Salesforce API 67.0: Apex, Integrations Face Major Changes

With the Summer '26 release of Salesforce API 67.0, Apex, integrations face major changes that demand immediate attention from architects and developers. This version introduces fundamental shifts in Apex security, accelerates the retirement of legacy APIs, and standardizes AI integration, impacting existing codebases and future roadmaps. Teams must proactively test and adapt to avoid service disruptions and leverage new capabilities effectively.

What are the key changes in Salesforce API version 67.0 and how do they affect Apex and integrations?

Salesforce API version 67.0, released in Summer '26, enforces 'with sharing' and 'USER_MODE' in Apex by default, retires older SOAP and Platform API versions, introduces managed Model Context Protocol (MCP) endpoints for AI integration, and adds new developer tools including SOQL FORMULA() and expanded REST resources. Migration and pre-release testing are critical for smooth upgrades.

1. Apex security: silent rewrite of the rulebook

Salesforce API v67.0 enforces with sharing and USER_MODE by default in all Apex classes and database operations, unless explicitly overridden. The WITH SECURITY_ENFORCED clause is now deprecated and must be replaced with WITH USER_MODE. Triggers now run exclusively in system mode without sharing declarations.

Starting with API version 67.0, the Apex runtime enforces a new default security model. All classes behave as if declared with sharing, and all database operations run in USER_MODE unless specified otherwise. The WITH SECURITY_ENFORCED SOQL clause is deprecated; queries must be updated to use WITH USER_MODE to maintain field-level security checks.

Old pattern (v66 and earlier)	New required pattern (v67+)
[SELECT Id FROM Account WITH SECURITY_ENFORCED]	[SELECT Id FROM Account WITH USER_MODE]
Class header blank (ran as without sharing)	Must declare without sharing if that behaviour is intended
Triggers could declare sharing	Sharing keywords disallowed; triggers always system mode

The platform will not generate a compile-time error for these changes. Instead, queries may return fewer records or throw runtime exceptions, making pre-release testing in a Developer Preview org essential. Code review is needed before upgrading, as tests may fail due to new defaults.

A single overlooked SOQL statement can now mask records from integration users that previously saw everything, breaking downstream AI agents that depend on full data visibility.

2. Legacy API countdown begins

Salesforce is accelerating the retirement of older API versions. Platform API versions 31.0-40.0 are deprecated in Summer '27 and will be fully retired in Summer '28, at which point calls will fail. Any integration using these legacy endpoints, common in older ETL tools, must be upgraded to version 41.0 or higher. Use the provided Setup utility to identify all call sources by version and plan migrations accordingly.

Component	Last safe version	Retirement wave	Recommended replacement
Platform API	40.0	Summer '28	41.0+ or REST/Connect endpoints
S2S connection	any	Spring '27	Partner Cloud, MuleSoft, or Data Cloud

3. MCP Server goes GA - AI agents get first-class status

The Model Context Protocol (MCP) capabilities are being expanded with a managed MCP endpoint automatically provisioned for all Production and Sandbox orgs, exposing sObject operations, Flow interviews, and other resources as JSON-RPC tools. This allows any MCP-compatible external agent, such as those from OpenAI or Claude, to discover and invoke org capabilities using standard OAuth scopes.

MuleSoft's API Catalog will expose RAML and OAS specifications via MCP, allowing agents to choose between direct Salesforce calls and mediated enterprise services.

With hosted MCP, the integration pattern shifts from "build an API for the AI" to "let the AI browse the org's capability catalog" - a move that cuts average connector development time from weeks to hours.

4. Developer toolbox: smaller gems with outsized impact

This release also includes several targeted enhancements for developers:

• SOQL FORMULA() pilot: Execute formula logic directly within the WHERE clause. For example, a formula field Days_Since_Last_Activity can now be filtered directly:
  SELECT Id FROM Account WHERE FORMULA(Days_Since_Last_Activity) > 30
• Apex Flow Actions: Now support custom property editors, allowing developers to create more intuitive configuration experiences for Flow builders, such as picking metadata directly from the canvas.
• Expanded Connect REST API: Adds 23 new resources for features like Revenue Management, Service Cloud Voice, and OmniStudio Data Mappers. These are also automatically exposed via the MCP channel.

5. What delivery teams should do before the next sprint

To ensure a smooth transition to version 67.0, delivery teams should prioritize the following actions:

1. Provision a Developer Preview org, deploy all packages, and execute all Apex tests with API 67.0 active. Document any permission errors.
2. Use the Setup utility to scan for and identify all external systems using retiring API versions. Create a migration plan with clear ownership and deadlines.
3. Activate the auto-provisioned MCP server, export its OpenRPC manifest, and submit it for a security review of required OAuth scopes.
4. Identify and update any triggers that still declare a sharing mode. The keyword must be removed, as it will cause a compile error in v67.0.
5. Perform a repository-wide search for WITH SECURITY_ENFORCED clauses and budget time to rewrite them using WITH USER_MODE.

Industry reports suggest that completing this checklist before the main sandbox preview can significantly reduce post-upgrade hotfixes compared to teams that wait until staging.