Salesforce Bulk API 2.0 is a REST-based API for loading or querying large volumes of Salesforce data asynchronously. It uses job-based batches, CSV or JSON payloads, and polling for completion, which makes it suited to high-volume data integration and extract, transform and load workflows.
How Salesforce Bulk API 2.0 fits into high-volume data movement
Salesforce bulk api 2.0 is designed for asynchronous, job-based ingestion and query at scale, so its main value is throughput rather than interactive request handling. That makes it a common choice for ETL pipelines, data warehouses, reporting exports and large synchronisation workflows where synchronous APIs would be too slow or fragile.
Because it operates in batches and polls for completion, the API changes how engineers think about reliability. Success is not just whether a request was accepted, but whether the full job completed correctly, produced the expected row count and handled retries, partial failures and duplicate submissions in a controlled way.
Where Bulk API 2.0 changes the security picture
High-volume data interfaces expand the blast radius of a mistake. A single over-permissive integration, misrouted export or compromised credential can move far more data than a normal transactional API call, especially when jobs are designed to process whole datasets efficiently.
Bulk interfaces also make abuse easier to hide in ordinary operations. Large exports, automated integrations and repeated polling can blend into expected platform activity, so defenders need to distinguish legitimate batch movement from suspicious mass extraction patterns.
In practice, the security posture depends less on the API name than on the permissions, connected app trust, token handling and data scope attached to it. For a broader Salesforce hardening view, the Salesforce Security Guide is the right place to anchor org-level controls around connected apps, access reviews and monitoring.
Operational controls around jobs, access and monitoring
Bulk API 2.0 should be governed like a privileged data movement channel. Organisations need clear ownership for who can submit jobs, which objects can be queried or loaded, how long job artefacts are retained and how failed jobs are reviewed for leakage or misuse.
Good monitoring looks for unusual export volume, unfamiliar source systems, abnormal job timing, new integration users and repeated use of the same access path across many tenants or objects. That is especially important because batch APIs can be used legitimately for migrations while also serving as a fast exfiltration route when access is abused.
When Bulk API 2.0 is part of a third-party integration chain, token scope and connected-app governance matter as much as the API itself. The Gainsight Salesforce breach 2025 and the Salesloft OAuth token breach both show how stolen integration tokens can become a data-access path into Salesforce at scale.
Failure modes and attacker abuse patterns
The main failure modes are overbroad access, poor token governance, weak connected-app approval and inadequate review of large exports. Those conditions turn a tool meant for efficient data exchange into a convenient bulk-access mechanism for an attacker or a rogue insider.
Compromise often starts upstream, through phishing, consent abuse, OAuth token theft or a malicious integration, then ends with high-volume querying or extraction through normal-looking API activity. Once that happens, the damage is often data-centric rather than availability-centric: sensitive CRM records, support cases, customer details and account relationships can be exposed quickly.
The ShinyHunters Salesforce data theft campaign 2025 illustrates how connected-app abuse can lead directly to bulk CRM export, while the UNC6395 (Salesloft Drift OAuth token theft) threat actor profile shows the operational value of hunting for bulk-query patterns after integration compromise.
Practitioner guidance for secure use
Why practitioners should care: Bulk API 2.0 is often the fastest way to move large Salesforce datasets, which makes it valuable for operations and equally valuable for abuse if access is not tightly governed. Treat it as a high-trust data path, not a generic convenience API.
What to watch for: Watch for sudden changes in job volume, unfamiliar integration users, unusual export schedules, and connected apps that can read more data than the business case requires. Review both job history and the upstream authentication path that authorized the job.
Practitioner takeaway: The safest Bulk API 2.0 deployments combine least-privilege access, explicit connected-app governance and continuous review of large-query activity, because the control failure is usually permissions and trust, not the bulk transport mechanism itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API4 — Unrestricted Resource Consumption | Bulk API 2.0 moves large datasets asynchronously at scale. |
| API6 — Unrestricted Access to Sensitive Business Flows | Bulk data export can expose sensitive Salesforce business records. | |
| API2 — Broken Authentication | Bulk access depends on the auth path used by the integration or user. | |
| Recommendation — Limit bulk job volume and rate so exports cannot be abused at scale. Restrict who can invoke bulk read and write flows over sensitive CRM data. Harden authentication for integration access before permitting bulk API use. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Bulk jobs require review of export and query activity for misuse detection. |
| AC-6 — Least Privilege | Bulk API access should be limited to the minimum Salesforce data scope. | |
| Recommendation — Review bulk API activity logs for anomalous exports and failed job patterns. Assign the minimum object and field access needed for bulk jobs. | ||
Related resources from NHI Mgmt Group
- What is the difference between monitoring API logs and monitoring connected app activity in Salesforce security?
- How should security teams reduce the risk of Salesforce API abuse in SaaS environments?
- What should organisations do after Salesforce API credentials are suspected to be compromised?
- What happens when an API allows client-controlled parameters to drive record retrieval or bulk search without effective rate limiting?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org