--- schema_version: "1" id: 5abc64aaabd636d09376b21c4570e101c99a85a6b6d0484d2468d69e47df9cee title: Assigning Permissions collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-experience-hub/assigning-permissions.md canonical_url: https://docs.mulesoft.com/api-experience-hub/assigning-permissions source_site: docs.mulesoft.com content_type: documentation content_hash: 6c859f677802f4788a466c5a738510650507fb1d524e0c86eff585c12a902141 description: MuleSoft Documentation Site latest: true --- --- product: API Experience Hub --- # Assigning Permissions > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Platform comes with predefined permissions that you can set in Anypoint Platform access management to provide users with different access levels. You configure the permissions for administrators and Exchange viewers. The Salesforce platform uses the System Administrator profile, which includes permissions to perform specific tasks in Salesforce. For API Experience Hub, this profile or the AEH\_Anypoint permission set is required for the user who performs the Salesforce linking. ## Before You Begin - You must be an Organization Administrator or an existing API Experience Hub Administrator. - Consider the permission strategy for users in the Anypoint organization and Salesforce organization. See [User Roles, Permissions, and Profiles](https://docs.mulesoft.com/api-experience-hub/user-roles-permissions-and-profiles) for more information. - The Salesforce user who is assigned the AEH\_Anypoint permission set must have the Salesforce license and the Standard User profile. ## Grant the API Experience Hub Administrator Permission and the Exchange Viewer Permission The Organization Administration and API Experience Hub Administrator can perform all of the functions to create a portal. Only the Organization Administrator or an existing API Experience Hub Administrator can grant a user the API Experience Hub Administrator permission. Grant this permission when you want another user in your organization to perform the Salesforce linking process, create and curate the portal, manage the portal, and manage users. To add APIs to the portal, administrators must have Exchange Viewer permissions for those APIs. When APIs are added to the portal, all administrators are automatically assigned the Exchange Viewer permission for the APIs added in the portal. To grant the permissions to an administrator: 1. Go to **Access Management**. 2. Click **Users**, and then select the username of the user that you want to add the API Experience Hub Administrator permission. 3. Select **Permissions** and click **Add permissions**. 4. In the **Select permissions to add for this user** search box, enter **API Experience Hub Admin** and select the checkbox. 5. Enter **Exchange viewer** in the search box and select the checkbox, and then click **Next**. 6. Select the **MuleSoft** checkbox, and then click **Next**. 7. Click **Add Permissions**. ## Create the AEH\_Anypoint Permission Set with the Minimum Permissions for the Salesforce User to Perform the Linking Process A Salesforce user with the System Administrator profile is required to connect Salesforce Experience Cloud and link the Salesforce organization with the Anypoint Platform organization. The System Administrator profile might have more permissions than necessary. For users with an existing Salesforce organization and potentially sensitive data, ensure the security of that data by following the principle of least privilege. Use the AEH\_Anypoint permission set to configure only those permissions for the user who performs the linking process. The Salesforce user with the System Administrator profile creates the AEH\_Anypoint permission set with all the necessary permissions and assigns the permission set to a Salesforce user. Create the permission set manually in Salesforce or deploy it via the CI/CD pipeline using the `AEH_Anypoint.permissionset-meta.xml` metadata file. You can downgrade the permissions for the System Administrator using the permissions set before or after connecting to Salesforce. If the Salesforce user is the same user who created the connection, you can assign that user to the AEH\_Anypoint permission set without disconnecting the portal and recreating the connection. To assign the permission set to the Salesforce user who didn’t create the connection, you must disconnect the portal and recreate the connection. For example, the original Salesforce user who connected to Salesforce left the company. Perform the following steps to manually create the permission set, add the necessary permissions, and assign a user to the permission set: 1. Create the AEH\_Anypoint permission set: 1. Log in to Salesforce as the System Administrator. 2. In **Setup**, enter `permission sets` in the **Quick Find** box and click **Permission Sets**. 3. Click **New**. 4. Enter `AEH_Anypoint` exactly as it appears in both the **Label** and **API Name** fields. 5. Click **Save**. 2. Add the necessary permissions to the permission set: 1. In the **Systems** section, click **System Permissions**. 2. Click **Edit**. 