Create Digital Experience Portal
Create a new Digital Experience (formerly Communities) portal/site in Salesforce. Supports employee service portals, partner portals (PRM), and general customer communities.
Every operation runs through the headless-360 MCP server (
mcp__headless-360__discover
→
mcp__headless-360__describe
→
mcp__headless-360__dispatch
/
mcp__headless-360__dispatch_readonly
).
Do
not use the Salesforce CLI (its
,
, or
subcommands), the project-codey MCP
server, raw
, or any other HTTP client —
/
is the only way this
skill talks to the org. See
references/mcp-invocation.md
for the exact call shapes.
Scope
- In scope: Creating Digital Experience sites via the headless-360 Connect API dispatcher. Portal type selection. Basic configuration (name, URL, templates). Self-service portals with embedded service configs. Making the site reachable end to end — activating the Network (), adding member profiles, and publishing the Experience Builder pages (see
references/post-creation-activate-publish.md
).
- Out of scope: Deep post-creation customization (page layout/component authoring in Builder). Content authoring. Branding beyond initial setup. Individual per-user record management (membership is added at the profile/permission-set level, not per user).
Execution model (read first)
Every org call is a
dispatch:
mcp__headless-360__dispatch_readonly(url, method: "GET", queryParams)
for reads,
mcp__headless-360__dispatch(url, method, body)
for writes; read
+
from
the response. To resolve the endpoint for a portal type, use
mcp__headless-360__discover(query=...)
and
mcp__headless-360__describe(id=...)
as needed. Connect API create/list operations for Experience Cloud
are not always indexed by
/
— when a lookup returns nothing, dispatch the well-known
versioned Connect API path directly (see
references/mcp-invocation.md
) rather than concluding the
capability is missing.
Critical: paths must include the full prefix (e.g.
"/services/data/v67.0/connect/communities"
) — unlike some other dispatchers, headless-360 does
not resolve or inject the API version for you. A path without the version prefix returns
. Copy the path verbatim from a
/
result when available;
otherwise use the version shown in this skill's examples (
at time of writing) and adjust if
the org runs a different version. Full details, response envelope, job-monitoring, and gotchas live
in
references/mcp-invocation.md
.
Clarifying Questions
Before proceeding, determine:
-
Portal type?
- Employee Service / ITSM / HR / help desk → prefer the
Agentforce Employee Center
Aura template via the communities API (richest employee experience; Agentforce-ready). Use the self-service API instead when MIAW must be wired in at creation time and a guest ESD exists.
- Partner Portal (PRM) → requires PRM feature enabled
- Customer Community → general community creation (Aura or LWR Experience Builder template)
-
Basic settings (required for all types):
- Portal name?
- URL prefix? (must be alphanumeric only, no hyphens or spaces)
- Description (optional)
-
For Employee Service / Self-Service portals:
- ? → default (Aura Experience Builder + Builder). Use only if the user explicitly wants a Lightning Web Runtime site. Never create a Salesforce Tabs + Visualforce ("VF Template") site — those are legacy and have no Builder.
- MIAW / Embedded Service Deployment ID(s)? These wire Messaging for In-App and Web into the portal at creation time. A guest ESD config is required by the self-service API; an authenticated-user ESD config is optional. If the user hasn't created an Embedded Service Deployment yet, point them to Setup → Embedded Service Deployments first.
-
For Partner portals only:
- PRM template name? (check org-specific templates)
Required Inputs
Employee Service / Self-Service Portals (POST /connect/self-service/site
):
- (required) - portal name
guestEmbeddedServiceConfigId
(required) - Embedded Service Deployment (MIAW) config ID for guest users
- (optional) - Embedded Service Deployment (MIAW) config ID for authenticated users
- (optional) - (default) or . Produces an Experience Builder site. Do not use Visualforce.
- (optional) - whether guest (unauthenticated) users can access the site
- (optional) - ContentDocument ID of a logo image to wire into the site's branding set
- (optional) - array of RGBA colors targeting , , , ,
This API sets the URL path prefix automatically from the site name. There is no
— the framework is chosen with
(Aura/LWR), never Visualforce.
Partner Portals (PRM):
- (required)
- (required)
- (required)
- (optional)
General Communities (POST /connect/communities
):
- (required)
- (required) - alphanumeric only, no hyphens
- (required) - an Experience Builder template. Aura:
Agentforce Employee Center
(preferred for employee service), , , , , , . LWR: , . Validate the exact string via GET /connect/communities/templates
(see below). Do not use Salesforce Tabs + Visualforce
("VF Template") — it is a legacy Visualforce site with no Builder.
