service-itsm-agentic-setup-uel-user-create

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Create and Enable a Unified Employee (UEL) User

创建并启用Unified Employee (UEL)用户

Provision an employee under the Unified Employee License (UEL) by creating and linking a

User

on the Unified Employee license/profile, a Person

Account

(with an auto-generated

Contact

), and an

Employee2

record, then assigning the required permission sets. Every operation runs through the Salesforce-hosted headless-360 MCP server (server key

headless-360

) via its four meta-tools (

discover

describe

dispatch_readonly

dispatch

). The org is derived from the OAuth JWT bound to the current MCP session — the skill never handles an org id, alias, or credentials — so the flow behaves identically against production and sandbox with no per-user MCP install.

通过创建并关联Unified Employee许可/配置文件下的

User

、Person

Account

（含自动生成的

Contact

）以及

Employee2

记录，然后分配所需权限集，为员工配置Unified Employee License (UEL)。所有操作均通过Salesforce托管的headless-360 MCP服务器（服务器密钥

headless-360

）及其四个元工具（

discover

、

describe

、

dispatch_readonly

、

dispatch

）执行。组织信息由绑定到当前MCP会话的OAuth JWT派生而来——本技能从不处理组织ID、别名或凭据——因此该流程在生产环境和沙箱中的表现完全一致，无需为每个用户安装MCP。

Scope

适用范围

In scope: Creating a new UEL User, Person Account, Employee2 record; assigning permission sets; verifying the full chain.
Out of scope: Standard user creation (non-UEL); cloning existing users; managing existing user permissions only; deactivating users; license assignment changes.

包含场景：创建新的UEL User、Person Account、Employee2记录；分配权限集；验证完整实体链。
排除场景：创建标准用户（非UEL）；克隆现有用户；仅管理现有用户权限；停用用户；更改许可分配。

Routes at a glance

路由概览

Reads dispatch through

mcp__headless-360__dispatch_readonly

; writes through

mcp__headless-360__dispatch

. Both take raw HTTP:

{"url": "<path>", "method": "GET|POST", "body"?: {...}, "queryParams"?: {...}}

. Full URL paths and request/response bodies for every row live in

references/mcp-invocation.md

; this table lists only the operation and HTTP method.

Concern	Method + operation	Notes
Unified Employee license	`GET /query` (UserLicense)	Zero rows → stop
Unified Employee profile	`GET /query` (Profile)	Zero rows → stop
Person Account record type	`GET /query` (RecordType, IsPersonType)	Zero rows → stop
Employee Hub perm set	`GET /query` (PermissionSet)	Mandatory; zero rows → stop
Employee2 accessible	`GET /sobjects/Employee2/describe`	200 = HR module enabled
Resolve manager	`GET /query` (User by Username/Name)	Active users only
Create user	`POST /sobjects/User`	Profile = Unified Employee
Assign Employee Hub set	`POST /sobjects/PermissionSetAssignment`	Mandatory
Create Person Account	`POST /sobjects/Account`	`PersonEmail` required
Read PersonContact	`GET /query` (Account)	Capture `PersonContactId`
Create Employee2	`POST /sobjects/Employee2`	Use `UserId` / `ContactId` field names
Verify chain	`GET /query`	User + Account + Employee2 + perm sets

Response envelope:

describe

/query

, and

/sobjects/…

are all standard REST — the

dispatch*

tool returns the HTTP status plus the parsed body:

{ "status_code": 200, "body": <REST response> }

. Read

body

. A create returns

body.id

and

body.success == true

; a query returns

body.records[]

. Status codes:

200/201

success;

bad body (re-check schema via

describe

);

/auth error the MCP session needs re-auth;

the endpoint/impl is not present on this org;

a downstream dependency issue.

