Salesforce
Bag of words enumerates the org’s queryable objects — standard and custom__c — filtering out system and plumbing objects (sharing rows, field history, change events, Chatter feeds). Reference fields become foreign keys. Discovery is capped at 500 objects, with common CRM objects (Account, Contact, Lead, Opportunity, Case, and so on) prioritized so they always survive the cap. A single query returns at most 10,000 rows.
Before you start (JWT bearer)
The recommended path is a Connected App using the OAuth 2.0 JWT bearer flow: a certificate signs a short-lived assertion that is exchanged for an access token. No interactive login, no stored password.1
Generate a key pair
Create an RSA private key and a matching X.509 certificate. Keep the private key (PEM) — you will paste it into Bag of words.
2
Create the Connected App
In Salesforce Setup → App Manager → New Connected App, enable OAuth settings, tick Use digital signatures, and upload the certificate.
3
Copy the Consumer Key
From the Connected App’s detail page, copy the Consumer Key — this is the OAuth
client_id.4
Pre-authorize the service account user
Set the Connected App’s OAuth policy to Admin approved users are pre-authorized, then grant the profile or permission set of the Salesforce user Bag of words will authenticate as.
Fields
Authentication modes
Both modes are system-scope — one shared credential for the whole connection. Connected App (JWT Bearer) —jwt (the default)
Username / Password —
userpass (legacy SOAP login)
NetSuite
Bag of words queries NetSuite with SuiteQL over the REST API (https://<account>.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql), signing each request with OAuth 1.0a HMAC-SHA256 — NetSuite’s Token-Based Authentication (TBA). Results are paged automatically.
Before you start
1
Enable the features
In NetSuite Setup → Company → Enable Features → SuiteCloud, enable REST Web Services and Token-Based Authentication.
2
Create an integration record
Setup → Integration → Manage Integrations → New. Enable Token-Based Authentication. On save, NetSuite shows the Consumer Key and Consumer Secret once — copy both.
3
Create an access token
Setup → Users/Roles → Access Tokens → New, choosing the integration record, the user, and a role with permission to run SuiteQL against the records you want. NetSuite shows the Token ID and Token Secret once — copy both.
Fields
Authentication
Token-Based Auth —token (system scope, the only mode)
ServiceNow
The ServiceNow connector is in beta.
/api/now/table/{table}). Schema discovery reads ServiceNow’s own metadata tables in bulk — sys_db_object for tables and inheritance, sys_dictionary for fields — so a full snapshot takes a handful of requests rather than one per table. Reference fields become foreign keys.
Fields
Authentication modes
Username / Password —userpass (scopes: system and user)
Sign in with ServiceNow —
oauth (scope: user, no fields). Each user signs in against the instance’s own endpoints (/oauth_auth.do, /oauth_token.do) with the useraccount scope, so queries run with that person’s own ServiceNow permissions. This requires the oauth_client_id above to be configured on the connection.
Per-user authentication on a database-style connection requires an Enterprise license. See Authentication and access.
PostHog
The PostHog connector is in beta.
events, persons, sessions, and related tables — rather than introspecting the instance.
Fields
Authentication
Personal API Key —api_key (scopes: system and user)
Because this mode is available at user scope as well as system scope, each user can supply their own personal API key instead of sharing the admin’s. Per-user credentials on a database-style connection require an Enterprise license — see Authentication and access.