How Do I Set Up a Permission Set for a Headless Salesforce User?
Last updated: November 13, 2026
Whenever someone leaves your team or business, their email account is usually deactivated, leaving multiple services that their account was tied to -- such as Salesforce's connection to Ambition -- in limbo.
For that reason, headless user accounts are preferable for serving as the authorizing and installing user when connecting Salesforce to Ambition because a headless user account will remain active regardless of who joins and leaves your business.
The headless user needs a custom permission set which includes only the access settings that Ambition requires. Part of those permissions are added before, and the rest after, installation.
Required permissions:
The System Administrator profile in Salesforce is required to create and assign permission sets.
Create the Permission Set
In Salesforce, go to Setup --> Users --> Permission Sets.
Click on New.
Enter "Ambition Access (Custom)" in the Label field.
Click on Save.
Click on Manage Assignments and add the headless user.
Add Access Before Install
System Permissions
API Enabled
Assign Permission Sets
Download AppExchange Packages
Manage Package Licenses
Run Reports.
View All Data (strongly recommended)
View All Users
Object Settings:
Read access to every Standard and Custom Object you want to track
Read and edit access to the IsAmbitionUser field on the User Object.
Add Access After Install
Assigned Apps
ambition.Ambition
Assigned Connected Apps
Ambition
Ambition Canvas
Object Settings: Full access to:
AmbitionEmailRecipient
AmbitionGeneralConfig
AmbitionLogEntry
AmbitionPushableObject
AmbitionPushableObjectField
AmbitionReportFilter
AmbitionReportRunConfig
AmbitionReportInstance
AmbitionReportInstanceChunk
Apex Class Access and Visualforce Page Access
Every class and page starting with "Ambition".
Note:
The "Salesforce Integration" license is API-only, so it can't be used to install the package or use Ambition inside Salesforce.