Business Mashups Best of the Web APIs

Slide 1: Business Mashups: Best of the Web APIs Track: New AppExchange Developer Ron Hess, salesforce.com Jon Jessup, Infopia Charlie Wood, Spanning Partners

Slide 2: Safe Harbor Statement “Safe harbor” statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain forward- looking statements the achievement of which involves risks, uncertainties and assumptions. If any such risks or uncertainties materialize or if any of the assumptions proves incorrect, our results could differ materially from the results expressed or implied by the forward-looking statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services. The risks and uncertainties referred to above include - but are not limited to - risks associated with the integration of Sendia Corporation’s technology, operations, infrastructure and personnel with ours; unexpected costs or delays incurred in integrating Sendia with salesforce.com, which could adversely affect our operating results and rate of growth; any unknown errors or limitations in the Sendia technology; any third party intellectual property claims arising from the Sendia technology; customer and partner acceptance and deployment of the AppExchange and AppExchange Mobile platforms; interruptions or delays in our service or our Web hosting; our new business model; breach of our security measures; possible fluctuations in our operating results and rate of growth; the emerging market in which we operate; our relatively limited operating history; our ability to hire, retain and motivate our employees and manage our growth; competition; our ability to continue to release and gain customer acceptance of new and improved versions of our CRM service; unanticipated changes in our effective tax rate; fluctuations in the number of shares outstanding; the price of such shares; foreign currency exchange rates and interest rates. Further information on these and other factors that could affect our financial results is included in the reports on Forms 10-K, 10-Q and 8-K and in other filings we make with the Securities and Exchange Commission from time to time, including our Form 10-K for the fiscal year ended January 31, 2006. These documents are available on the SEC Filings section of the Investor Information section of our website at www.salesforce.com/investor. Any unreleased services or features referenced in this or other press releases or public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make purchase decisions based upon features that are currently available. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements, except as required by law. 2

Slide 3: Business Mashups: Best of the Web APIs Track: New AppExchange Developer Jonathan Jessup Development Manager

Slide 4: Infopia Introduction  Leader in On-demand eCommerce Solutions  The industry’s most complete INDUSTRY: eCommerce on-demand eCommerce EMPLOYEES: 43 solution suite for online GEOGRAPHY: Global merchants: # USERS: 350 PRODUCTS USED: Oracle On- Marketplace Manager™ Demand, Salesforce. 4

Slide 5: Multichannel Selling – Means “Multi-Mashup”  Infopia utilizes API’s from many partners to deliver a complete ‘Inventory to Cash’ solution Inventory & Market Presence Fulfillment & Analysis & Merchandising & Shopping Tools Service Decisions •Real-Time Inventory •Website •Order Mgmt •Online Sales Pipeline •Listings (Price, •Marketplaces •Customer Mgmt •Marketplaces Promotion, Product, •Comparison Shopping •Fraud Alert •Customers Place) •Products CRM ERP Comparison Marketplaces Payment & Analytics Shopping Shipping 5

Slide 6: Transforming eCommerce Transactions into Relationships The Challenge – Taking my Business to eBay  Businesses looking to take advantage of eBay marketplace  Required resources to making this a viable business channel  Keeping this channel in sync with their traditional direct sales efforts. The Solution –Infopia, salesforce.com, & eBay  Extend the sales reach to the vast eBay online marketplace in a cost effective manner  Optimize customer service by maintaining the complete 360-degree customer visibility Analysis/ Operations & Market Fulfillment & Decisions Merchandising Presence Service Ecommerce Solution Online Sales Channels Analytics Marketing Sales Service CRM Solution 6

Slide 7: Keys to Successful API Integration  Language-independent implementation (SOAP XML)  Accessible over standard Internet protocols (HTTPS)  Clear and unambiguous description language (WSDL or XSD)  Full development and sandbox environments  SDK and sample codes  Developer’s Network and Support 7

Slide 8: eBay API Integration  API to create, revise and process eBay auctions  SOAP XML with complete WSDL  Full development and sandbox environments  Expansive Developers Network and Support  eBay API Calls:  com.ebay.sdk.ApiCall  com.ebay.soap.eBLBaseComponents.ItemType  com.ebay.soap.eBLBaseComponents.AddItemRequestType  com.ebay.soap.eBLBaseComponents.ReviseItemRequestType  com.ebay.soap.eBLBaseComponents.GetItemTransactionsResponseType  com.ebay.soap.eBLBaseComponents.AddMemberMessageRTQRequestType 8

Slide 9: Paypal Integration  API to process Paypal Payments  SOAP XML with complete WSDL and SDK  Full development and sandbox environments  Expansive Developers Network and Support  Paypal API Calls:  com.paypal.sdk.services.CallerServices  com.paypal.soap.api.DoAuthorizationRequestType  com.paypal.soap.api.DoCaptureRequestType  com.paypal.soap.api.DoDirectPaymentRequestType  com.paypal.soap.api.DoExpressCheckoutPaymentRequestType 9