读取操作通过

mcp__headless-360__dispatch_readonly

执行；写入操作通过

mcp__headless-360__dispatch

执行。两者均接受原始HTTP请求：

{"url": "<path>", "method": "GET|POST", "body"?: {...}, "queryParams"?: {...}}

。每行的完整URL路径以及请求/响应体均位于

references/mcp-invocation.md

中；本表仅列出操作和HTTP方法。

事项	方法 + 操作	说明
Unified Employee许可	`GET /query` (UserLicense)	无结果则终止
Unified Employee配置文件	`GET /query` (Profile)	无结果则终止
Person Account记录类型	`GET /query` (RecordType, IsPersonType)	无结果则终止
Employee Hub权限集	`GET /query` (PermissionSet)	必填；无结果则终止
Employee2可访问性	`GET /sobjects/Employee2/describe`	返回200表示HR模块已启用
解析经理信息	`GET /query` (User by Username/Name)	仅查询活跃用户
创建用户	`POST /sobjects/User`	Profile = Unified Employee
分配Employee Hub权限集	`POST /sobjects/PermissionSetAssignment`	必填
创建Person Account	`POST /sobjects/Account`	`PersonEmail` 为必填项
读取PersonContact	`GET /query` (Account)	捕获 `PersonContactId`
创建Employee2	`POST /sobjects/Employee2`	使用 `UserId` / `ContactId` 字段名
验证实体链	`GET /query`	验证User + Account + Employee2 + 权限集

响应包：

describe

、

/query

和

/sobjects/…

均为标准REST接口——

dispatch*

工具返回HTTP状态码及解析后的响应体：

{ "status_code": 200, "body": <REST响应> }

。读取

body

字段即可。创建操作返回

body.id

且

body.success == true

；查询操作返回

body.records[]

。状态码说明：

200/201

表示成功；

表示请求体无效（需通过

describe

重新检查 schema）；

/认证错误表示MCP会话需重新认证；

表示该组织不存在此端点/实现；

表示下游依赖出现问题。

Required Inputs

必填输入项

Collect from the user (ask only what is not already in conversation context):

从用户处收集信息（仅询问对话上下文未包含的内容）：

Identity (required)

身份信息（必填）

Field	Description
`FirstName`	Employee first name
`LastName`	Employee last name
`Email`	Employee email address

字段	描述
`FirstName`	员工名
`LastName`	员工姓
`Email`	员工邮箱地址

Credentials & Locale (required)

凭据与区域设置（必填）

Field	Description	Example
`Username`	Email-formatted, globally unique	`jane.doe@company.uel.com`
`Alias`	Max 8 chars	`jdoe`
`TimeZoneSidKey`	Timezone	`America/Los_Angeles`
`LocaleSidKey`	Locale	`en_US`
`LanguageLocaleKey`	Language	`en_US`
`EmailEncodingKey`	Email encoding	`UTF-8`

字段	描述	示例
`Username`	邮箱格式，全局唯一	`jane.doe@company.uel.com`
`Alias`	最多8个字符	`jdoe`
`TimeZoneSidKey`	时区	`America/Los_Angeles`
`LocaleSidKey`	区域设置	`en_US`
`LanguageLocaleKey`	语言	`en_US`
`EmailEncodingKey`	邮箱编码	`UTF-8`

Manager (optional)

经理信息（可选）

Field	Description
`ManagerName` or `ManagerUsername`	Resolve to ManagerId via SOQL

字段	描述
`ManagerName` 或 `ManagerUsername`	通过SOQL解析为ManagerId

HR Attributes for Employee2 (required)

Employee2的HR属性（必填）

Field	Description
`Department`	Employee department
`Location`	Employee location
`EmployeeNumber`	HR employee number
`Title`	Job title
`HireDate`	Date format: YYYY-MM-DD

字段	描述
`Department`	员工部门
`Location`	员工办公地点
`EmployeeNumber`	HR员工编号
`Title`	职位名称
`HireDate`	日期格式：YYYY-MM-DD

Permission Sets

权限集

Employee Hub Unified Employee User

(

EmployeeHubEmployeeUser

) is always assigned — no other permission sets belong on a UEL user. If the caller asks for extras (Incident Fulfiller, Case Agent, or any other fulfiller/agent-role set), decline: those are for fulfillers on the Service Cloud side, not for requesters who log into the Employee Hub. Point the caller at the appropriate fulfiller user-create flow instead of extending this one.

