The External Connections report is a security report that finds the external systems a Salesforce org connects to. The report reads the metadata snapshot only, and does not log into the org. For every endpoint, the report shows the classification, the direction of the connection, the external host, how the endpoint was resolved, and any security flags.
Integrations are spread across many metadata types. A single vendor can appear in a Named Credential, a Connected App, a Remote Site Setting, and an Apex class. The report brings these pieces together, and the summary groups every endpoint by external host so each integration can be reviewed in one place.
When To Use This Report
- For a security audit or a compliance review of the org.
- To build an inventory of integrations and external vendors.
- Before connecting a new vendor, or after retiring an old one.
- To find endpoints that use HTTP instead of HTTPS, wildcard origins, or broad OAuth scopes.
Open The Report
- Right-click a Metadata Snapshot item on the desktop.
- Select External Connections under Security.
No login is needed. The report works from the metadata in the snapshot.
Select Metadata Tab
The left side of the tab lists the metadata types that can hold external connections. Metadata types that are not in the snapshot are grayed out. The first time the report is opened, every available type is checked.
- Check the box next to each metadata type to include in the report.
- Type in the Quick Find box to locate a metadata type.
- Right-click the list to Check None or Check All Types.
- Select a metadata type to preview the endpoints for that type in the table on the right.
The metadata types include Named Credentials, External Credentials, External Data Sources, External Services, Network Connections, Remote Site Settings, CSP Trusted Sites, CORS Whitelist Origins, Connected Apps, Auth Providers, SAML SSO Configurations, Certificates, Workflow Outbound Messages and Alerts, Email Services, Call Centers, Apex, Visualforce, Lightning Components, Static Resources, Flows, Custom Metadata, Custom Labels, Tabs, Web Links, Navigation Menus, Sites, Networks, Experience Bundles, and Data Cloud connectors.
Hold down the Escape key to cancel a long scan.
Display Report Tab
Open the Display Report tab to scan every checked metadata type. The report shows one table for each metadata type, with one row for every distinct endpoint found in an asset.
Display Options
- Show Links shows a link that opens the asset in Salesforce.
- Show Create Modify shows who created and last modified the asset, and when.
- Show Usage shows the text around each endpoint.
- Color Code shows endpoints with security flags in red, and the rest in green.
- Clean Report hides tables that have no endpoints.
- Show Platform URLs includes Salesforce URLs and standards URLs, such as XML namespaces. These URLs are hidden by default because they are not external connections.
Use the menu on the right to sort by Asset Name, Endpoint Host, Classification, Direction, Security Flags, Created By, Created Date, Last Modified By, or Last Modified Date.
Select Reports, Dashboards, or Summary to switch between the report tables, the charts, and the summary tables.
Report Columns
| Column | Description |
|---|---|
| Folder Name | The folder of the asset, for folder based types. |
| Asset Name | The asset that contains the endpoint. Child types show the Parent Asset here. |
| Element Name | The child element that contains the endpoint, for child types such as Workflow Outbound Messages. |
| Classification | The role of the endpoint. See the table below. |
| Direction | Outbound when Salesforce calls the external system, Inbound when the external system reaches into Salesforce. |
| Endpoint Host | The host name of the external system. |
| Endpoint | The full endpoint, with user names, passwords, query strings, and fragments removed. |
| Resolution | How the endpoint was found. See the table below. |
| Security Flags | The security risks found for the endpoint or the asset. See the table below. |
| Occurrences | The number of times the endpoint appears in the asset. |
| Usage Snippet | The text around the first occurrence of the endpoint. |
| Created By, Created Date, Last Modified By, Last Modified Date | Audit information for the asset. |
| Browser Link | A link that opens the asset in Salesforce. |
Classifications
| Classification | Meaning |
|---|---|
| Outbound Connection | A Named Credential, External Credential, External Data Source, External Service, or network connection that calls an external system. |
| Outbound Allowlist | A Remote Site Setting that permits Apex callouts to a destination. An allowlist entry does not prove a callout exists. |
| Browser Trust | A CSP Trusted Site that permits pages in Salesforce to load content from an external site. |
| Inbound Origin | A CORS origin that permits an external web site to call Salesforce from a browser. |
| OAuth Application | A Connected App or External Client App, with callback and application URLs. |
| Identity Provider | An Auth Provider or SAML SSO Configuration used to sign in to Salesforce. |
| Outbound Message | A Workflow outbound message that sends record data to an external endpoint. |
| Outbound Email | An email alert that sends to an address outside the org. |
| Hard Coded Endpoint | A URL written directly into Apex code. |
| Callout Reference | A callout:Name reference in Apex that uses a Named Credential. |
