--- schema_version: "1" id: f28379155ee2df87dff754e70b728995af71fa598898f2d2cc5955ed8e65bbcd title: Connect to Salesforce Data 360 Connect API collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/mc-core/guide/mc-connect-apis/mc-connect-apis-data-cloud.md canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud-growth/guide/mc-connect-apis-data-cloud.html source_site: developer.salesforce.com content_type: documentation content_hash: 4f12ecc5f4853b8b92b69dd32a190352be0302fa23891c4dab11b7af1567ccd3 products: - Marketing Cloud Next - Marketing Cloud --- # Connect to Salesforce Data 360 Connect API Data 360 Connect API is a high-performance API for ingesting data into Data 360. You can also use it to query data and to manage calculated data insights for Marketing Cloud Next. Data 360 Connect API has strict authentication requirements compared to other REST-based Salesforce APIs. **note:** Use Connect API to manage segments and identity resolution rulesets in Data 360. For information about connecting to Connect API, see [Connect to REST-based APIs](https://developer.salesforce.com/docs/marketing/marketing-cloud-growth/guide/mc-connect-apis-rest.md). ## Step 1: Generate a Private Key and Self-Signed Certificate Interacting with Data 360 Connect API requires a signed digital certificate. You can use a private key and certificate issued by a certification authority. Alternatively, you can use OpenSSL to create a key and a self-signed digital certificate. Here’s how to create a self-signed certificate with OpenSSL. 1. At the command line, create a directory to store your certificate and private key. ``` mkdir ~/jwt && cd ~/jwt ``` 2. Create a 2048-bit RSA key. ``` openssl genrsa 2048 > host.key && chmod 400 host.key ``` 3. Use the private key to sign a certificate. Enter details about the certificate, or press Enter at each prompt to accept the default value. ``` openssl req -new -x509 -nodes -sha256 -days 365 -key host.key -out host.crt ``` ## Step 2: Create an External Client App An external client app is a framework that enables a third-party app to integrate with Salesforce by using APIs. 1. In Setup, in the Quick Find box, enter `client app`, and then select **External Client App Manager**. 2. Click **New External Client App**. 3. Enter an app name and your email address. 4. Select **Enable OAuth Settings**. 5. For **Callback URL**, enter `http://localhost:1717/OauthRedirect`. 6. Select **Use digital signatures**, and then click **Browse**. 7. Select your self-signed certificate. 8. Add the OAuth scopes that are necessary for your use case. For example, if your use case requires you to ingest content, add the `Manage Data Cloud Ingestion API data (cdp_ingest_api)` scope. Also add the `Perform requests at any time (refresh_token, offline_access)` scope so that you can refresh your bearer token as needed. See [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm). 9. Save your changes. 10. Click **Manage Consumer Details**. 11. Copy the **Consumer Key** value. This value is also referred to as the client ID. You use the client ID value when you encode a Java Web Token (JWT). ## Step 3: Encode a JWT Encode a JWT by completing the steps in [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm). For best results, use libraries for your preferred programming language. Popular libraries include PyJWT for Python, `jwt-encode` for JavaScript, or `java-jwt` for Java. We provide a [code example](https://developer.salesforce.com/docs/marketing/marketing-cloud-growth/guide/mc-connect-apis-data-cloud-jwt-encode.md) that uses PyJWT to encode the JWT and request a token. The [Salesforce Data 360 Connect API Postman collection](https://www.postman.com/salesforce-developers/workspace/salesforce-developers/collection/14448118-8145476a-1797-4b2a-b219-37c6d438d956?tab=variables) handles this step for you. In the Postman collection, on the Variables tab for the parent folder, populate the `loginUrl`, `clientId`, `userName`, and `privateKey` fields with the values that you obtained earlier. Next, send a request to the API. When you send a request, a prerequest script encodes the JWT and uses it to retrieve a bearer token. It also creates variables that track the age of the token and automatically requests a new token if the existing token is expired. ## Step 4: Request an Access Token To request an access token, issue a POST request to the login endpoint for your Salesforce instance. ``` POST /services/oauth2/token HTTP/1.1 Host: login.salesforce.com Content-Type: application/x-www-form-urlencoded grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer& assertion=YOUR_JWT ``` If the request is successful, the response object includes the access token, the permission scope, your tenant-specific API URL, an identity URL, and the token type. The value of `token_type` is always `Bearer`. ```json { "access_token": "00DSB0000023p85!AQEAQM2kTRKkIiXrNHHXkTOsRZPO2vCsj71esL7xxEADntI1wPENsCKOcL3mw2ag3udQYanhaKqI3smq_50XgvkiWy5NCRrx", "scope": "cdp_query_api cdp_identityresolution_api cdp_ingest_api cdp_calculated_insight_api cdp_segment_api cdp_profile_api", "instance_url": "https://MY_DOMAIN_LOGIN_URL", "id": "https://login.salesforce.com/id/00BCM0000082q383BC/004TB0000029cmJWM42", "token_type": "Bearer" } ``` ## Step 5: Exchange the Access Token for a Data 360 Token Use your access token to obtain a token specifically for Data 360 by issuing a POST request to the `/services/a360/token` endpoint. ``` POST /services/a360/token Host: YOUR_SUBDOMAIN.my.salesforce.com Content-Type : application/x-www-form-urlencoded grant_type=urn:salesforce:grant-type:external:cdp& subject_token=ACCESS_TOKEN& subject_token_type=urn:ietf:params:oauth:token-type:access_token ``` If the request is successful, the response includes an instance URL and an access token. ```json { "access_token": "DATA_CLOUD_TOKEN", "instance_url": "MY_DOMAIN_LOGIN_URL", "token_type": "Bearer", "issued_token_type": "urn:ietf:params:oauth:token-type:jwt", "expires_in": 7191 } ``` Use the access token to issue subsequent requests to Data 360 Connect API. ## Step 6: Use the Token in Data 360 Connect API Requests When you make subsequent calls to Data 360 Connect API, include your token as a request header that uses the bearer token syntax. ``` Authorization: Bearer ACCESS_TOKEN ``` Test your authentication token by issuing a GET call to the `/api/v1/metadata/` endpoint. ``` GET /api/v1/metadata/ HTTP/1.1 Host: MY_DOMAIN_LOGIN_URL Authorization: Bearer DATA_CLOUD_TOKEN ``` If the request is successful, the response includes information about the data model objects in your Data 360 account. ```json { "metadata": [ { "fields": [ { "name": "AccountId__c", "displayName": "Account ID", "type": "STRING", "businessType": "TEXT" }, { "name": "AssistantName__c", "displayName": "Assistant’s Name", "type": "STRING", "businessType": "TEXT" }, { "name": "AssistantPhone__c", "displayName": "Asst. Phone", "type": "STRING", "businessType": "TEXT" }, { "name": "Birthdate__c", "displayName": "Birthdate", "type": "DATE_TIME", "businessType": "DATE_TIME" }, ... ] } ] } ``` Authentication tokens are valid until the time specified in the JWT that you used to obtain the bearer token. To issue API requests after the bearer token expires, request a new token. ## See Also - _JWT.io_: [Libraries for Token Signing/Verification](https://jwt.io/libraries)