---
schema_version: "1"
id: 5b67298f1ab8c3a5ef4a1c14cc0f861239e6d4b438e4b362e14de5d78a2eec54
title: Get Started with Salesforce Spiff Import API and Object API
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/sales-cloud/spiff/guides/import-object-api-get-started.md
canonical_url: https://developer.salesforce.com/docs/sales/spiff/guide/import-object-api-get-started.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: a0c2a5be8abc9c7f7d2e5a27643fa01cf00a1188d338b933969d4c6ca955562c
products:
  - Salesforce Spiff
  - Sales Cloud
---
# Get Started with Salesforce Spiff Import API and Object API

Import records into Salesforce Spiff, such as teams and team assignments, or create, read, update, and delete Spiff objects and fields.

## 1. Generate the HMAC-SHA256 Signature

All endpoints in the Spiff Import API and Spiff Object API require a signature header, which is a HMAC-SHA256 cryptographic hash of the current time, the request body, and a secret key for your company. The signature format is `t={timestamp},v1={digest}`, where `{timestamp}` is a UTC epoch timestamp and `{digest}` is a string representation of the HMAC-SHA256 digest.

First, contact Salesforce Customer Support and request the secret key for your company. Then, generate the signature.

### cURL Example

Here's a cURL example for generating a signature.

```curl
export COMPANY_UUID="COMPANY_ID"
export SECRET="COMPANY_SECRET"
export URL="https://SUBDOMAIN.spiff.com/api/external_data/$COMPANY_UUID/objects"
export BODY=""
export TIMESTAMP=$(date +%s)
export MESSAGE="${TIMESTAMP}.${BODY}"
export DIGEST=$(printf '%s' "$MESSAGE" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')
export SIGNATURE="t=${TIMESTAMP},v1=${DIGEST}"
echo "SIGNATURE: $SIGNATURE"

curl -v GET "$URL" -H 'content-type: application/json' -H "Signature: $SIGNATURE"
```

Replace these values:

- `COMPANY_ID`: Your Spiff company ID, which you can find at **Admin » Settings » Company Settings » Company Identifiers**.
- `COMPANY_SECRET`: Your Spiff company secret that you received from Salesforce Customer Support.
- `SUBDOMAIN`: The subdomain for your Spiff environment.
  - If you're in the US, use `us1`.
  - If you're in the EU, use `eu1`.

### Python Example

Here's a Python example.

```python
import hashlib
import json
import hmac
import time

secret = b"KEY"

body = {
    "import_target": "OBJECT_ID",
    "import_action": "upsert",
    "payload": [
        {
            "external_id": "12345",
            "name": "Test Person",
            "email": "test.person@example.com"
        }
    ]
}
epoch_timestamp = str(int(time.time()))
json_body = json.dumps(body)
predigeststring = f"{epoch_timestamp}.{json_body}".encode("utf-8")
signatureHash = hmac.new(secret, predigeststring, hashlib.sha256).hexdigest()

headers = {
    "Signature": f"t={epoch_timestamp},v1={signatureHash}",
    "Content-Type": "application/json"
}
```

Replace these values:

- `KEY`: Your Spiff company secret that you received from Salesforce Customer Support.
- `OBJECT_ID`: The ID of a Spiff object, such as `0a5de148-4864-41f3-bd59-03ee50435e14`, or the name of a supported Spiff object, such as `teams`.

## 2. Test the Signature

To verify that you generated the HMAC-SHA256 signature correctly, pass the signature in a header with the [testImport](/docs/sales/spiff/references/spiff-import-api-reference?meta=testImport) endpoint.

```
curl "https://SUBDOMAIN.spiff.com/api/external_data/COMPANY_ID/imports/test" \
  -X POST \
  -H "signature: t=TIMESTAMP,v1=DIGEST" \
  -H "content-type: application/json"
```

Replace these values:

- `SUBDOMAIN`: The subdomain for your Spiff environment.
  - If you're in the US, use `us1`.
  - If you're in the EU, use `eu1`.
- `COMPANY_ID`: Your company's UUID in Spiff, which you can find at **Admin » Settings » Company Settings » Company Identifiers**.
- `TIMESTAMP`: The string representation of the UTC epoch timestamp when the signature was created.
- `DIGEST`: The string representation of the HMAC-SHA256 signature that you generated.

You can now use the other endpoints in the Import API and Object API. See [Spiff Import API](/docs/sales/spiff/references/spiff-import-api-reference?meta=Summary) and [Spiff Object API](/docs/sales/spiff/references/spiff-object-api-reference?meta=Summary). Make sure that you pass the signature header for every endpoint.

**See Also**

- _Salesforce Help_: [Getting Data into Salesforce Spiff](https://help.salesforce.com/s/articleView?id=sales.spiff_data.htm&type=5)
- _Trailhead_: [Deliver Smarter Incentives with Salesforce Spiff](https://trailhead.salesforce.com/content/learn/trails/deliver-smarter-incentives-with-salesforce-spiff)