- (optional)
Workflow
Step 1: Determine API Based on Portal Type
-
Employee Service / Self-Service →
POST /connect/self-service/site
- Creates an Aura (or LWR) Experience Builder site — never Visualforce
- Wires MIAW (Embedded Service Deployment) into the site at creation time
- Prerequisites: permission; org has self-service site-creation API access; a guest Embedded Service Deployment exists
-
Partner (PRM) →
POST /connect/prm/setup/sites
-
General Community →
POST /connect/communities
- Uses an Experience Builder (Aura or LWR) — never
Salesforce Tabs + Visualforce
- Prerequisites: Manage Communities permission ()
Step 2: Create Portal (By Type)
Option A: Employee Service / Self-Service Portal
Use the self-service site API. It creates an Aura Experience Builder site (with the Builder option) by deploying CustomSite, Network, and ExperienceBundle metadata, then wires MIAW into the site via the given Embedded Service Deployment (ESD) config IDs. This is the correct path for ITSM / IT help desk / employee self-service portals.
API Call (via
mcp__headless-360__dispatch
):
text
method: "POST"
url: "/services/data/v67.0/connect/self-service/site"
body:
{
"siteName": "<portal-name>",
"siteType": "AURA",
"guestEmbeddedServiceConfigId": "<guest-ESD-config-id>",
"embeddedServiceConfigId": "<auth-ESD-config-id>",
"enableForGuest": true
}
Poll with
GET /services/data/v67.0/connect/self-service/site/status/{jobId}
via
mcp__headless-360__dispatch_readonly
.
- defaults to (Aura Experience Builder + Builder). Pass only if the user explicitly asks for a Lightning Web Runtime site. Never create a Visualforce site.
guestEmbeddedServiceConfigId
is required — it is the MIAW Embedded Service Deployment config ID for guest users. (authenticated users) is optional. If the user has no Embedded Service Deployment yet, have them create one first (Setup → Embedded Service Deployments), or use the MIAW/embedded-service setup skill.
- Optional branding: (logo) and (array of
{ "type": "action|link|border|text|pageBackground", "color": { "r": 0-255, "g": 0-255, "b": 0-255, "a": 0-1 } }
).
Response:
json
{
"success": true,
"siteName": "IT Support Portal",
"urlPathPrefix": "itsupport",
"siteUrl": "https://domain.my.site.com/itsupport",
"jobId": "708...",
"status": "Queued"
}
On success, report
— the portal creation started (Aura + Experience Builder); give the
name, framework (Aura),
, and
, and note it is provisioning in the background
(Network, CustomSite, ExperienceBundle metadata + the Embedded Service/MIAW deployment). Next: monitor
the job (see 'Background Job Monitoring'), then complete Step 3 (Activate → Add Members → Publish).
On failure, report
with the
— see the "Common Errors" section for the causes
(missing/invalid
guestEmbeddedServiceConfigId
, duplicate name/URL prefix, org lacks self-service
site-creation API access, missing
) and their resolutions.
Option B: Partner Portal (PRM)
API Call (via
mcp__headless-360__dispatch
):
text
method: "POST"
url: "/services/data/v67.0/connect/prm/setup/sites"
body:
{
"siteName": "<name>",
"siteUrlPrefix": "<url-prefix>",
"siteDesc": "<description>",
"prmTemplate": "<template-name>"
}
Synchronous — no job polling.
Response:
json
{
"networkId": "0DB..."
}
On success, report
— the partner portal was created; give the name,
,
, and
. Next: find it at Setup → Digital Experiences → All Sites (by
Network ID), then complete Step 3 (Activate → Add Members → Publish).
On failure, report
— see "Common Errors" (org lacks PRM/
, invalid PRM
template name, duplicate name/URL prefix). PRM templates: Setup → Digital Experiences → Settings →
Partner Templates.
Option C: General Community
First, discover valid templates (required — accepted
strings vary by org edition/version), via
mcp__headless-360__dispatch_readonly
:
text
method: "GET"
url: "/services/data/v67.0/connect/communities/templates"
Response:
{ "templates": [ { "publisher": "Salesforce", "templateName": "Employee Portal" }, … ], "total": N }
. Use a returned
verbatim. Prefer an
Experience Builder template (Aura or LWR). Never use
Salesforce Tabs + Visualforce
.