Employee Hub Unified Employee User

（

EmployeeHubEmployeeUser

）始终会被分配——UEL用户不应添加其他权限集。若调用者要求添加额外权限集（Incident Fulfiller、Case Agent或任何其他执行者/代理角色权限集），需拒绝：这些权限集适用于Service Cloud端的执行者，而非登录Employee Hub的请求者。请引导调用者使用对应的执行者用户创建流程，而非扩展本流程。

Workflow

工作流程

All steps are sequential. Always read before you write. Every call goes through

mcp__headless-360__*

tools. Stop and report if any step fails.

所有步骤均按顺序执行。写入前务必先读取。所有调用均通过

mcp__headless-360__*

工具执行。若任何步骤失败，需立即终止并上报。

Phase 1 — Preflight & discovery

阶段1 — 预检与发现

On any
401
/
403
/
404
from a
discover
/
describe
/
dispatch
/
dispatch_readonly
call below, halt and surface the raw error — the org or client is not configured correctly.

→ headless-360 MCP client not authenticated to

CORE_ORG_ALIAS

(session expired).

→ executing user is missing one of the required perms (

ManageUsers

ManageProfilesPermissionsets

CustomizeApplication

AssignPermissionSets

) OR the org lacks the Unified Employee License.

→ the target sObject / route is not available (HR module / UEL not provisioned — surfaces separately as the five prerequisite checks in step 2).

Discover the operations —
```
mcp__headless-360__discover(query="create User Account Employee2 sObject")
```
and
```
mcp__headless-360__describe(id=<operation_id>)
```
for the
```
POST /sobjects/User
```
,
```
POST /sobjects/Account
```
, and
```
POST /sobjects/Employee2
```
operations to confirm they are indexed and pull the input schema. A
```
discover
```
miss does not mean the route is absent — the
```
/sobjects/…
```
REST endpoints are core Data API paths and can be invoked directly with
```
dispatch_readonly
```
/
```
dispatch
```
against the exact URL (see
```
references/mcp-invocation.md
```
). If a direct
```
dispatch_readonly
```
probe at the documented path also fails (404), direct the user to the Setup UI.
Verify all five UEL prerequisites (all read-only
```
/query
```
or describe). If any fails, stop and report exactly which prerequisite is missing:
- Unified Employee license exists → else "Unified Employee license not found in this org."
- Unified Employee profile exists → else "Unified Employee profile not found. Ensure UEL license is provisioned."
- Active Person Account record type exists → else "No active Person Account record type found. Enable Person Accounts in Setup."
- Employee Hub permission set exists → else "Employee Hub Unified Employee User permission set not found. This is required for UEL provisioning."
- Employee2 describe returns 200 → else "Employee2 sObject not accessible. Ensure the HR module is enabled."
Capture:
```
UnifiedEmployeeProfileId
```
,
```
PersonAccountRecordTypeId
```
,
```
EmployeeHubPermSetId
```
.

若以下
discover
/
describe
/
dispatch
/
dispatch_readonly
调用返回
401
/
403
/
404
，需立即终止并显示原始错误——组织或客户端配置不正确。

