Salesforce.

How it works.

The Salesforce integration runs a bidirectional sync between the wrxstack work graph and one or more Salesforce orgs. The sync uses three Salesforce surfaces in combination. Change Data Capture (CDC) handles real-time push from Salesforce into wrxstack. Bulk API 2.0 handles the initial backfill and any periodic full reconcile. The REST API handles writes from wrxstack back into Salesforce, gated by the field-mapping configuration.

The integration is built as a Salesforce Connected App. It uses the OAuth 2.0 client credentials grant for backend operations and the user-agent flow for user-scoped writes. Sandbox and production orgs are supported. Multiple Salesforce orgs can be connected to a single wrxstack workspace; each maps to its own namespace inside the work graph and shares no records with the others unless you explicitly link them.

Field mapping is declarative. An admin writes a mapping document that names each Salesforce object, the wrxstack node it maps to, the field translations, and the conflict policy when both sides change the same record. We default to "Salesforce wins" on conflict for the records Salesforce owns (accounts, opportunities, contacts) and "wrxstack wins" for records wrxstack owns (assistant-generated activities and notes).

Setup steps.

Example mapping (YAML)

# wrxstack Salesforce mapping
version: "2026-04"
org: "acme-prod"
conflict_policy: "source_wins"

objects:
  - salesforce: "Account"
    wrxstack: "crm.company"
    key: "Id"
    fields:
      - { sf: "Name",           wrx: "name" }
      - { sf: "Industry",       wrx: "industry" }
      - { sf: "NumberOfEmployees",wrx: "size" }
      - { sf: "Website",        wrx: "website" }
      - { sf: "OwnerId",        wrx: "owner", resolve: "user_by_sf_id" }

  - salesforce: "Opportunity"
    wrxstack: "crm.deal"
    key: "Id"
    fields:
      - { sf: "Name",          wrx: "title" }
      - { sf: "StageName",     wrx: "stage" }
      - { sf: "Amount",        wrx: "value" }
      - { sf: "CloseDate",     wrx: "close_at" }
      - { sf: "AccountId",     wrx: "company", resolve: "company_by_sf_id" }

What it syncs.

Security model.

The Connected App requires three OAuth scopes: api, refresh_token, offline_access. We do not request "Full access" or any admin scope. The refresh token is stored encrypted at rest with a per-tenant data key and is rotatable from the admin panel without re-installing the app. We honor Salesforce's IP restrictions and login flow restrictions if your org has them.

Field-level security is honored on read and on write. If a user does not have permission to a Salesforce field, that field is not exposed in wrxstack to them and we do not write to it. Sharing rules are inherited; a wrxstack user sees the records the matched Salesforce user would see. Profile-based permission changes propagate within five minutes.

Every write through the integration is audit-logged with the originating wrxstack user, the matched Salesforce user, the object, the field-level diff, and the resulting CDC event ID. Every write is recorded in the workspace audit log. We retain integration audit events for one year.

Common use cases.

• Capture a customer call into Salesforce.The assistant attends the call, transcribes it, writes a structured summary, and posts the result back to Salesforce as a Task on the right Account and Opportunity. The full transcript stays in wrxstack with the record link.
• Surface CRM context inside any wrxstack doc.Mention "@account: Acme" in a document and the rendered card pulls the live Account record from Salesforce. Updates in Salesforce refresh the card on the next view.
• Trigger workflows on stage transitions.When an Opportunity moves from Proposal to Closed Won, the wrxstack workflow generates the contract task, schedules the post-sale kickoff, and notifies finance. All bidirectional with Salesforce as the source of truth.
• Reconcile CRM hygiene.A weekly assistant report shows the records with missing required fields, stale stage transitions, or duplicate contacts. The report has one-click writes back to Salesforce.
• Forecast assist.The assistant reads the open pipeline, the recent customer signals (meeting outcomes, email replies, support tickets), and proposes a forecast adjustment with reasoning attached. Adjustments are gated on a human approver.

Troubleshooting.

• CDC events are not arriving.CDC is not enabled for that object in Salesforce Setup, or the user behind the Connected App does not have View All on that object. Confirm both, then click "Resync subscription" in the wrxstack admin panel.
• Backfill stalls partway through.The Bulk API has hit your org's daily limit. Wait twenty-four hours or upgrade your Salesforce edition. wrxstack will resume from the last completed batch.
• Writes return INVALID_FIELD_FOR_INSERT_UPDATE.The mapping references a field the connected user does not have edit permission on. Update the user's profile or remove the field from the mapping.
• Records show up twice in wrxstack.The deduplication key is mismatched between the two objects. Confirm the key field is Id (not Name) in the mapping, and run a full reconcile.
• Sandbox refresh broke the integration.Sandbox refreshes invalidate refresh tokens. Reconnect the sandbox from the admin panel; production is unaffected.