ORG permissions

Permissions the connected user needs

Stood Flows is read-only. The connected org user needs visibility on what you want to analyse, nothing more:

• View Setup and Configuration (system permission). Required for metadata reads.

• API Enabled (system permission). Required to make any SOQL or REST call.

• Read access on the standard CRM objects (Lead, Opportunity, Case, Account, Contact, Campaign) and any custom objects you plan to enable in the graph.

• View All Data or View All on objects is convenient but not required — Stood Flows scopes queries by record type when it can.

• View All External Client Apps, View All Users, View All Profiles enabled.

• For Event Log File reads (used by DML and I/O analyses): View Event Log Files permission. This unlocks the EventLogFile object so Stood Flows can pull yesterday's hourly logs for Login, DatabaseSave, API, RestApi, CalloutRequest, ExternalCustomApexCallout, ExternalODataCallout, ExternalCrossOrgCallout, etc.

• For Apex source bodies: the user will query ApexClass.Body and ApexTrigger.Body via the Tooling API.

A dedicated read-only integration user with these permissions is the cleanest setup. Anything Stood Flows writes lands on your local machine — never on the org.

Authorize Salesforce CLI

CLI App must be authorized for the ORG: https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_web_flow.htm

For that one admin may need to initiate a CLI login from a shell:

sf org login web --alias my-org

Once the CLI is authorized, more actions or permissions appear in "Connected Apps OAuth Usage" (load actions > install for more options) or "Manage connected apps"