表示headless-360 MCP客户端未通过

CORE_ORG_ALIAS

认证（会话已过期）。

表示执行用户缺少必要权限（

ManageUsers

、

ManageProfilesPermissionsets

、

CustomizeApplication

、

AssignPermissionSets

），或组织未配置Unified Employee许可。

表示目标sObject/路由不可用（HR模块/UEL未配置——会在步骤2的五项前置检查中单独提示）。

发现操作——调用
```
mcp__headless-360__discover(query="create User Account Employee2 sObject")
```
，并针对
```
POST /sobjects/User
```
、
```
POST /sobjects/Account
```
和
```
POST /sobjects/Employee2
```
操作调用
```
mcp__headless-360__describe(id=<operation_id>)
```
，确认操作已被索引并获取输入schema。
```
discover
```
未找到结果不代表路由不存在——
```
/sobjects/…
```
REST端点是核心Data API路径，可直接使用
```
dispatch_readonly
```
/
```
dispatch
```
调用精确URL（详见
```
references/mcp-invocation.md
```
）。若直接调用文档路径的
```
dispatch_readonly
```
也返回失败（404），请引导用户前往Setup UI进行配置。
验证五项UEL前置条件（均为只读
```
/query
```
或describe操作）。若任何一项失败，立即终止并明确上报缺失的前置条件：
- 存在Unified Employee 许可 → 否则提示"此组织中未找到Unified Employee许可。"
- 存在Unified Employee 配置文件 → 否则提示"未找到Unified Employee配置文件，请确保已配置UEL许可。"
- 存在活跃的Person Account记录类型 → 否则提示"未找到活跃的Person Account记录类型，请在Setup中启用Person Accounts。"
- 存在Employee Hub权限集 → 否则提示"未找到Employee Hub Unified Employee User权限集，这是UEL配置的必填项。"
- Employee2 describe返回200 → 否则提示"无法访问Employee2 sObject，请确保HR模块已启用。"
捕获以下ID：
```
UnifiedEmployeeProfileId
```
、
```
PersonAccountRecordTypeId
```
、
```
EmployeeHubPermSetId
```
。

Phase 2 — Resolve references

阶段2 — 解析引用信息

Resolve the manager — when the user supplied a manager, query by Username or Name (active users only). On multiple matches, present options and ask the user to disambiguate. Capture
```
ManagerId
```
. When no manager was supplied, skip this step.
Check username uniqueness — query
```
User
```
by
```
Username
```
; any record → stop, username taken.

解析经理信息——若用户提供了经理信息，通过Username或Name查询（仅查询活跃用户）。若存在多个匹配结果，需提供选项并请用户明确选择。捕获
```
ManagerId
```
。若未提供经理信息，跳过此步骤。
检查用户名唯一性——通过
```
Username
```
查询
```
User
```
；若存在记录则立即终止，提示用户名已被占用。

Phase 3 — Confirm & create the chain

阶段3 — 确认并创建实体链

Confirm the plan — present the full configuration (including HR attributes) and wait for explicit confirmation before any mutation.

Create the User —

POST /sobjects/User

with identity, locale,

ProfileId

UnifiedEmployeeProfileId

, and

ManagerId

(omit

ManagerId

when none). Capture

NewUserId

Assign the Employee Hub permission set (mandatory) —
```
POST /sobjects/PermissionSetAssignment
```
with
```
{AssigneeId: NewUserId, PermissionSetId: EmployeeHubPermSetId}
```
. If this fails, stop and report the exact error — the set exists (verified) but may be incompatible with the license.
Create the Person Account —
```
POST /sobjects/Account
```
with
```
FirstName
```
,
```
LastName
```
,
```
PersonEmail
```
(required), and
```
RecordTypeId
```
=
```
PersonAccountRecordTypeId
```
. Capture
```
NewAccountId
```
.
```
PersonEmail
```
must be set: the Employee2 validation hook rejects the record when the linked PersonContact is missing
```
Email
```
or
```
LastName
```
.
Verify the PersonContact — query the Account for
```
IsPersonAccount
```
and
```
PersonContactId
```
. Confirm
```
IsPersonAccount = true
```
and capture
```
PersonContactId
```
. If it is null, stop and report failure to generate the PersonContact.
Create the Employee2 record —
```
POST /sobjects/Employee2
```
with
```
UserId
```
=
```
NewUserId
```
,
```
ContactId
```
=
```
PersonContactId
```
, and the HR attributes. Use the foreign-key field names
```
UserId
```
/
```
ContactId
```
(not the relationship names
```
User
```
/
```
Contact
```
). Capture
```
NewEmployee2Id
```
.

