--- cuppy_hub: salesforce cuppy_path: reference/official/data360/data-cloud-query-guide/references/data-cloud-query-api-reference/c360a-direct-api-connected-app.md cuppy_section: docs cuppy_doc: 2W2M-0D9Q cuppy_doc_uuid: 52ca5cbd-4451-4be7-8d52-175cfbe89d4e cuppy_permalink: https://cuppy.io/salesforce/d/2W2M-0D9Q cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/salesforce/docs/reference/official/data360/data-cloud-query-guide/references/data-cloud-query-api-reference/c360a-direct-api-connected-app cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 70cffeabf1f8afb9ad04ded9d20df28fffbda447e62820ec25405f95e590110d # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- > Mirror of (Salesforce, Data 360 Query Guide), read 2026-10-23. Salesforce's own page is the authority; this copy exists because that site refuses non-browser readers. ## Authenticate with the Data Cloud Rest API Understand the prerequisites required to get started with the Data Cloud Rest API, also known as the Data Cloud Direct API. Set up a connected app to authenticate and request access to Data Cloud APIs. The connected app enables standard OAuth protocols for authentication and authorization. Follow the instructions in [Create a Connected App](https://help.salesforce.com/articleView?id=connected_app_create.htm&type=5), and configure the app as needed. In your connected app, select **Enable OAuth Settings** and the necessary OAuth scopes. The possible scopes are: * `cdp_query_api`: Execute ANSI SQL queries against Data Cloud data. * `cdp_profile_api`: Read and write Data Cloud profile and entity data. * `refresh_token`: Obtain refresh tokens for offline access. * `api`: Access Salesforce APIs (required for token exchange). Your orgs must be provisioned with Data Cloud licenses and users must be assigned to appropriate roles to have full access to objects in Data Cloud. Refer to [User Roles and Permission Sets in Data Cloud](https://help.salesforce.com/s/articleView?id=data.c360_a_userpermissions.htm&type=5) before setting up the Connected App. Send a request to acquire the Salesforce access token. Here’s an example request. Refer to [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm) for creating a JWT assertion. **Response Format** Use the `access_token` and `instance_url` to get a Data Cloud token. The `instance_url` is where you post to get a Data Cloud token. After you’ve acquired the Salesforce access token, issue this request to get the Data Cloud access token to invoke the APIs. **Response Format** You need three values from the response: * `access_token`: The token used to access Data Cloud resources. * `instance_url`: The tenant-specific endpoint where Data Cloud API requests are sent. * `expires_in`: The number of seconds until the token expires and you must reauthenticate. Use this value as part of your access logic to avoid having to repeat the access steps for each call. The Data Cloud application assigns a unique, system-generated endpoint to each of your organizations. After you’ve acquired your endpoints in Data Cloud, use them for your organization’s API calls. No other Data Cloud customer can use your endpoint for their API requests. You can only use your endpoint with the **c360a.salesforce.com** endpoint structure. When you need to revoke access tokens for security purposes or when decommissioning an application, you can revoke both the Salesforce access token and the Data Cloud token. For detailed instructions on revoking tokens, see [Revoke OAuth Tokens](https://help.salesforce.com/articleView?id=remoteaccess_revoke_token.htm&type=5) in the Salesforce Help documentation. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 376 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/salesforce/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.