salesforce-incident-runbook

name	salesforce-incident-runbook
description	Execute Salesforce incident response procedures with triage, mitigation, and postmortem. Use when responding to Salesforce-related outages, investigating API errors, or running post-incident reviews for Salesforce integration failures. Trigger with phrases like "salesforce incident", "salesforce outage", "salesforce down", "salesforce on-call", "salesforce emergency", "salesforce broken".
allowed-tools	Read, Grep, Bash(sf:*), Bash(curl:*)
version	1.7.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","crm","salesforce"]
compatibility	Designed for Claude Code

Salesforce Incident Runbook

Overview

Rapid incident response procedures for Salesforce integration failures, covering Salesforce-side outages, API limit exhaustion, authentication failures, and data sync issues.

Prerequisites

• Salesforce CLI authenticated (sf org login)
• Access to Salesforce Status API
• Monitoring dashboards configured (see salesforce-observability)
• Communication channels (Slack, PagerDuty)

Quick Triage (Do This First)

# 1. Is Salesforce itself down?
curl -s https://api.status.salesforce.com/v1/incidents/active | jq '.[0:3]'
# If incidents returned → Salesforce-side issue, enable fallback mode

# 2. Check your org's instance status
# Find your instance at: https://status.salesforce.com
curl -s "https://api.status.salesforce.com/v1/instances/NA45/status" | jq '.status'

# 3. Check API limits — are we out of calls?
sf limits api display --target-org my-org --json | jq '.result[] | select(.name == "DailyApiRequests")'
# If remaining = 0 → API_LIMIT_EXCEEDED, see mitigation below

# 4. Check authentication
sf org display --target-org my-org --json | jq '.result.connectedStatus'
# If "RefreshTokenError" → re-authenticate

# 5. Check recent errors in your logs
sf apex log list --target-org my-org --json | jq '.result[0:5]'

Decision Tree

Integration returning errors?
├── YES: Is status.salesforce.com showing incident?
│   ├── YES → Salesforce outage. Enable fallback mode. Monitor status page.
│   └── NO → Check error type below:
│       ├── INVALID_SESSION_ID (401) → Token expired. Re-authenticate.
│       ├── REQUEST_LIMIT_EXCEEDED (403) → API limit hit. Reduce calls.
│       ├── UNABLE_TO_LOCK_ROW (409) → Record contention. Retry with backoff.
│       ├── MALFORMED_QUERY / INVALID_FIELD → Code bug. Check SOQL.
│       └── 500/503 → Salesforce-side. Wait and retry.
└── NO: Is data syncing correctly?
    ├── YES → Likely resolved or intermittent. Monitor.
    └── NO → Check CDC subscription, query timestamps, bulk job status.

Immediate Actions by Error Type

REQUEST_LIMIT_EXCEEDED — API Limit Exhausted