API Call (via
mcp__headless-360__dispatch
):
text
method: "POST"
url: "/services/data/v67.0/connect/communities"
body:
{
"name": "<name>",
"urlPathPrefix": "<url-prefix>",
"description": "<description>",
"templateName": "Agentforce Employee Center"
}
The body accepts only
{name, description, templateName, templateParams, urlPathPrefix}
— omit
unless you need template-specific config.
For an
employee service / ITSM / HR portal, prefer the
Agentforce Employee Center
template when the org's live template list includes it — it ships IT/HR ticketing, a self-service catalog, a knowledge base, and an Agentforce-ready experience. Fall back to
(then
) for a plainer, non-Agentforce site. Other options by use case:
(Aura knowledge/deflection),
(Aura authenticated account self-service),
(Aura PRM), or
for a modern blank LWR site.
Agentforce Employee Center is two layers. This
POST /connect/communities
call provisions the
site only. The embedded
Agentforce conversational assistant is a separate step — create the internal employee agent from its shipped template (
EmployeeCopilot__AgentforceEmployeeAgent
) via
PATCH /services/data/v67.0/headless/invoke/einstein/genai-agentbuilder/create-copilot-from-template
(
is
required), then activate it and wire it to the site. This skill provisions the site and points the user to that step; full Agentforce setup is out of scope. See
.
Response:
json
{
"jobId": "08P...",
"message": "Your site is almost ready. To track the site creation status, query the BackgroundOperation object and enter the jobId as the Id.",
"name": "Customer Community"
}
On success, report
— community creation started; give the name,
, and
. Next: monitor the job (see 'Background Job Monitoring'), then complete Step 3 (Activate →
Add Members → Publish).
On failure, report
— see "Common Errors" (invalid
— run
GET /services/data/v67.0/connect/communities/templates
and use a returned value verbatim; duplicate
name/URL prefix; missing Manage Communities permission).
Step 3: Make the Site Reachable — Activate, Add Members, Publish
Creation only provisions the site — it comes back
, admin-only, with
unpublished pages, so its URL is
not reachable yet (the #1 "my portal doesn't work" cause).
Complete three steps, in order: (1)
Activate — deploy the
metadata with
; (2)
Add members — add the target
profile(s) to
(membership is profile-based, not per user; e.g.
— a
Profile, not a UserRole) and redeploy (combinable with step 1); (3)
Publish —
sf community publish --name "<Site Name>"
, then poll the returned
on
until
. Then confirm
and give the user the
login URL
(
), not the bare prefix.
Tooling exception: activate/members use the
Metadata API (
deploy) and publish
uses
— there is no Connect API for these (
PATCH /connect/communities
returns 405). This is the one place the skill uses tools other than headless-360; Step 3 reads
still go through headless-360.
Exact commands, XML, verification queries, and gotchas: references/post-creation-activate-publish.md
.
Step 4: Write the Portal Creation Report (always — final step)
Always finish by writing a summarizing what was done — this is the skill's final,
non-optional action, whether the create call succeeded, is still provisioning, or failed. Write it to
the working/output directory as
.
The report must:
- Start with the heading .
- State the portal name, the API used (, , or ) and
why (e.g. "no guest ESD present → communities API"), the framework (Aura / LWR), and the
template or chosen.
- Give the dispatched request (path + key body fields) and the response ( /
/ / , or the error).
- List the remaining Step 3 work (Activate → Add Members → Publish) and, for employee-service
sites, note that the embedded Agentforce agent is a separate follow-up step.
- End with the sentinel line, exactly:
Task completed: portal creation dispatched — see report.md
Copy the template at assets/report-template.md
and fill in the portal-specific values.
