Load Salesforce data into BigQuery

You can load data from your Salesforce Sales Account to BigQuery using theBigQuery Data Transfer Service for Salesforce connector. With theBigQuery Data Transfer Service, you can schedule recurring transfer jobs thatadd your latest data from your Salesforce Sales Account toBigQuery.

Limitations

Salesforce data transfers are subject to the following limitations:

  • The Salesforce connector only supports transfers from aSalesforce Sales Account.
  • The Salesforce connector only supports fields included in Salesforce BulkAPI V1 version 64.0. Some fields that were included in previous versions of the SalesforceBulk API might not be supported. For more information about these changes to the Salesforceconnector, seeSalesforce Bulk API.
  • The Salesforce connector uses Salesforce Bulk API V1 to connectto the Salesforce endpoint to retrieve data.
    • The Salesforce connector only supports the SalesforceBulk API V1 to connect to the Salesforce instance, and only supports thetransfer of entities which are supported by the Salesforce Bulk API. For moreinformation about what entities are supported, see'Entity is not supported by the Bulk API' error.
  • The Salesforce connector does not support the transfer ofthe following objects that have binary fields.
    • Attachment
    • ContentVersion
    • Document
    • StaticResource
    • Scontrol
    • EmailCapture
    • MailMergeTemplate
  • The minimum interval time between recurring data transfers is 15 minutes. Thedefault interval for a recurring transfer is 24 hours.
  • Due to Salesforce processing limits, scheduling too many datatransfers at a time can lead to delays or failures. We recommend that you limitSalesforce data transfers to the following:
    • Have no more than 10 assets per transfer configuration.
    • Across your different transfer configurations, have no more than 10simultaneous transfer runs at a time.
  • A single transfer configuration can only support one data transfer run at a giventime. In the case where a second data transfer is scheduled to run before thefirst transfer is completed, then only the first data transfer completes whileany other data transfers that overlap with the first transfer is skipped.
    • To avoid skipped transfers within a single transfer configuration, werecommend that you increase the duration of time between large datatransfers by configuring theRepeat frequency.
  • If you are using network attachments with your data transfer, you mustset up a public network address translation (NAT) with a static IPaddress. For more information, seeSetup IP allowlist for Salesforce transfers.
  • If your configured network attachment and virtual machine (VM) instance arelocated in different regions, there might be cross-region data movement whenyou transfer data from Salesforce.

Incremental transfer limitations

Incremental Salesforce transfers are subject to the followinglimitations:

  • You can only chooseTIMESTAMP columns as watermark columns.
  • Incremental ingestion is only supported for assets with valid watermark columns.
  • Values in a watermark column must be monotonically increasing.
  • Incremental transfers cannot sync delete operations in the source table.
  • A single transfer configuration can only support either incremental or fullingestion.
  • You cannot update objects in theasset list after the first incrementalingestion run.
  • You cannot change the write mode in a transfer configuration after the firstincremental ingestion run.
  • You cannot change the watermark column or the primary key after the firstincremental ingestion run.

Data ingestion options

The following sections provide more information on the data ingestion optionswhen you set up a Salesforce data transfer.

Full or incremental transfers

You can specify how data is loaded into BigQuery by selectingeither theFull orIncremental writepreference in the transfer configuration when youset up aSalesforce transfer. Incremental transfersare supported inpreview.

Note: To request feedback or support for incremental transfers, send email todts-preview-support@google.com.You can selectFull to transfer all data from your Salesforcedatasets with each data transfer.

Alternatively, you can selectIncremental(Preview) to onlytransfer data that was changed since the last data transfer, instead of loadingthe entire dataset with each data transfer. If you selectIncremental foryour data transfer, you must specify either theAppend orUpsert writemodes to define how data is written to BigQuery during anincremental data transfer. The following sections describe the available writemodes.

Append write mode

TheAppend write mode only inserts new rows to your destination table. This optionstrictly appends transferred data without checking for existing records, sothis mode can potentially cause data duplication in the destination table.

When you select theAppend mode, you must select a watermark column. Awatermark column is required for the Salesforce connector to track changesin the source table.

For Salesforce transfers, we recommend selecting a column that is onlyupdated when the record was created, and won't change with subsequent updates.For example, theCreatedDate column.

