Permission Set Assignment: Exporting Data Outside Salesforce

The PermissionSetAssignment junction object links Salesforce users to specific permission sets and permission set groups across your org. You can query those records with SOQL, filter out the profile-owned permissions, and export the result through the REST API or Bulk API 2.0. That extract is what lets security and governance teams keep an auditable view of user access in an external data warehouse or SIEM platform.

Understanding the PermissionSetAssignment object

The PermissionSetAssignment object is the junction between a user and a permission set. It carries constraints that standard objects do not: it is queryable, but it is not a traditional object you can hit with standard CRUD operations in every context.

Exporting the data means going through the Salesforce REST or SOAP APIs. PermissionSetAssignment is a standard object, so the REST API exposes it fully, and you can run SOQL that filters assignments by user, permission set ID, or expiration date.

The anatomy of the query

Querying the join object on its own tells you very little. Query the related metadata alongside it. A practical export query looks like this:

SELECT Id, Assignee.Username, PermissionSet.Name, PermissionSet.Label, SystemModstamp 
FROM PermissionSetAssignment 
WHERE PermissionSet.IsOwnedByProfile = false

Filtering on IsOwnedByProfile = false drops the base profile permissions, which audit reporting usually wants out of the way.

Extracting data via REST API

For external integrations the REST API is the primary tool. Retrieve the assignments with a GET request to the Query endpoint.

Step-by-step implementation

1. Authenticate with OAuth 2.0, typically the JWT Bearer Flow for server-to-server integrations, to obtain an access token.
2. Construct your SOQL query and URL-encode it.
3. Handle the nextRecordsUrl returned in the response so you capture the whole dataset. Organizations with large user bases will page.

Example request (CURL):

curl https://yourInstance.my.salesforce.com/services/data/v60.0/query/?q=SELECT+Id,Assignee.Username,PermissionSet.Name+FROM+PermissionSetAssignment+LIMIT+2000 \
-H "Authorization: Bearer <YOUR_ACCESS_TOKEN>" \
-H "Content-Type: application/json"

Automating exports with middleware

When you sync this data into an external data lake such as Snowflake or AWS S3, hard-coding API calls in a script rarely holds up as a long-term strategy. Use middleware patterns instead.

The change data capture (CDC) approach

PermissionSetAssignment does not support standard Change Data Capture in every Salesforce edition. You can build a platform-event-based trigger that captures changes and pushes them to an external endpoint through an Outbound Message or a named credential callout. The external system then stays current in near real time without polling the API over and over.

Batch exporting

For a full audit once a day, use the Bulk API 2.0. It is far more efficient at large volumes of assignment data. Submit a Query Job and you can retrieve millions of rows without running into the standard REST API limits.

// Bulk API 2.0 Job Request
{
  "operation": "query",
  "query": "SELECT AssigneeId, PermissionSetId FROM PermissionSetAssignment",
  "contentType": "CSV"
}

Best practices for security and compliance

Exporting permission data is security-sensitive work. You are exporting the "keys to the kingdom," so treat the integration accordingly:

• Give the integration user the minimum permissions the export needs. Do not run your ETL processes as an administrator.
• Encrypt the exported data at rest and in transit in the external system.
• Monitor the external system logs to see who is reading the exported permission set assignment data. If the export is intercepted, your security posture is compromised.
• If you store these assignments in a database, restrict the user-permission mapping to authorized personnel.