Medallia setup issues

When Salesforce administrators enter the connectivity credentials provided by the Medallia delivery team, there are a few types of issues that can possibly run into.

Unauthorized endpoint

The API connection reports "Unauthorized endpoint".

Cause: The Medallia sandbox and production instances are not in the Salesforce allow-list. As a result Salesforce is blocking the request made to validate the credentials.

Solution: See the "Allow-list the instance URL(s)" section in Salesforce Admin Guide. Salesforce administrator needs to add the Medallia environments to the list of valid external systems (the "Remote site settings").

Authentication failed

Cause: When the authentication fails at this stage it means the Salesforce organization cannot reach the proper Medallia instance and validate the credentials. The root cause is usually one of these:

• At least one of the settings on the first page is incorrect. The authentication request fails right at the beginning when it does not find the correct instance to address the call.

  Note: Many people make the mistake of providing the wrong base URL by adding the company name to the end of the URL. Verify that the base URL does not include the company; rather, it should only the instance name, similar to this: https://instance.medallia.com

• At least one of the settings on the second page is incorrect. The request is addressed to the correct instance but the incorrect combination of client ID and secret is rejected by Medallia Experience Cloud.

• All fields are correct but the Medallia delivery team did not properly define the OAuth Client. The request is made to the proper instance but as there is no OAuth client on the receiving end the call is rejected. Contact the Medallia delivery team to correct and/or verify the client definition and credentials.

How to investigate: The simplest solution is to verify the values are correct. From there it should be easy to identify the actual root cause and solution. If the OAuth client exists in Experience Cloud, check the "Failed attempts" page to see if there is any request from Salesforce that were rejected.

1. If not then the issue is most likely the settings on the first page are not correct.

2. If yes (there was a rejection), check the details of the failed attempt. Most likely the issue will be an issue with the Client ID and Secret.

Solution: The Salesforce administrator should use the correct settings, or the Medallia delivery team needs to recreate the OAuth client correctly.

Argument 1 cannot be null

Error Message: The Salesforce administrator receives this error message:

Argument 1 cannot be null

Root Cause: The Salesforce administrator who configured the connection likely does not have a System Administrator profile in Salesforce.

Solution: The Salesforce administrator should provision themselves the "Medallia App Admin" permission set and attempt to set up the connection again afterwards

Invitations failing to be sent to Medallia

After the Salesforce administrators have set up the connection to Medallia, they must configure Process Builders, Add to Program, or other custom functionality to send invitations to Medallia Experience Cloud. To test that the Salesforce setup has been configured correctly, administrators trigger test invitations.

Once invitations have been created in Salesforce (to find Invitation records, navigate to the Invitations tab), the Invitation will either have a status of New or Received, assuming the administrator created the Invitation with a Date to Send = Now(). Invitations in a Received status have been successfully sent to Medallia Experience Cloud. Invitations that are still in a New state have failed to be sent and Log records have been created.

General tips for deciphering log records

When issues occur with sending, a collection of Log records is created, even for just one invitation and one failure. The easiest way to identify a group of Log records tied to one failure is by the creation date of the Logs. This example has 19 log records:

However, this does not indicate there were 19 separate failures. In fact, in this example, there are actually only 3 unique failures, which you can see when grouped by creation date.

Typically the first entry in the group identifies the problem.

Ignore the log entries that say Empty record set returned… because they typically do not indicate the root cause.

Here are some of the common errors and their scenario for the problem.

{"error": "invalid_client"}

User is not authorized to access ...

<!-- Custom page for 404 errors which doesn't expose the requested resource since the default page in struts is vulnerable to XSS -->
<html>
<head>
<title>Page not found</title>
</head>
<body>
<h3>
Oops! A 404 error happened because the resource you are looking for could not be found.
</h3>
</body>
</html>

Scenario 1: Invalid OAuth credentials

Root Cause: Receiving an ApiClient error with Status Code 401 and a message of error: invalid_client, typically means the OAuth credentials provided by Medallia are now invalid. Normally bad credentials are caught during the Medallia Setup configuration. However, this type of error usually happens after the OAuth credentials change after the initial setup, such as when Medallia sandboxes refresh and client secrets are automatically changed.

Solution:

1. The Medallia delivery team should verify the OAuth credentials of the salesforce_oauth client defined for the Medallia instance. If a sandbox environment has been recently refreshed, the Medallia team will need to reset the client secret, and then provide the updated credentials to Salesforce administrator.

2. The Salesforce administrator needs to go to the Medallia Setup page, break the connectivity, and re-enter the new credentials to reestablish connectivity. See the tips above if there are any errors when resetting the connectivity.

Scenario 2: Web Feed access

Root Cause: Receiving an ApiClient error with Status Code 403 and a message of User is not authorized to access ..., typically means the Web Feed endpoint that Salesforce is trying to send the invitation payload data to cannot be accessed. This usually occurs when a new Web Feed is created by a Medallia delivery team that is not part of the Salesforce package.

Solutions: 

1. Verify the Salesforce administrator is using the correct Web Feed endpoint and that there are no typos.

2. Confirm that the Web Feed in Medallia Experience Cloud is set to an Active or Pretend status. 

3. Confirm that the Salesforce Inbound API role has access to the Web Feed. To confirm this:

   1. Navigate to Admin Suite > Roles > search for Salesforce Inbound API Role and click on Edit Role.

   2. On the Edit Role page, click on Administrative Permissions  > navigate down the page until you see a box that is checked called Import Data via Web Feed. Click the info circle to see what Web Feeds are given access. See screenshot below for an example.

   3. If the Web Feed is not in the provisioned list, click Limit, add the Web Feed to the list, and then click Save.

Scenario 3: Invalid Endpoint

Root Cause: Receiving an ApiClient error with Status Code 404 and a message of Invalid Path requested, typically means the Web Feed endpoint that Salesforce is trying to call is not valid. In most cases, this situation is due to an incorrect base URL being entered into the Medallia Setup page.

Solution: See the discussion for "Authentication failure" in the "Medallia Setup Issues" section above for the correct base URL to use.

Scenario 4: Invitation Status not being updated to Received

Issue: There is one edge case that Log records will not catch: When an invitation's payload is successfully sent to Medallia Experience Cloud (you can verify by viewing Imported Files in Experience Cloud ), the invitation status does not get updated to Received and remains in a New state.

Root Cause: This issue only seems to occur when a record ID is excluded from the field-set used to compile the payload. The record ID is the record that caused the invitation to be created. This error happens when the record ID is missing from the field-set. The source of the record ID depends on the how the record was created. For

• Situations where Process Builder creates the invitations, the record ID is the record the Process is being triggered off of.

• Case Closure use cases, the record ID is the Case record being closed.

• Opportunity Closure use cases, the record ID is the Opportunity being closed.

• Relationship survey use cases, the record ID is the Contact record the relationship survey is for.

Solution: Include the record ID in the field set. Typically the record ID is the record ID of the object the field set is being based off of, except in Relationship survey use cases which leverage a Contact object field set.