| External Service | An External Service, or a Flow action that calls an External Service. |
| Inbound REST Service, Inbound SOAP Service | Apex that exposes a web service other systems can call. |
| Inbound Email Service | An Email Service that accepts email from outside the org. |
| Public Site | A Site, Network, or Experience Bundle that is reachable from the internet. |
| Browser Code, Automation Endpoint, Configuration, Navigation, Telephony | URLs found in Lightning Components, Visualforce, Static Resources, Flows, Custom Metadata, Custom Labels, Tabs, Web Links, and Call Centers. |
| Certificate | A certificate with the expiration date shown in the Endpoint column. |
| Test Code | A URL in an Apex test class. Test code usually uses fake endpoints, so no security flags are reported. |
Resolution Values
| Resolution | Meaning |
|---|---|
| Direct | The complete endpoint is stored in the asset. |
| Resolved | The endpoint was found by following a reference, such as a callout:Name reference to a Named Credential. |
| Dynamic | The endpoint is built at run time, so the destination is not in the metadata. |
| Unresolved | The referenced Named Credential or External Service is not in the snapshot. |
| Interface Only | The asset exposes an inbound service, site, or email address, but the external caller is not known from the metadata. |
| Not Applicable | The row describes a certificate rather than an endpoint. |
Security Flags
| Flag | Meaning |
|---|---|
| Not HTTPS | The endpoint uses HTTP, so data is sent without encryption. |
| Wildcard Host | The host contains an asterisk and matches many sites. |
| Credentials In URL | The URL contains a user name or password. |
| Local Host, IP Address Host | The endpoint points to the local machine or to a raw IP address instead of a host name. |
| Non Production Host | A production org points to a host with sandbox, test, dev, qa, uat, or staging in the name. |
| Sends Session ID | An outbound message sends the Salesforce session ID to the external system. |
| Protocol Security Disabled | A Remote Site Setting allows HTTP callouts. |
| No Authentication | A Named Credential or External Data Source connects without authentication. |
| Merge Fields Allowed | A Named Credential allows merge fields in the request header or body. |
| Full Access Scope, Refresh Token Scope | An OAuth application has full access or can keep access with refresh tokens. |
| Refresh Token Never Expires | Refresh tokens for an OAuth application are valid until revoked. |
| IP Restrictions Relaxed | An OAuth application bypasses IP restrictions. |
| Send Secret In APIs | An Auth Provider has the Send Secret In APIs setting turned on. |
| Sender Not Authenticated, TLS Not Required | An Email Service accepts email without sender authentication or without TLS. |
| Self Registration | A Network allows users to register themselves. |
| Inactive | A Remote Site Setting, CSP Trusted Site, Email Service, or Site is turned off and may be a candidate for removal. |
| Certificate Expired, Certificate Expires Within 60 Days | A certificate has expired or will expire soon. |
Dashboards
- Metadata Types By Endpoints shows the endpoints with and without security flags for each metadata type.
- External Hosts By Endpoints shows how many endpoints point to each external host.
Summary
The summary has two tables.
The first table has one row for every metadata type in the report, and a Totals row at the bottom.
| Column | Description |
|---|---|
| Metadata Type | The metadata type that was scanned. |
| Total Assets | The number of assets scanned. |
| Assets With Endpoints | The number of assets that contain at least one endpoint. |
| Endpoints | The number of endpoints found. |
| External Hosts | The number of distinct external hosts. |
| Flagged Endpoints | The number of endpoints with security flags. |
| Assets With Endpoints % | The percent of assets that contain endpoints. |
The second table has one row for every external host. Each host usually represents one integration or one vendor.
| Column | Description |
|---|---|
| Endpoint Host | The host name of the external system. |
| Endpoints | The number of endpoints that point to the host. |
| Flagged Endpoints | The number of those endpoints with security flags. |
| Metadata Types | The metadata types that reference the host. |
| Classifications | The roles the host plays, such as Outbound Connection or OAuth Application. |
| Directions | Whether the host is reached outbound, inbound, or both. |
| Security Flags | Every security flag found for the host. |
Export, Explain, And Schedule
- Right-click any table to export the report as CSV, Excel, PDF, or HTML.
- Right-click any table and select Explain Report Table to have the Intelligent Assistant summarize the security findings.
- Use the Schedule Report tab to run the report on a schedule. The condition If Security Flags Reported only sends the report when security flags are found.
What The Report Does Not Show
- The report shows configured connections, not usage. Login history and OAuth token activity are not part of the metadata snapshot.
- Endpoints stored in Custom Settings records are not in the metadata snapshot.
- Endpoints built at run time from variables are reported as Dynamic.
- Middleware and integration tools that connect to Salesforce without metadata in the org are not visible to the report.