Slide 10: Google Checkout Integration  Google Payment Processing API  XML Integration with complete XSD and SDK  Full development and sandbox environments  Good technical contacts and support  Google Checkout API Calls:  com.google.checkout.schema.x2.CheckoutShoppingCart  com.google.checkout.schema.x2.NewOrderNotification  com.google.checkout.schema.x2.RiskInformationNotification 10

Slide 11: Infopia Web Services API  Allows clients and partners to integrate with Infopia  SOAP XML, SSL, WSDL, SDK, Code Examples, etc.  Secure, client-specific access to Marketplace Manager data  Create, update, retrieve, and synchronize:  Inventory  Orders  Customer data 11

Slide 12: Infopia Demo 12

Slide 13: Business Mashups: Best of the Web APIs Track: New AppExchange Developer Charlie Wood Principal charlie.wood@spanningpartners.com

Slide 14: The Road to Sync: Feeds and Calendars  July ’05: Spanning Salesforce  RSS/Atom feeds for Salesforce and other AppExchange applications  July ’06: Spanning Salesforce for iCal  Web calendars for Salesforce using the iCalendar format and webcal:// protocol 14

Slide 15: Requirement: Sync with Google Apps  Customer Feedback  Calendar publishing is good  On-demand sync system  Two-way sync is better  Seamlessly integrates  Google Apps becoming a Google Applications with viable alternative to salesforce.com Microsoft Exchange  Speaks each system’s native language  Technology Challenge  Differences in protocols, formats, data models  Transparent operation 15

Slide 16: Spanning Sync for Google and AppExchange  How did we address the challenges?  Created a composite AppExchange application  Exposed the user interface in a custom tab  Hosted the sync engine on an external server  Used the AppExchange SOAP API and PHP Toolkit, and the Google Calendar Data API 16

Slide 17: User Perspective  Salesforce calendar and Google Calendar stay in sync  Key Requirements  Simple  Reliable  Transparent  Key Benefits  Eliminates need to maintain multiple calendars  Enables calendar sharing with non-SFDC users  Enables integration with numerous third-party PIM applications 17

Slide 18: Developer Perspective: Components 18

Slide 19: Developer Perspective: Process Flow 19

Slide 20: Developer Perspective: The Google Bits  Login to Google  Get updated and deleted events  Create/update events  Delete events 20

Slide 21: GData: The Google Data API  The API for Google Applications  Google Calendar  Blogger  Google Base  Format  Atom 1.0 plus custom namespace extensions  “Kinds” for specific data types (e.g., calendar events)  Protocol  Atom for reading  Atom Publishing Protocol for writing  OpenSearch for queries  Custom authentication for login to Google accounts  Custom versioning for conflict detection 21

Slide 22: Login to Google Calendar  ClientLogin (for installed apps), not AuthSub (for web apps)  HTTPS POST login request  Handle responses from Google:  success (HTTP 200)  failure (HTTP 403)  invalid request  CAPTCHA challenge  “Success” response includes an authentication token, required for all subsequent requests 22

Slide 23: Get Updated and Deleted Events Using GData  Queries are expressed an HTTP URIs: http://www.google.com/calendar/feeds/default/private/full?gsessionid=t1tdeGVYHL0& updated-min=2006-10-08T09:00:00-07:00&max-results=1000  Queries return an Atom feed with data in elements from two custom XML namespace extensions (“gd” and “gCal”): ... <gCal:sendEventNotifications value="true"/> <gd:recurrence>DTSTART;VALUE=DATE:20060818 DTEND;VALUE=DATE:20060819 RRULE:FREQ=DAILY;INTERVAL=1;UNTIL=20060823;WKST=SU</gd:recurrence> <gd:eventStatus value="http://schemas.google.com/g/2005#event.confirmed"/> <gd:transparency value="http://schemas.google.com/g/2005#event.opaque"/> <gd:reminder minutes="10"/> ...  Updates and Deletes are returned together, with deletes denoted by their status: <gd:eventStatus value="http://schemas.google.com/g/2005#event.canceled"/> 23

