SOAP login() turned off in orgs with no use in six months, from 2026-12-15

Provider

Salesforce

Endpoint

POST /services/Soap/*/*

Effective

2026-12-15

Severity

critical

Change

auth

Status

verified

What changed

In a one-time check on 2026-12-15 (sandboxes) and 2027-01-31 (production), Salesforce disables SOAP API login() in orgs that had no SOAP login() call in the previous six months; after that, login() fails in that org. Rarely run jobs (annual, seasonal, disaster recovery) can look inactive and then break. One call by any user in the window keeps login() on.

What to do

Check Login History (API Type SOAP Enterprise/Partner) and the API Total Usage event log (API_FAMILY SOAP, API_RESOURCE login) for every integration that uses SOAP login(), including rarely run jobs, and move them to an External Client App with OAuth 2.0 before 2026-12-15 (sandbox) / 2027-01-31 (production).

Sources

• Provider notice (2025-08-25)

Check your code

npx shapi-cli scan .

shapi scan lists the call sites this change affects; shapi fix repairs them test-first when the advisory has an automatic fix. All advisories · Markdown · OSV · JSON