Upsert write mode

TheUpsert write mode either updates a row or inserts a new row in yourdestination table by checking for a primary key. You can specify a primary keyto let the Salesforce connector determine what changes are needed to keepyour destination table up-to-date with your source table. If the specifiedprimary key is present in the destination BigQuery table during a data transfer, then the Salesforceconnector updates that row with new data from the source table. If a primary keyis not present during a data transfer, then the Salesforce connectorinserts a new row.

When you select theUpsert mode, you must select a watermark column and aprimary key:

  • A watermark column is required for the Salesforce connector to track changes in the source table.
    • Select a watermark column that updates every time a row is modified. We recommend using theSystemModstamp orLastModifiedDate column.
  • The primary key can be one or more columns on your table that are requiredfor the Salesforce connector to determine if itneeds to insert or update a row.
    • Select columns that contain non-null values that are unique across allrows of the table. We recommend columns that include system-generatedidentifiers, unique reference codes (for example, auto-incrementing IDs), orimmutable time-based sequence IDs.
    • To prevent potential data loss or data corruption, the primary key columnsthat you select must have unique values. If you have doubts about theuniqueness of your chosen primary key column, then we recommend that youuse theAppend write mode instead.

Before you begin

The following sections describe the steps that you need to take before youcreate a Salesforce data transfer.

Create a Salesforce Connected App

You mustcreate a Salesforce Connected Appwith the following required configurations:

  • Configure the Basic Informationin the Connected App. TheConnected App Name andContact Emailfields are required for a Salesforce transfer.
  • Enable OAuth Settingswith the following configurations:
    • Select theEnable OAuth Settings checkbox.
    • In theCallback URL field, enter the following:
      • For a production environment, enterhttps://login.salesforce.com/services/oauth2/token.
      • For a sandbox environment, enterhttps://test.salesforce.com/services/oauth2/token.
    • Verify that theIssue JSON Web Token(JWT)-based access tokens for named userscheckbox isn't selected.
  • In theSelected OAuth Scopes section, selectManage user data via APIs (api).
  • Clear theRequired Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flowscheckbox.
  • Select theEnable Client Credentials Flow, then clickOK on thenotice that appears.

Once you have configured the Connected App with the required configurations,clickSave. You are redirected to the detail page of your newly createdConnected App.

Once you have created the Connected App, you must also configure the clientcredentials flow by doing the following:

  1. ClickSetup.
  2. In the search bar, search forConnected Apps.
  3. ClickManage Apps>Connected Apps. If you are usingthe Salesforce Lightning Experience, clickManage Connected Apps.
  4. On the Connected App that you have created, clickEdit.
  5. TheApp details page appears. In theClient Credentials Flowsection, enter your username in theRun As field. You can use thefinder tool in this field to ensure that you have selected the correctuser.
  6. ClickSave.

Required Salesforce information

You must have the following Salesforce information when creating aSalesforce data transfer:

Parameter NameDescription
myDomainYourMy Domain in Salesforce.
clientIdConsumer Key of the Salesforce connected application.
clientSecret

OAuth Client Secret or Consumer Secret of the Salesforce connected application.

To obtain yourmyDomain,clientID, andclientSecret values,select one of the following options:

Salesforce Classic

RetrievemyDomain details

To find yourmyDomain, do the following:

  1. Sign in to the Salesforce platform.
  2. ClickSetup.
  3. In the search bar, search forMy Domain.
  4. In the search results, clickDomain Management>My Domain.

In theMy Domain Details section, yourmyDomain appears asthe prefix inCurrent My Domain URL. For example, if the My Domain URL isexample.my.salesforce.com, themyDomain value to use isexample.

RetrieveClientId andClientSecret details

To find yourClientId andClientSecret values, do the following:

  1. Sign in to the Salesforce platform.
  2. ClickSetup.
  3. In the search bar, search forApps.
  4. In theBuild section in the search results, clickCreate>Apps.
  5. Click aConnected App Name.
  6. In theConnected Apps details page, clickManage Consumer Details.
  7. Verify your identity using one of the registered methods. You can view theconsumer details page for up to five minutes before you're prompted to verifyyour identity again.
  8. In theConsumer Details page, theConsumer Key is yourClientIdvalue. TheCustomer Secret is yourClientSecret value.

Salesforce Lightning Experience

RetrievemyDomain details

To find yourmyDomain, do the following:

  1. Sign in to the Salesforce platform.
  2. ClickSetup.

Open the Setup page in the Salesforce platform.

  1. In the search bar, search forMy Domain.
  2. In the search results, clickCompany Settings>My Domain.

In theMy Domain Details section, yourmyDomain appears asthe prefix inCurrent My Domain URL. For example, if the My Domain URL isexample.my.salesforce.com, themyDomain value to use isexample.