Template Recommendations
All recommendations produce
Experience Builder sites (Aura or LWR). Never recommend
Salesforce Tabs + Visualforce
("VF Template") — it is legacy and has no Builder.
| Use Case | API | Framework | Template / |
|---|
| Employee service / ITSM / HR / help desk (richest; Agentforce-ready) | | Aura | Agentforce Employee Center
|
| Employee service / help desk (MIAW at creation, guest ESD exists) | | Aura | (+ MIAW ESD config) |
| Employee service / help desk (plainer, no Agentforce) | | Aura | (fallback ) |
| Customer support / self-service community | | Aura | |
| Knowledge base / case deflection | | Aura | |
| Authenticated account self-service | | Aura | |
| Partner portal (with PRM) | | Aura | Org-specific PRM template |
| Partner portal / channel (no PRM) | | Aura | |
| Modern blank / headless-friendly site | | LWR | |
Modern recommendations:
- For employee service / ITSM / HR portals, prefer the
Agentforce Employee Center
Aura template via the communities API — it ships the fullest employee experience (ticketing, catalog, knowledge, Agentforce-ready). The conversational assistant is a separate agent step (EmployeeCopilot__AgentforceEmployeeAgent
). Use the self-service site API () instead when the portal needs MIAW wired in at creation time and a guest Embedded Service Deployment exists; use for a plainer, non-Agentforce site.
- For customer communities, use the template (Aura, mobile-responsive) via the communities API.
See
for complete template documentation.
Background Job Monitoring
Portal creation is asynchronous (except PRM which is synchronous). Poll through
mcp__headless-360__dispatch_readonly
.
Self-service site path — use the dedicated typed status route (preferred):
text
method: "GET"
url: "/services/data/v67.0/connect/self-service/site/status/{jobId}"
Returns
{success, siteName, urlPathPrefix, siteUrl, error, jobId, status}
.
Communities path — query
via the
regular REST query endpoint,
not :
text
method: "GET"
url: "/services/data/v67.0/query"
queryParams: { "q": "SELECT Id, Status FROM BackgroundOperation WHERE Id = '<jobId>'" }
Tooling vs. regular query (verified gotcha): is
not a valid Tooling
API sObject through this dispatcher —
GET /services/data/vXX.0/tooling/query
with that SOQL
returns
400 INVALID_TYPE "sObject type 'BackgroundOperation' is not supported."
. Use the plain
/services/data/vXX.0/query
endpoint instead; it succeeds with the same SOQL string.
Column discipline: on
, select only
and
.
,
, and
are
not columns on this object and return
.
Use the SOQL string above exactly.
Job statuses:
- / — waiting to start
- / — executing
- — finished successfully
- — failed (check the field on the status route)
Verification
After creation completes:
- API (primary):
mcp__headless-360__dispatch_readonly(url: "/services/data/v67.0/connect/communities", method: "GET")
lists all Experience Cloud sites. Find the new one and confirm siteAsContainerEnabled: true
(Experience Builder — Aura/LWR) and a non-null , and that is not Salesforce Tabs + Visualforce
. siteAsContainerEnabled: false
means a legacy Visualforce site — the bug this skill exists to avoid.
- Setup UI (optional): Setup → Digital Experiences → All Sites. The Framework column should show Aura (or LWR) — not Visualforce — with a Builder workspace link.
- Test URL: Use from the response (portal will be inactive initially).
Note: Portal must be activated and published before external users can access it.
Rules / Constraints
| Constraint | Rationale |
|---|
| Portal creation is asynchronous | Deploys metadata and provisions resources in background |
| Site names must be unique | Each portal needs distinct name within org |
| URL prefixes must be unique | URL paths cannot conflict |
| URL prefixes must be alphanumeric | No hyphens, spaces, or special characters allowed |
| PRM requires PRM feature | Gated by licensing and org config |
| Created portals start inactive | Must manually activate/publish after creation |
| Paths must include the API version prefix | / do not inject — omitting it returns |
Prerequisites by Type
Employee Service / Self-Service:
- permission
- Communities/Digital Experience enabled
- Org has self-service site-creation API access enabled
- A guest Embedded Service Deployment (MIAW) config exists (its ID is required); optionally an authenticated-user ESD config
Partner (PRM):
- Org has
- Portal creation permissions
- Valid PRM template name
General Community:
- Manage Communities permission ()
- Communities/Digital Experience enabled
- Valid template name
Common Errors
Invalid URL prefix:
"The URL can only contain alphanumeric characters. Remove hyphens, spaces, or special characters (e.g., 'employeeservice' not 'employee-service') and try a different prefix."
Invalid template name (general community path):
"The specified template does not exist.
Resolution:
- Run
GET /services/data/v67.0/connect/communities/templates
and use a returned verbatim
- Prefer an Experience Builder template:
Agentforce Employee Center
(employee service), , , , , , ,
- Template names are case-sensitive — match exactly
- Do NOT use
Salesforce Tabs + Visualforce
("VF Template") — it is a legacy Visualforce site with no Builder"
Missing guest Embedded Service config (self-service path):
"The self-service site API requires a guest Embedded Service Deployment config ID.
