--- title: "Permissions for the Natterbox Data Connector (API User)" slug: "permissions-for-the-natterbox-data-connector" tags: ["Data Connector User", "API User"] updated: 2026-11-10T16:36:50Z published: 2026-11-10T16:36:50Z canonical: "docs.natterbox.com/permissions-for-the-natterbox-data-connector" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.natterbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Permissions for the Natterbox Data Connector (API User) The Natterbox Data Connector, also known as the API user, is the single Salesforce account that Natterbox uses to read from and write to your org. This guide explains the licence, profile permissions and org settings that account needs in order to work correctly. Every time a call is made or received, Natterbox uses this account to: - Create and update call records in Salesforce - Log call notes and wrap-up data - Send and receive messages (SMS, WhatsApp) - Check recording and listening permissions > [!WARNING] > ⚠️ > > **Important:** Deactivating this user, or removing any of the permissions below, will cause Natterbox to stop working correctly, for example: calls may not be logged and wrap-up may fail. ## Licence and Org requirements - **Salesforce edition:** Enterprise, Unlimited or Performance. - **API access:** must be enabled for your org, and the account must operate within the API request limits set by Salesforce. - **Licence type:** a dedicated *Salesforce Integration* licence is recommended, as it carries no UI seat cost. A full Salesforce licence also works but is more expensive. Chatter Free and Community licences will not work, because they cannot make API calls. ## Recommended setup For most orgs, the simplest and most reliable option is to assign the **System Administrator** profile to the Data Connector user. This account must have full read/write access to all objects, with **View All Custom Settings** and **API Enabled** switched on. If you would rather build a dedicated integration user with a tailored profile, use the permission reference below. ## Required profile permissions If you are not using the System Administrator profile, the account needs at least the permissions below. These must be set **directly on the profile** — several of them cannot be granted through a permission set. | Permission | Why it is needed | | --- | --- | | API Enabled | Without it, Natterbox cannot connect at all and all data sync stops. | | Activities (create/edit) | A call log task is created on the relevant record after each call. | | Modify All Data | **Required only if your org uses private record sharing.** Natterbox may need to update Contact, Account, Lead, Case, or Opportunity records owned by other users. Without it, those updates fail in private-sharing orgs. All other object access is already covered by the Natterbox permission sets. | | Customize Application | Required to edit Natterbox configuration stored in Salesforce's protected custom settings. Salesforce only allows editing protected custom settings via this permission. | | Set Audit Fields upon Record Creation, and Update Records with Inactive Owners | Needed for wrap-up where the record owner has since been deactivated. | | View All Custom Settings | Allows Natterbox to read Salesforce custom settings (CTI server address, feature flags, licence information). This permission grants read access only, writing to protected custom settings requires Customize Application. | ## What Does the DC User Need Access To? ### Permission Sets Assign both of the following permission sets to the Data Connector user. Together they cover all object-level access required, so no individual object configuration is needed: - `NBVC_Administrator_PermissionSet` - `NBVC_BasicUser_PermissionSet` Below is a summary of the object these permission sets give access to, in addition to the standard Salesforce objects (Contacts, Accounts, Leads, Cases, Opportunities, Tasks) and all Natterbox package objects. ### Permission References for Natterbox Package Objects #### Call Data | Object | Access | Why | | --- | --- | --- | | Call Records | Read | Checks existing call records when processing recording access requests | | Call Wrap-up | Read, Create, Update, Delete | Creates a draft wrap-up when a call starts; updates it as the agent fills in notes; deletes it if the agent discards it | | Conversations / Message Threads | Read, Create, Update | Tracks ongoing SMS and WhatsApp conversations | | Error Logs | Create | Records any errors that occur during data sync so they can be investigated | | Temporary Call Log Buffer | Read, Create, Update, Delete | A short-lived staging area used while the call log task is being built; cleaned up automatically after the task is created | Messaging & ConsentMessaging & Consent #### Messaging & Consent | Object | Access | Why | | --- | --- | --- | | Consent Records | Read, Create, Update | Tracks TCPA/GDPR consent before sending SMS or WhatsApp messages | | Phone Numbers | Read | Looks up which phone number to send a message from | #### Recording Access | Object | Access | Why | | --- | --- | --- | | Recording Access Rules | Read | Checks whether the requesting user is allowed to play back a specific recording | | Individual Recording Permissions | Read | Checks per-user overrides for recording playback | | AI Insights | Read | Checks whether a supervisor can access call insights during listen-in | | Insight Views | Read | Tracks which insights a supervisor has already reviewed | #### Listen-in & Supervisor Features | Object | Access | Why | | --- | --- | --- | | Natterbox Users | Read | Looks up the agent being listened in on and retrieves their settings | | Groups | Read | Checks which group an agent belongs to, to verify listen-in permissions | | Group Members | Read | Confirms group membership for permission checks | | Group Administrators | Read | Confirms supervisor status for permission checks | ## Troubleshooting | Symptom | Likely Cause | What to Check | | --- | --- | --- | | Calls are not being logged in Salesforce | Activities permission missing from profile, or DC User deactivated | Check the DC User is active; check the profile has Activities enabled | | Wrap-up fails or saves incorrectly | Missing object permissions or field-level access on wrap-up data | Check the DC User's permission set includes access to wrap-up and all its fields | | The Natterbox phone widget does not load | Clickjack protection is enabled | Go to Setup > Session Settings and disable clickjack protection for Visualforce pages | | DC User gets logged out unexpectedly | Session is locked to originating IP | Disable IP-locked sessions, or add Natterbox IP addresses to the allowed list | | Recording playback fails for some users | Recording access permissions missing | Check the DC User can read Recording Access Rules and Individual Recording Permissions | | Users assigned via Permission Set Groups show no Natterbox role | The DC User cannot read Salesforce Permission Set Group data | Ensure the DC User has at least Read access to Salesforce permission assignment objects | ## Related - [Technical Prerequisites](/technical-prerequisites.md) - [How to Reauthorise your Data Connector with Natterbox](/reauthorizing-your-data-connector-with-natterbox.md)