authenticated user. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: Bulk Error: Script Internal Error Reason: An optimized object being queried by the Bulk API via the primary key chunking method has not been backed up. Solution: Contact Own Customer Support at [https://support.owndata.com/](https://support.owndata.com/). ### Error Message: Service Backup Failed - API is Disabled for user Reason: The Salesforce authenticated user doesn't have the "API Enabled" permission. Solution: Verify that the authenticated user’s profile in Salesforce has the “API Enabled” permission. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: Service Backup Failed - INSUFFICIENT\_ACCESS - ModifyAllData or ModifyMetadata permissions required Reason: The Salesforce authenticated user doesn't have the "Modify All Data" permission. Solution: Verify that the authenticated user has the “Modify All Data” permission. In addition, check to see if the authenticated user has appropriate access to the specified object and all referenced objects. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: Service Backup Failed - Connected Applications connected\_applications fail Bulk batch ended with state Failed and message: InvalidBatch: Failed to process query: INSUFFICIENT\_ACCESS: insufficient access rights on cross-reference id. Reason: The Salesforce authenticated user doesn't have the "Customize Application" permission. Solution: Verify that the authenticated user's profile has the “Customize Application” permission. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: Unable to retrieve metadata object Reason: Sometimes, the Salesforce Metadata API is unable to query certain metadata objects. Solution: These warnings are temporary and don’t require any action. ### Error Message: Insufficient access to the specified data category Reason: In Lightning for Salesforce, data categories are used in communities. A particular category is marked as invalid. Solution: In Salesforce, in Setup, enter Data Categories in the Quick Find box and select **Data Categories**. Verify that the data categories that need to be active are marked as active. ### Error Message: sObject not sorted by Id: Reason: We use REST APIs to request data from Salesforce, which are sorted by the RecordId when using the Compare, Restore, and Replicate tools. Certain objects are not sortable due to Salesforce limitations, so they are excluded in these tools. Solution: The particular sObject is not sortable. The object is still backed up and available in the backups. ### Error Message: Messaging Sessions Bulk Error: Salesforce Error Reason: This is a known Salesforce issue that can be found in [Null pointer error thrown from SOQL on MessagingSession AgentMessageCount and EndUserMessageCount without perm](https://help.salesforce.com/s/issue?id=a028c00000gAyw2AAC#:~:text=Null%20pointer%20error%20thrown%20from%20SOQL%20on%20MessagingSession%20AgentMessageCount%20and%20EndUserMessageCount%20without%20perm). Solution: Enable "Access Conversation Entries" under Administrative Permissions for the Salesforce authenticated user. ### Error Message: You have reached the API download limit for this service (downloaded files out of files available) Reason: The number of files that can be backed up has been reached. We download only the new and changed files. Solution: The binary files backup continues on each consecutive backup until all files are backed up. ### Error Message: Content Documents: Salesforce Error: invalid character encoding. Reason: A Non-UTF-8 character(s) was used in the Content Document, which is incompatible with the Salesforce API. Solution: The backup error is related to the Salesforce FileExtension field for the ContentDocument object. This field might cause backup issues and can be safely excluded, because it is a nillable Salesforce field that isn't required for data restore. Despite excluding this field, your backups will still include the FileExtension value in the FileType field. Exclude the FileExtension from the ContentDocument object for future backups to resolve this issue. From the Backup Exclusions page in the backup service, create a New Rule for a Field, then enter the term ContentDocument.FileExtension and submit. ### Error Message: Content Documents: Salesforce Error: content\_documents fail Bulk PK Error. Example: content\_documents fail Bulk PK Error: Object backup has failed due to an unexpected error, please run an on demand backup or wait for the next scheduled backup. If issue is not resolved, contact Own Customer Support at [https://support.owndata.com/](https://support.owndata.com/). Example: Content Versions content\_versions warning: Failed downloading 18 files Solution: Create a backup exclusion rule for the service that excludes the "ContentDocument FileExtension" field. This doesn't impact the file itself. It only excludes the FileExtension field, which contains the file extension that’s preventing the record from being backed up. The file can still be restored and downloaded in its original format using the Find tool. After the FileExtension field is excluded, review the next backup and verify that the previously blocked content documents are downloaded. ### Error Message: Timeout Error too many errors in request #1- Warning for “Knowledge Article Versions” and “Knowledge KAVs” Reason: The Salesforce authenticated user is missing permissions. Solution: Grant the "View Draft Articles" and "View Archived Articles" permissions to the authenticated user. If the error persists, contact Salesforce Customer Support. ### Error Message: Too Many Requests: The user has sent too many requests in a given amount of time. Reason: A query has failed to archive multiple records and therefore stopped the archiving activity. Solutions: Disable the trigger or validation rule that is preventing the policy from deleting these records. If the issue is due to dependency, archive the referenced dependency first before archiving this record. ## Restore Error Messages Get solutions for common errors encountered during the restore process. ### Error Message: INVALID\_CROSS\_REFERENCE\_KEY Reason: The Salesforce authenticated user doesn't have the permission needed to access the record type. Solution: Verify that the Salesforce authenticated user has the permission needed to access the record type provided in the error. See Salesforce [User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US). ### Error Message: ENTITY\_IS\_DELETED Reason: At least one record references a deleted record in the destination org. Solution: Make sure that the record doesn't reference a deleted record (which could be the record’s parent) in the destination org. ### Error Message: CANNOT\_INSERT\_UPDATE\_ACTIVATE\_ENTITY Reason: Reason: This