3. In the **Systems** section, enable the following _required_ permissions: Required permissions - Apex REST Services - API Enabled - Assign Topics - Author Apex - Connect Organization to Environment Hub - Create and Customize Dashboards - Create and Customize List Views - Create and Customize Reports - Create and Set Up Experiences - Create Dashboard Folders - Create Report Folders - Create Topics - Customize Application - Delete Topics - Download AppExchange Packages - Edit Events - Edit HTML Templates - Edit My Dashboards - Edit My Reports - Edit Tasks - Edit Topics - Manage Auth. Providers - Manage Connected Apps - Manage Custom Permissions - Manage Dashboards in Public Folders - Manage Letterheads - Manage Multi-Factor Authentication in User Interface - Manage Public Classic Email Templates - Manage Public Documents - Manage Public List Views - Manage Reports in Public Folders - Manage Session Permission Set Activations - Modify All Data - Modify Metadata Through Metadata API Functions - Run Reports - Transfer Record - View All Data - View Dashboards in Public Folders - View Event Log Files - View Reports in Public Folders - View Roles and Role Hierarchy - View Setup and Configuration 4. In the **User** section, enable the following _required_ permissions: Required permissions - Assign Permission Sets - Manage Internal Users - Manage IP Addresses - Manage Login Access Policies - Manage Password Policies - Manage Profiles and Permission Sets - Manage Roles - Manage Sandboxes - Manage Sharing - Manage Users - Reset User Passwords and Unlock Users - View All Users 5. Enable any other permissions that you want to add to the permission set. 6. Click **Save**. 3. Assign the permission set to a Salesforce user: This user must have the Salesforce license and the Standard User profile. 1. In **Setup**, enter `Users` in the **Quick Find** box and click **Permission Sets**, and click **Users**. 2. In the **Full Name** column, select the name of the user. 3. In **Permission Set Assignments** section, click **Edit Assignments**. 4. Select **AEH\_Anypoint** from the **Available Permission Sets** list and move the set to the **Enabled Permission Sets** list. 5. Click **Save**. To deploy the permission set via your CI/CD, use the following `AEH_Anypoint.permissionset-meta.xml metadata` file, then assign the permission set to a Salesforce user: 1. Copy the metadata file and create a file named `AEH_Anypoint.permissionset-meta.xml`. ```xml false true ApexRestServices true ApiEnabled true AssignPermissionSets true AssignTopics true AuthorApex true ConnectOrgToEnvironmentHub true ConvertLeads true CreateCustomizeDashboards true CreateCustomizeFilters true CreateCustomizeReports true CreateDashboardFolders true CreateReportFolders true CreateTopics true CustomizeApplication true DelegatedTwoFactor true DeleteTopics true EditBrandTemplates true EditEvent true EditHtmlTemplates true EditMyDashboards true EditMyReports true EditPublicDocuments true EditPublicFilters true EditPublicTemplates true EditTask true EditTopics true ImportLeads true InstallPackaging true ManageAuthProviders true ManageCategories true ManageCustomPermissions true ManageDashbdsInPubFolders true ManageInternalUsers true ManageIpAddresses true ManageLoginAccessPolicies true ManageNetworks true ManagePasswordPolicies true ManageProfilesPermissionsets true ManageQuotas true ManageRemoteAccess true ManageReportsInPubFolders true ManageRoles true ManageSandboxes true ManageSessionPermissionSets true ManageSharing true ManageTerritories true ManageTranslation true ManageUsers true ModifyAllData true ModifyDataClassification true ModifyMetadata true OverrideForecasts true ResetPasswords true RunReports true SolutionImport true TransferAnyEntity true TransferAnyLead true UseTeamReassignWizards true ViewAllData true ViewAllForecasts true ViewAllUsers true ViewEventLogFiles true ViewPublicDashboards true ViewPublicReports true ViewRoles true ViewSetup true CanApproveUninstalledApps ``` 2. Run the following command and replace `path/to/permissionset/` and `orgAlias` variables with your path and org alias: ```code sf project deploy start --source-dir path/to/permissionset/ -o orgAlias ``` 3. To verify that the permission set was created: 1. Log in to Salesforce as the System Administrator. 2. In **Setup**, enter `permission sets` in the **Quick Find** box and click **Permission Sets**. 3. Locate **AEH\_Anypoint** in the list. ## Assign API Experience Hub Users Approver Permission Assign the API Experience Hub Users Approver permission to enable a user to approve or reject pending registration requests and enable or disable member users only. This permission grants access to the following **User Management** pages in **Manage your API portal**: - Portal members Enable or disable a user’s access to the portal. - Pending registration requests Approve or reject a user’s registration request. - Settings View information about the Salesforce account and portal. To assign this permission to a user: 1. Go to **Access Management**. 2. Click **Users** and select a username. 3. Select **Permissions** and click **Add permissions**. 4. In the **Select permissions to add for this user** search box, enter **API Experience Hub Users Approver** and select the checkbox. 5. Click **Next**. 6. Select the **Mulesoft** checkbox and click **Next**. 7. Click **Add Permissions**. ## See Also - [User Roles, Permissions, and Profiles](https://docs.mulesoft.com/api-experience-hub/user-roles-permissions-and-profiles) - [Connecting to Salesforce](https://docs.mulesoft.com/api-experience-hub/connecting-to-salesforce)