确认配置方案——向用户展示完整配置信息（含HR属性），等待用户明确确认后再执行任何修改操作。
创建User——调用
```
POST /sobjects/User
```
，传入身份信息、区域设置、
```
ProfileId
```
=
```
UnifiedEmployeeProfileId
```
，以及
```
ManagerId
```
（未提供则省略）。捕获
```
NewUserId
```
。
分配Employee Hub权限集（必填）——调用
```
POST /sobjects/PermissionSetAssignment
```
，传入
```
{AssigneeId: NewUserId, PermissionSetId: EmployeeHubPermSetId}
```
。若此步骤失败，立即终止并上报具体错误——权限集已存在（已验证），但可能与许可不兼容。
创建Person Account——调用
```
POST /sobjects/Account
```
，传入
```
FirstName
```
、
```
LastName
```
、
```
PersonEmail
```
（必填），以及
```
RecordTypeId
```
=
```
PersonAccountRecordTypeId
```
。捕获
```
NewAccountId
```
。必须设置
```
PersonEmail
```
：当关联的PersonContact缺少
```
Email
```
或
```
LastName
```
时，Employee2验证钩子会拒绝该记录。
验证PersonContact——查询Account的
```
IsPersonAccount
```
和
```
PersonContactId
```
。确认
```
IsPersonAccount = true
```
并捕获
```
PersonContactId
```
。若
```
PersonContactId
```
为空，立即终止并上报生成PersonContact失败。
创建Employee2记录——调用
```
POST /sobjects/Employee2
```
，传入
```
UserId
```
=
```
NewUserId
```
、
```
ContactId
```
=
```
PersonContactId
```
，以及HR属性。使用外键字段名
```
UserId
```
/
```
ContactId
```
（而非关系名
```
User
```
/
```
Contact
```
）。捕获
```
NewEmployee2Id
```
。

Phase 4 — Verify & present

阶段4 — 验证并反馈

Verify the full chain — query the Account (IsPersonAccount, PersonContactId), the User (IsActive, ProfileId, ManagerId), the Employee2 (UserId, ContactId), and confirm the Employee Hub permission set is the only PermissionSetAssignment (beyond the profile).
Report using the output format below.

验证完整实体链——查询Account（IsPersonAccount、PersonContactId）、User（IsActive、ProfileId、ManagerId）、Employee2（UserId、ContactId），并确认仅分配了Employee Hub权限集（配置文件自带权限除外）。
按以下格式反馈结果。

Rules / Constraints

规则/约束

Constraint	Rationale
Verify all five prerequisites before any mutation	Prevents partial state when the org is not configured for UEL
Always `describe` before a `POST`	You need the exact input schema for each sObject
Confirm the plan with the user before creating records	Prevents unintended record creation
`PersonEmail` is required on Person Account create	The Employee2 validation hook rejects a PersonContact with no Email
Use `UserId` / `ContactId` field names on Employee2	The API rejects bare IDs under the relationship names
`Employee Hub Unified Employee User` is the ONLY permset assigned	UEL users are Employee Hub requesters, not fulfillers/agents — no other permsets are compatible
Omit null/empty foreign keys from create bodies	The API rejects an explicit empty `ManagerId`
Display the exact error from `dispatch*` on failure	Helps diagnose issues
Never show Salesforce record IDs to the user	Use human-readable names only

