SfSkills Domains Docs GitHub

Home / integration / data-cloud-activation-development

data-cloud-activation-development

Use this skill when building developer-driven Data Cloud activation surfaces: webhook Data Action Targets with HMAC-SHA256 signing, Salesforce Platform Event data actions, Data Cloud-Triggered Flows on DMO insert. NOT for standard admin-level Activation Targets (SFTP, ad platform segment publishing) — use admin/data-cloud-segmentation. NOT for receiving webhooks into Salesforce — use integration/webhook-inbound-patterns.

Open the skill folder on GitHub

Data Cloud Activation Development

This skill activates when a developer needs to build event-driven automations or external integrations triggered by Data Cloud DMO events. It covers Data Action Targets (Webhook, Salesforce Platform Event, Marketing Cloud) and Data Cloud-Triggered Flows, including HMAC security configuration, payload handling, event retention limits, and failure recovery patterns. It does NOT cover segment-level Activation Targets (SFTP, ad platforms) — those are admin activation tasks.

Before Starting

Gather this context before working on anything in this domain:

Core Concepts

Data Action Targets vs. Activation Targets

Activation Targets publish segment membership in batch to external channels (Marketing Cloud, SFTP, ad networks, CRM). Configured by admins. Run on batch schedules.

Data Action Targets fire near-real-time when a Streaming Insight condition is met on a DMO. Three types:

HMAC-SHA256 Secret Key for Webhooks

Every webhook Data Action Target should have an HMAC-SHA256 secret key configured. The platform computes the signature as HMAC-SHA256 of the raw request body using the key and includes it in the X-SFDC-Signature request header. Receivers must verify this signature. If the key is missing, the platform silently drops outbound payloads — there is no error logged and no delivery occurs.

After changing or regenerating the key, allow up to 15 minutes for propagation before expecting correct signatures.

Data Cloud-Triggered Flows

Data Cloud-Triggered Flows bind an autolaunched Salesforce Flow to a specific DMO. They fire when a row is inserted into that DMO. The Flow receives the inserted record's fields as input variables. Since the trigger is insert-only, any downstream logic that must respond to profile updates needs an explicit re-insert pattern or must use Calculated Insights with delta detection.

Event Retention and No Retry

Data Action Target events are retained for 4 days. If the target (webhook endpoint or Platform Event bus) is unavailable during event delivery, the event is not retried. External dead-letter queues or idempotent replay mechanisms must be built outside the Data Cloud platform.

Common Patterns

Pattern 1: Webhook Data Action Target with HMAC Verification

When to use: External system needs near-real-time notification when a DMO condition is met.

How it works:

  1. In Data Cloud Setup > Data Action Targets, create a new Webhook target.
  2. Enter the endpoint URL and set a strong HMAC-SHA256 secret key.
  3. Create a Streaming Insight that defines the DMO condition.
  4. Link the Streaming Insight to the Data Action Target.

Receiver-side HMAC verification:

import hmac, hashlib

def verify_payload(secret: str, raw_body: bytes, sig_header: str) -> bool:
    expected_sig = hmac.new(
        secret.encode("utf-8"),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected_sig, sig_header)

# In your webhook handler:
# sig = request.headers.get("X-SFDC-Signature", "")
# if not verify_payload(SECRET, request.get_data(), sig):
#     return 403

Why not skip HMAC: No HMAC key means no payload delivery and no security verification.

Pattern 2: Data Cloud-Triggered Flow for Automated CRM Actions

When to use: A new unified profile DMO record should trigger CRM record creation or update.

How it works:

  1. Build an autolaunched Salesforce Flow in Flow Builder with input variables matching DMO fields.
  2. Activate the Flow.
  3. In Data Cloud Setup > Data Cloud-Triggered Flows, create a new entry binding the Flow to the target DMO.
  4. Activate the triggered flow binding.
  5. When a new DMO row is inserted, the Flow executes with that record's data as inputs.

Why not use record-triggered Flow: Record-triggered Flows only watch standard Salesforce CRM objects, not Data Cloud DMOs.

Decision Guidance

SituationRecommended ApproachReason
Near-real-time external system notificationWebhook Data Action Target with HMACEvent-level trigger with payload signing
Salesforce-internal automation on DMO eventData Cloud-Triggered FlowNative Flow, no external dependency
Segment membership push to ad platformAdmin Activation Target (not this skill)Batch segment-level publishing
React to unified profile updateRe-insert pattern or CI deltaTriggered Flows fire on insert only
Reliable delivery despite endpoint downtimeExternal dead-letter queue + idempotent receiverPlatform has no auto-retry
  1. Confirm the use case is event-level (Data Action Target) vs. segment-level (Activation Target admin config).
  2. Identify the target DMO and the triggering condition for the Streaming Insight.
  3. For webhook targets: generate the HMAC-SHA256 secret key BEFORE creating the target. Set it during creation.
  4. Create the Streaming Insight defining the DMO condition and link it to the Data Action Target.
  5. For Triggered Flows: build and activate the autolaunched Flow, then create the Data Cloud-Triggered Flow binding in Data Cloud Setup and activate it.
  6. Test by inserting a qualifying DMO record and verifying payload delivery or Flow execution.
  7. Implement idempotent receivers and external retry/dead-letter handling for webhook targets.

Review Checklist

Salesforce-Specific Gotchas

  1. Missing HMAC Key Causes Silent Payload Drop — No HMAC key on a webhook target means no payload is ever delivered. No error is surfaced in Data Cloud. Always configure the HMAC key at target creation time.
  2. Triggered Flows Are Insert-Only — DMO row updates do NOT fire Data Cloud-Triggered Flows. Only new insertions do. This is a hard platform constraint, not a configuration option.
  3. 15-Minute Key Propagation After Change — After regenerating the HMAC secret key, up to 15 minutes elapse before the new key is applied. Plan rotations for low-traffic periods.
  4. No Auto-Retry on Delivery Failure — Events retained for 4 days but not retried automatically. Endpoint downtime = lost events after retention window. External dead-letter queues are required for reliable delivery.
  5. Naming Confusion: Activation Targets vs. Data Action Targets — Creating a webhook under the wrong menu (Activation Targets vs. Data Action Targets in Setup) creates a segment-level batch publisher, not an event-level trigger. These are different features with different menus in Data Cloud Setup.

Output Artifacts

ArtifactDescription
Data Action TargetWebhook, Platform Event, or Marketing Cloud target configuration
Streaming InsightDMO condition filter definition linked to target
HMAC verification codePython/Node receiver-side signature check
Triggered Flow bindingData Cloud-Triggered Flow entry in Setup

Package files