Resolution:
- Create an Embedded Service Deployment (MIAW) at Setup → Embedded Service Deployments, or use the MIAW/embedded-service setup skill
- Pass its config ID as
guestEmbeddedServiceConfigId
(and optionally for authenticated users)"
PRM not enabled:
"This org doesn't have Partner Relationship Management (PRM) enabled.
Options:
- Contact Salesforce to enable PRM feature
- Create a general community with the template instead (via Communities API)"
Duplicate name/URL:
"A portal with this name or URL prefix already exists (the communities API returns
—
Enter a different name. That one already exists.
).
Check existing portals: mcp__headless-360__dispatch_readonly(url: "/services/data/v67.0/connect/communities", method: "GET")
and scan the
/
fields.
Choose a different name or URL prefix."
Missing permissions:
"You don't have permission to create portals.
Required permissions:
- Self-service portals:
- General communities: (Manage Communities)
Contact your Salesforce admin to request these permissions."
Route not found (missing version prefix):
"
on a path that otherwise matches this skill's documentation. Confirm the
includes the full
prefix —
/
require it verbatim and won't add it for you. If a specific version 404s, try the version shown in a recent
/
result for that org."
Related Operations
After creation:
- Activate portal — Setup → Digital Experiences → All Sites → Activate
- Configure branding — Customize colors, logo, theme
- Add pages/components — Use Experience Builder
- Set up user access — Profiles, permission sets, sharing rules
- Publish portal — Make accessible to external users
Manage existing:
- List portals —
mcp__headless-360__dispatch_readonly(url: "/services/data/v67.0/connect/communities", method: "GET")
- Update settings — Network Tooling API or Metadata API
- Deactivate — Via Setup UI
Important Notes
- Creation is asynchronous (except PRM) and only provisions — APIs return a job ID and the portal comes back , member-less, and unpublished, so its URL is not reachable until you complete Step 3 (Activate → Add Members → Publish; see
references/post-creation-activate-publish.md
).
- URL prefix becomes the site path —
https://<domain>.my.site.com/<prefix>
(serve/login at , not the bare prefix).
- Embedded Service / MIAW configs must pre-exist — This skill does not create Embedded Service Deployments. Create them separately at Setup → Embedded Service Deployments (or via the MIAW/embedded-service setup skill), then pass the config IDs to the self-service site API. For general communities, MIAW is added post-creation via an Embedded Service component in Experience Builder.
- Template names are case-sensitive — Verify available templates in your org before attempting creation.
- discover/describe may not resolve a specific Connect API operation by id — the headless-360 corpus indexes many operations as multi-step SORs rather than single endpoints, and some standard Connect API writes (e.g.
POST /connect/communities
) are not individually indexed. Do not conclude the capability is missing; dispatch the well-known, versioned Connect API path directly (documented in this skill).
Reference Documentation
references/mcp-invocation.md
— Read every session. Exact call shapes, the version-prefix requirement, response envelope, job monitoring, column/endpoint discipline, and gotchas.
- — Available templates, template parameters, selection guide.
references/post-creation-activate-publish.md
— Step 3 (activate, add members, publish) to make the site reachable: the Metadata-API + paths, the 405-on-PATCH gotcha, column discipline, and the login-URL note.
assets/report-template.md
— Step 4 template to copy (heading, required fields, sentinel).
API Type Classification
Site creation is dispatched through
mcp__headless-360__dispatch
/
mcp__headless-360__dispatch_readonly
(never project-codey or raw HTTP). All paths include the
prefix.
Post-creation (Step 3) is the one exception: activating the Network and adding members use the
Metadata API (
sf project deploy start --metadata Network:...
), and publishing uses
— there is no Connect API for these (a
PATCH /connect/communities/<id>
returns 405). Reads/verification for Step 3 still go through headless-360. Creation paths:
- Self-service portal: Connect API
POST /services/data/vXX.0/connect/self-service/site
— asynchronous (poll GET /services/data/vXX.0/connect/self-service/site/status/{jobId}
)
- PRM portal: Connect API
POST /services/data/vXX.0/connect/prm/setup/sites
— synchronous
- General community: Connect API
POST /services/data/vXX.0/connect/communities
— asynchronous (poll via GET /services/data/vXX.0/query
, not )