RetrieveClientId andClientSecret details

  1. Sign in to the Salesforce platform.
  2. ClickSetup.
  3. In the search bar, search forApps.
  4. In the search results, clickApps>App Manager.
  5. Find a connected app, then clickView.
  6. ClickManage Consumer Details.
  7. Verify your identity using one of the registered methods. You can view theconsumer details page for up to five minutes before you're prompted to verifyyour identity again.
  8. In theConsumer Details page, theConsumer Key is yourClientIdvalue. TheCustomer Secret is yourClientSecret value.

Setup IP allowlist for Salesforce transfers

You must configure your Google Cloud environment and your Salesforceaccount to add specific IP addresses to the allowlist for data transfers.This ensures that Salesforce only accepts connections from a trusted,static IP address. This step is required if you are using network attachmentswith your data transfers.

To do so, you must first set up and configure your Google Cloud network to usea static IP address:

  1. Set up a public network address translation(NAT) with a static IPaddress within your Virtual Private Cloud network. The CloudNAT must be configuredwithin the same region as the destination dataset for this data transfer.
  2. Set up a network attachmentwithin the same VPC network. This resource is used by theBigQuery Data Transfer Service to access private services.

Next, you mustconfigure the trusted IP ranges inSalesforce.When adding the range of the IP address, use the static IP address from yourGoogle Cloud public NAT for both the beginning and ending IP addresses for theIP range.

Note: For more granular control, you can apply IP restrictions at the profile level or on every API call. For more information, seeRestrict Login IP Addresses in Profiles.

Once you have set up the IP ranges, you can now specify the static IP when youset up your transfer configuration by selecting your network attachment in theNetwork attachment field.

BigQuery prerequisites

Required BigQuery roles

To get the permissions that you need to create a BigQuery Data Transfer Service data transfer, ask your administrator to grant you theBigQuery Admin (roles/bigquery.admin) IAM role on your project. For more information about granting roles, seeManage access to projects, folders, and organizations.

This predefined role contains the permissions required to create a BigQuery Data Transfer Service data transfer. To see the exact permissions that are required, expand theRequired permissions section:

Required permissions

The following permissions are required to create a BigQuery Data Transfer Service data transfer:

  • BigQuery Data Transfer Service permissions:
    • bigquery.transfers.update
    • bigquery.transfers.get
  • BigQuery permissions:
    • bigquery.datasets.get
    • bigquery.datasets.getIamPolicy
    • bigquery.datasets.update
    • bigquery.datasets.setIamPolicy
    • bigquery.jobs.create

You might also be able to get these permissions withcustom roles or otherpredefined roles.

For more information, seeGrantbigquery.admin access.

Set up a Salesforce data transfer

Add Salesforce data into BigQuery by setting up atransfer configuration using one of the following options:

Console

  1. Go to the Data transfers page in the Google Cloud console.

    Go to Data transfers

  2. ClickCreate transfer.

  3. In theSource type section, forSource, chooseSalesforce.

  4. In theData source details section, do the following:

    • ForNetwork attachment, select a network attachment from the list.You mustconfigure your public NAT and set up your IP allow listbefore you can use a network attachment with this data transfer.
    • ForMy Domain, enter your SalesforceMy Domain.
    • ForClient ID, enter the Salesforce connectedapplication Consumer Key.
    • ForClient secret, enter the Salesforce connectedapplication Consumer Secret.
    • ForIngestion type, selectFull orIncremental.
    • ForSalesforce objects to transfer, clickBrowse:
      • Select any objects to be transferred to the BigQuerydestination dataset. You can also manually enter any objects to includein the data transfer in this field.
      • If you have selectedAppend as your incremental write mode, youmust select a column as the watermark column.
      • If you have selectedUpsert as your incremental write mode, youmust select a column as the watermark column, and then select one ormore columns as the primary key.
  5. In theDestination settings section, forDataset, choose thedataset that you created to store your data.