error occurs when an object has a trigger, and data being updated or created causes an error. More specifically, it is called an Unhandled Exception. Solution: - Change the Apex code to handle exceptions. - Disable the trigger (you may need to reach out to the vendor if the trigger is part of a managed package). - Exclude the records that are causing the trigger to run. ### Error Message: INVALID\_OR\_NULL\_FOR\_RESTRICTED\_PICKLIST:Status: bad value for restricted picklist field Reason 1: The destination org doesn't have the value enabled that's selected in the source environment. Solution: If an object has multiple record types enabled in the source environment, make sure to enable the value for the record type in the destination environment. If the object doesn't have a record type enabled, then enable the picklist value for the object in the destination environment. Reason 2: The source org data contains a picklist value that's no longer active. Update the value to an active value. Solution: In Setup, enter Object Manager in the Quick Find box, then select **Object Manager**. Select the object you want to update, then select **Fields and Relationships**. Select a picklist field to see its inactive values. ### Error Message: INACTIVE\_OWNER\_OR\_USER Reason: The owner of the record in the source environment is disabled in the destination environment. Solution 1: Enable the “Set Audit Fields and Update Records with Inactive Owners” permission. Then create a permission set, or edit the profile of the Salesforce authenticated user and give them the "Update Records with Inactive Owners" permission. Solution 2: Activate the record owner in the destination environment. ### Error Message: DUPLICATES\_DETECTED” or “DUPLICATE\_VALUE: duplicate value found Reason: Salesforce found a matching value in a unique identifier field when inserting or updating a record. Solution 1: Delete the duplicate records in the destination org. Solution 2: Disable duplicate rules in your Salesforce org. See [Customize Duplicate Rules](https://help.salesforce.com/s/articleView?id=sales.duplicate_rules_create.htm&type=5&language=en_US). ### Error Message: FIELD\_FILTER\_VALIDATION\_EXCEPTION: Value does not exist or does not match filter criteria Reason: This error occurs when there are lookup filters defined on an object, and you modify it so that the update does not reflect the filter criteria. Solution: Check to see if any filters are defined on the object, and make sure any modifications adhere to the filter criteria. You can see if there are any filters on the object by following the steps described in [Error 'FIELD\_FILTER\_VALIDATION\_EXCEPTION' on lookup field update](https://help.salesforce.com/s/articleView?id=000384756&type=1&language=en_US). ### Error Message: FAILED\_ACTIVATION Reason: Restore wasn't able to activate or re-enable automations on the Order object. Solution: Make sure that the "Author Apex," "Customize Application," and "Manage Flow" permissions are assigned to the Salesforce authenticated user. ### Error Message: FIELD\_INTEGRITY\_EXCEPTION Reason: Restore couldn't insert records due to the wrong object ID in the destination record’s lookup field. Solution: Validate the object ID being inserted in the destination org record’s lookup field. ### Error Message: SKIP\_INSERT Reason: A record can't be inserted because a required dependency hasn't been met. For example, a lookup to a parent that does not exist. Solution: Make sure the parent record is included in the data. ### Error Message: STRING\_TOO\_LONG Reason: A field contains a value that exceeds the field size limit. See ['STRING\_TOO\_LONG' error in Flow](https://help.salesforce.com/s/articleView?id=000386497&type=1&language=en_US). Solution: Review the data in the source org or update the field size limit. ### Error Message: INVALID\_FIELD: Failed to deserialize at col number Reason: A file is missing from the backup, so it couldn't be restored. Solution: Check the source backup to see whether all expected files and attachments were backed up. ### Error Message: SF\_BATCH\_FAILED: adding synthetic line to results file Reason: A record included in the bulk restore failed to be inserted in the destination environment. Solution: Review the resulting log file for more information on the error. ## Continuous Data Protection Error Messages Get solutions for common errors seen when you use Continuous Data Protection. ### Error Message: Failed to capture events due to an authentication error. Reauthenticate the service. Reason: The service is unable to connect to Salesforce. Solution: Reauthenticate the service, then click **Retry** to get the stream back online. ### Error Message: Failed to capture events due to configuration of: \[object\]. Check your CDC entities in Salesforce. Reason 1: The object is not in Salesforce Change Data Capture (CDC) entities. Solution: In Salesforce Setup, enter Change Data Capture in the Quick Find box and select **Change Data Capture**. After adding the entities back in CDC, click **Retry** to get the stream back online. Reason 2: The object name entered in the backup service configuration doesn't match the Salesforce API naming convention. Solution: When you set up a Continuous Data Protection service in Backup & Recover, make sure the objects in the Objects field match the Salesforce API naming convention. You can see the API names in Salesforce. In Setup, enter Change Data Capture in the Quick Find box and select **Change Data Capture**. ### Error Message: Failed to capture events. Pub/Sub API limit reached. Reason: The Pub/Sub API limit set in Salesforce was reached. Solution: The stream will return online after the Pub/Sub API quota is reset. If you raised the Pub/Sub API quota, click **Retry** to get the stream back online. See [Change Data Capture Allocations](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/cdc_allocations.htm). ### Error Message: Failed to capture events. REST API limit reached. Reason: The Pub/Sub API limit set in Salesforce was reached. Solution: The stream will return online after the Pub/Sub API quota is reset. If you raised the Pub/Sub API quota, click **Retry** to get the stream back online. See [Change Data Capture Allocations](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/cdc_allocations.htm). ## Data Privacy Error Messages Get solutions for common errors encountered during Data Privacy operations. ### Error Message: Failed to locate the object \[object\] in the latest backup. Reason: Variables in the Data Privacy request CSV were incorrect. Solution: Verify the following: - That the CSV is formatted correctly. - The value in the Object field is the Salesforce Object API Name. - The value in the RecordId field is the 18-character Salesforce Record Id.