Salesforce · Tableau Next · SE Track

OAuth Scopes.

Three CDP scopes required for live Data Cloud ingestion. Curl evidence, exact PlatformCLI Connected App edit path, the 90-second fix an attendee sees when their kit install 401s.

Agent Astro

The three scopes

cdp_ingest_api — Access CDP Ingestion API
cdp_query_api — Access CDP Query API
cdp_profile_api — Access CDP Profile API

The fix (90 seconds)

Open Setup → App Manager → find "Salesforce CLI" (API name: PlatformCLI)
Dropdown → Manage → Edit Policies
Under Selected OAuth Scopes, add the three above. Save.

Wait ~60 seconds, then re-mint the CLI session:

sf org logout --target-org <alias>
sf org login web --alias <alias> \
  --scopes "api cdp_ingest_api cdp_query_api cdp_profile_api refresh_token"

Verify it worked

curl -H "Authorization: Bearer $(sf org display --json | jq -r .result.accessToken)" \
  "$(sf org display --json | jq -r .result.instanceUrl)/services/data/v67.0/ssot/connections"

200 OK = you're good. 401 = scopes not applied yet, or session cached.