Real IntelligenceReal Intelligence Docs
Real BotsReal EventsReal Messaging EngineRI Social Media

Real Bots

Relationship Intelligence Troubleshooting

SymptomMeaningCheck
Unexpected character '<'Salesforce received HTML instead of the Relationship Intelligence JSON API.The Named Credential base URL should be https://eie-api.realintelligence.com
RI_AUTH_ASSERTION_MISSINGThe endpoint was reached but no valid Salesforce assertion was supplied.Generate Authorization Header is OFF; the running user has External Credential Principal Access; RIInboundAuth is installed
RI_AUTH_AUDIENCE_INVALIDThe assertion audience does not match an accepted Relationship Intelligence endpoint.The Named Credential base URL and the endpoint path in use
Certificate / KID errorThe tenant certificate could not be matched.EIE certificate registration, ribot__Signing_Certificate_KID__c, certificate is Active, correct tenant
Domain Delegation not verifiedGoogle has not authorized the service account.Google Admin Domain-Wide Delegation Client ID and scopes
Directory API not operationalDirectory calls are failing.Admin SDK API enabled, Workspace Admin Subject, directory scopes
Gmail API not operationalGmail metadata calls are failing.Gmail API enabled, gmail.metadata scope, test mailbox, delegated mailbox access

Relationship Intelligence signing certificate KID is required

Cause — the Relationship Intelligence Configuration record does not contain the EIE-generated Certificate KID.

Resolution

  1. Register the Salesforce public signing certificate in the correct EIE tenant.
  2. Copy the generated Certificate KID.
  3. Paste it into ribot__Signing_Certificate_KID__c.
  4. Save the configuration.
  5. Retry verification.

We couldn't access the credential(s)

We couldn't access the credential(s). You might not have the required permissions,
or the external credential "EIE_Relationship_Intelligence_Auth" might not exist.

Possible causes

  • The External Credential does not exist.
  • The External Credential API name is incorrect.
  • EIE_RI_Principal was not created.
  • The principal was not enabled in the permission set.
  • The permission set was not assigned to the running user.
  • The Named Credential references the wrong External Credential.
  • The Named Credential is not enabled for callouts.
  • The ribot namespace is not allowed.

Resolution order

  1. Confirm the External Credential exists.
  2. Confirm EIE_RI_Principal appears in its Principals section.
  3. Confirm the Named Credential references that External Credential.
  4. Confirm Enabled for Callouts is on.
  5. Confirm ribot is an allowed namespace.
  6. Enable the principal in the Relationship Intelligence permission set.
  7. Assign the permission set to the running user.
  8. Refresh Salesforce and retry verification.

Full procedure: Named & External Credentials.

Principal absent from the permission set

Cause — the External Credential exists, but no Named Principal has been created.

Resolution — open the External Credential, click New under Principals, and create:

Parameter Name:  EIE_RI_Principal
Identity Type:   Named Principal
Sequence Number: 1

Then return to the permission set and enable the principal.

One administrator succeeds but another fails

Cause — External Credential Principal Access is assigned per user through a permission set. System Administrator status alone does not grant it.

Resolution — assign the Relationship Intelligence permission set to the failing user and confirm that it includes EIE_RI_Principal.

Diagnostic order

  1. Run Verify Google Connection and note which check fails first.
  2. Failures before "Google Connection" are Salesforce or EIE authentication issues.
  3. Failures at Directory or Gmail are Google Workspace configuration issues.

Escalation

Provide the Salesforce Org ID, the certificate KID, the timestamp of the failed verification, and the exact error text.

Was this helpful?

PreviousSecurity & AuthenticationNextOverview

Last updated 1 month ago