  6. In theTransfer config name section, forDisplay name, enter aname for the data transfer.

  7. In theSchedule options section:

    • In theRepeat frequency list, select an option to specify howoften this data transfer runs. To specify a custom repeat frequency,selectCustom. If you selectOn-demand, then this transferruns when youmanually trigger the transfer.
    • If applicable, select eitherStart now orStart at set time,and provide a start date and run time.
  8. Optional: In theNotification options section, do the following:

    • To enable email notifications, click theEmail notification toggle.When you enable this option, the transfer administrator receives anemail notification when a transfer run fails.
    • To enablePub/Sub transfer run notificationsfor this transfer, click thePub/Sub notifications toggle. Youcan select yourtopic name, or you canclickCreate a topic to create one.
  9. ClickSave.

bq

Enter thebq mk commandand supply the transfer creation flag--transfer_config:

bqmk--transfer_config--project_id=PROJECT_ID--data_source=DATA_SOURCE--display_name=NAME--target_dataset=DATASET--params='PARAMETERS'

Where:

  • PROJECT_ID (optional): your Google Cloud project ID.If--project_id isn't supplied to specify a particular project, thedefault project is used.
  • DATA_SOURCE: the data source —salesforce.
  • NAME: the display name for the data transferconfiguration. The transfer name can be any value that lets youidentify the transfer if you need to modify it later.
  • DATASET: the target dataset for the transfer configuration.
  • PARAMETERS: the parameters for the created transferconfiguration in JSON format. For example:--params='{"param":"param_value"}'. The following are the parameters fora Salesforce data transfer:

    • connector.authentication.oauth.clientId: the Consumer Key of the Salesforce connected application.
    • connector.authentication.oauth.clientSecret: OAuth Client Secret or Consumer Secret of the Salesforce connected application.
    • connector.authentication.oauth.myDomain: theSalesforce My Domain.For example, if your domain URL isexample.my.salesforce.com, then the value isexample.
    • ingestionType: specify eitherFULL orINCREMENTAL. Incrementaltransfers are supported inpreview. Formore information, seeFull or incrementaltransfers.
    • writeMode: specify eitherWRITE_MODE_APPEND orWRITE_MODE_UPSERT.
    • watermarkColumns: specify columns in your table as watermark columns.This field is required for incremental transfers.
    • primaryKeys: specify columns in your table as primary keys.This field is required for incremental transfers.
    • assets: the path to the Salesforce objects to be transferredto BigQuery.

When specifying multiple assets during an incremental transfer, the valuesof thewatermarkColumns andprimaryKeys fields correspond to theposition of values in theassets field. In the following example,Id corresponds to the tableAccount, whilemaster_labelandtype corresponds to the tableCaseHistory.

"primaryKeys":[['Id'],['master_label','type']],"assets":["Account","CaseHistory"],

The following command creates an incremental Salesforce data transfer in thedefault project, and uses theAPPEND write mode.

bqmk--transfer_config--target_dataset=mydataset--data_source=salesforce--display_name='My Transfer'--params='{"assets": ["Account", "CaseHistory"]        "connector.authentication.oauth.clientId": "1234567890",        "connector.authentication.oauth.clientSecret":"ABC12345",        "connector.authentication.oauth.myDomain":"MyDomainName",        "connector.authentication.username":"user1@force.com",        "connector.authentication.password":"abcdef1234",        "ingestionType":"incremental",        "writeMode":"WRITE_MODE_UPSERT",        "watermarkColumns":["SystemModstamp","CreatedDate"]        "primaryKeys":[['Id'], ['master_label','type']]}'

API

Use theprojects.locations.transferConfigs.createmethod and supply an instance of theTransferConfigresource.

When you save the transfer configuration, the Salesforceconnector automatically triggers a transfer run according to your scheduleoption. With every transfer run, the Salesforce connectortransfers all available data from Salesforce intoBigQuery.

To manually run a data transfer outside of your regular schedule, you can startabackfill run.

Data type mapping

The following table maps Salesforce data types to thecorresponding BigQuery data types:

Salesforce data typeBigQuery data type
_boolBOOLEAN
_intINTEGER
_longINTEGER
_doubleFLOAT
currencyFLOAT
percentFLOAT
geolocation (latitude)FLOAT
geolocation (longitude)FLOAT
dateDATE
datetimeTIMESTAMP
timeTIME
picklistSTRING
multipicklistSTRING
comboboxSTRING
referenceSTRING
base64STRING
textareaSTRING
phoneSTRING
idSTRING
urlSTRING
emailSTRING
encryptedstringSTRING
datacategorygroupreferenceSTRING
locationSTRING
addressSTRING
anyTypeSTRING

Pricing

For pricing information about Salesforce transfers, seeData Transfer Service pricing.

Troubleshoot transfer setup

If you are having issues setting up your data transfer, seeSalesforce transfer issues.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.