Step-Up Authentication for Reports Advisory

Update - October 1, 2026 

Nintex transitioned customers from the Web API mechanism to the Reports REST API on September 30, 2026. The new implementation is now enabled for all customers using Salesforce Reports.

What If I Need More Time?
If you require additional time to validate report output and update your DocGen packages, you have the following options:

Option 1: Request an Extension from Salesforce
Work with Salesforce to request an extension to your Step-Up Authentication exemption for the maximum period they allow.
Once Salesforce approves the extension, notify Nintex Support so your organization can continue using the existing report retrieval mechanism for the approved extension period.

Option 2: Configure Profile IP Restrictions
Salesforce has identified Profile IP Restrictions as an alternative security control for report exports. By configuring Profile IP Restrictions on the profiles of users who run DocGen packages and allowing the Nintex server IP addresses, Salesforce can bypass the Step-Up Authentication challenge for report exports using the Web API request. With this option, the current behavior won't change, and the DocGen packages in your Salesforce org will continue to work as they currently do. Once the Profile IP Restriction is set up, please inform Nintex Support to switch your Salesforce org from the REST API back to the Web API.

This should be treated as a temporary workaround while you validate the updated report output and make any required template or package changes.

Important Note
The Salesforce Reports REST API may format some report values differently than the previous export mechanism. As a result, generated document output may vary slightly. Customers should test and validate their DocGen packages as soon as possible to ensure documents continue to generate as expected. Differences between the legacy Web API and REST API identified by Nintex are available in the August update below.

Update - August 2026

Nintex DocGen now supports orgs with Step-Up Authentication enforced on reports. Report retrieval has been migrated from Salesforce report web requests to the Salesforce Reports REST API.

When a Salesforce report is used as a template, the generated output may differ from the previous implementation. We recommend validating report output to ensure there are no unexpected formatting differences.

Known formatting differences include: 

Known row limit: The Salesforce Reports REST API returns a maximum of the first 2,000 report rows - this is a Salesforce limitation. As an alternative, retrieve the data through a DocGen Relationship instead. If your reports typically return large row counts, include one in your validation testing.

Note: An option is available to preserve existing formatting where possible - contact Nintex Support. However, we encourage moving to the new format long term, as Salesforce controls the API response format. 

Testing Instructions 

To validate the new Reports API implementation: 

1. (Recommended) Verify Step-Up Authentication is configured in Salesforce:
   • Navigate to Setup → Identity Verification
   • Under Session Security Level Policies, set Reports and Dashboards to "Require periodic step-up authentication when exporting"
2. (Recommended) Run the Salesforce report directly and attempt to export it. You should be prompted to verify your identity, confirming the setting is active. After verifying once, Salesforce may not prompt again for some period of time.
3. Run your DDP, download the generated document, and verify the output matches expectations.

Test in a sandbox first whenever possible - ideally one without a Step-Up Authentication extension, as this provides the most accurate validation.

Refer to the help document for more details.