约束	理由
执行任何修改前验证所有五项前置条件	避免组织未配置UEL时出现部分状态
执行 `POST` 前务必调用 `describe`	需要获取每个sObject的精确输入schema
创建记录前需与用户确认配置方案	防止意外创建记录
创建Person Account时必须填写 `PersonEmail`	当PersonContact无Email时，Employee2验证钩子会拒绝该记录
在Employee2中使用 `UserId` / `ContactId` 字段名	API会拒绝使用关系名传入裸ID
仅分配 `Employee Hub Unified Employee User` 权限集	UEL用户是Employee Hub请求者，而非执行者/代理——其他权限集均不兼容
创建请求体中省略空值/空外键	API会拒绝显式传入空 `ManagerId`
失败时显示 `dispatch*` 返回的原始错误	便于排查问题
绝不向用户展示Salesforce记录ID	仅使用易读的名称

Permissions Required

所需权限

The executing admin user (the identity behind

CORE_ORG_ALIAS

) must have:

Permission	Purpose
Manage Internal Users	Create User records
Manage Profiles and Permission Sets	Assign permission sets
Customize Application	Create Employee2 and Person Account records
Assign Permission Sets	Create PermissionSetAssignment records

执行操作的管理员用户（

CORE_ORG_ALIAS

对应的身份）必须拥有以下权限：

权限	用途
Manage Internal Users	创建User记录
Manage Profiles and Permission Sets	分配权限集
Customize Application	创建Employee2和Person Account记录
Assign Permission Sets	创建PermissionSetAssignment记录

Verification Checklist

验证清单

Did
```
discover
```
+
```
describe(id)
```
(or, on a
```
discover
```
miss, a direct
```
dispatch_readonly
```
probe at the documented
```
/sobjects/…
```
path) confirm the User / Account / Employee2 create operations?
Did all five UEL prerequisites pass (license, profile, Person Account RT, Employee Hub set, Employee2)?
Did you confirm the username is unique and confirm the plan before any mutation?

Account.IsPersonAccount = true

with a non-null

PersonContactId

Is
```
User.IsActive = true
```
on the Unified Employee profile (and manager, if provided)?
Does
```
Employee2
```
link
```
UserId
```
and
```
ContactId
```
correctly?
Is
```
Employee Hub Unified Employee User
```
the only permission set assigned (no fulfiller-side extras)?

是否已通过
```
discover
```
+
```
describe(id)
```
（若
```
discover
```
未找到结果，则直接调用文档中
```
/sobjects/…
```
路径的
```
dispatch_readonly
```
）确认User/Account/Employee2的创建操作可用？
五项UEL前置条件是否全部通过（许可、配置文件、Person Account记录类型、Employee Hub权限集、Employee2）？
是否已确认用户名唯一，并在执行修改前与用户确认配置方案？

Account.IsPersonAccount

是否为

true

且

PersonContactId

非空？

```
User.IsActive
```
是否为
```
true
```
且使用Unified Employee配置文件（若提供了经理信息，经理用户也需满足此条件）？
```
Employee2
```
是否正确关联了
```
UserId
```
和
```
ContactId
```
？
是否仅分配了
```
Employee Hub Unified Employee User
```
权限集（无执行者侧额外权限集）？

Output Format

输出格式

On failure, display the error from

dispatch*

exactly as returned.

On success:

text

UEL User Provisioning Complete (via service-itsm-agentic-setup-uel-user-create)

User:
  Name:     <FirstName> <LastName>
  Username: <Username>
  Email:    <Email>
  Profile:  Unified Employee
  Manager:  <ManagerName> (or "not set")
  Status:   Active

Person Account:
  Account Name: <FirstName> <LastName>
  Person Contact: linked

Employee Record:
  Department:    <Department>
  Title:         <Title>
  Location:      <Location>
  Employee No:   <EmployeeNumber>
  Hire Date:     <HireDate>

Permission Set Assigned:
  - Employee Hub Unified Employee User

Chain: User > Person Account > PersonContact > Employee2 > Employee Hub permset

No record IDs in user-facing output — use human-readable names only.

失败时，直接显示

dispatch*

返回的错误信息。

成功时：