Slide 24: Create and Update Events Using GData  Specify the event using the GData format : <?xml version="1.0"?> <entry xmlns="http://www.w3.org/2005/Atom" xmlns:openSearch="http://a9.com/- /spec/opensearchrss/1.0/" xmlns:gd="http://schemas.google.com/g/2005" xmlns:gCal="http://schemas.google.com/gCal/2005"> <id>http://www.google.com/calendar/feeds/default/private/full/73st11emr9vunnde9sb2ggnsug</id> <category scheme="http://schemas.google.com/g/2005#kind" term="http://schemas.google.com/g/2005#event"/> <title type="text">Dreamforce Preparty</title> <content type="text">Don&apos;t stay out too late!</content> </content> <gd:transparency value="http://schemas.google.com/g/2005#event.opaque"/> <gd:visibility value="http://schemas.google.com/g/2005#event.default"/> <gd:eventStatus value="http://schemas.google.com/g/2005#event.confirmed"/> <gd:when startTime="2006-10-08T21:00:00.000-07:00" endTime="2006-10-00T00:00:00.000-07:00"> <gd:reminder minutes="15"/> </gd:when> </entry>  To create a new event, use HTTP POST to the feed’s URI  To update an event, use HTTP PUT to the event’s URI 24

Slide 25: Delete Events Using GData  To delete an event, use HTTP DELETE with the event’s URI: <?php $header[] = "Authorization: GoogleLogin auth=".$this->authToken; $header[] = "X-HTTP-Method-Override: DELETE"; $ch = curl_init(); curl_setopt($ch, CURLOPT_HTTPHEADER, $header); curl_setopt($ch, CURLOPT_URL, $theEventURI."?gsessionid=".$this- >sessionID); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_POST, 1); $tmp = curl_exec($ch); curl_close($ch); ?> 25

Slide 26: GData Optimistic Concurrency (Versioning)  Motivation  To prevent one client from overwriting another’s changes  Implementation  A version ID is appended to every GData entry’s URI: http://www.google.com/calendar/feeds/default/private/full/k28lgd7n 9jgbi220cv4fe5to04/63293840053  When a PUT or DELETE is performed, the version in the request is compared to the version of the existing entry  If the versions don’t match, Google responds with HTTP 409 Conflict  Beta  This is still a work in progress 26

Slide 27: Lessons Learned  Developing for GData feels like developing for AppExchange  No software to install, no biz dev meetings to attend  Develop using your language and tools of choice  Google Calendar Data API is still in beta  Only some data types supported (e.g., no contacts or tasks)  “Optimistic concurrency” versioning system still in development  Format and protocol docs don’t yet always match behavior  No scripting-level toolkits available yet, so you’ll be writing Java, C#, or raw HTTP requests  AppExchange + Google mashups can be incredibly powerful and relatively simple to create 27

Slide 28: For More Information  Google Data APIs (Beta) Developer’s Guide http://code.google.com/apis/gdata/overview.html  Using the Google Calendar Data API http://code.google.com/apis/gdata/calendar.html  Google Account Authentication http://code.google.com/apis/accounts/Authentication.html  Google Groups: Google Calendar Data API http://groups.google.com/group/google-calendar-help-dataapi  Moonwatcher (My Blog) http://globelogger.com/moonwatcher 28

Slide 29: QUESTION & ANSWER SESSION Salesforce.com Ron Hess Developer Marketing Spanning Partners Charlie Wood Principal Jonathan Jessup Jonathan Jessup Development Manager 29

Slide 30: Session Feedback Session ID: 234 Let us know how we’re doing! Save time! Use your cell phone or mobile device to send Feedback via SMS/Text Messaging! Please score the session from 5 to 1 (5=excellent,1=needs improvement) on the following categories:  Overall rating of the session  Quality of content Send a message to 26335  Strength of presentation delivery In the message body:  Relevance of the session to your Session 234, #### organization Scores for 4 Session ID # categories For example, “Session 123, 5555” SMS Voting powered by: 30

Slide 31: Login Sample Code (Part 1 of 3) <?php function authenticate($gcUname, $gcPword, $loginToken, $loginCaptcha) { $header[] = "Content-type: application/x-www-form-urlencoded"; $postFields = "AccountType=HOSTED_OR_GOOGLE&Email=".urlencode($gcUname)."&Passwd="; $postFields .= urlencode($gcPword)."&source=Spanning-AppExSync-1&service=cl"; if(strlen($loginToken) && strlen($loginCaptcha)) { $postFields .= "&logintoken=".$loginToken."&logincaptcha=".$loginCaptcha; } $ch = curl_init("https://www.google.com/accounts/ClientLogin"); curl_setopt($ch, CURLOPT_HTTPHEADER, $header); curl_setopt($ch, CURLOPT_HEADER, 1); // include the header in the output curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // store the output in a variable curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields); $tmp = curl_exec($ch); curl_close($ch); // parse the response and check for authentication success/failure $theResponse = $this->parse_response($tmp); switch($theResponse["code"]) { case "200": // success break; case "403": $this->handleBadLoginResponse($theResponse["body"]); break; default: $msg = "Unrecognized response status code on attempted Google Calendar authentication. "; $msg .= "Status code: ".$theResponse["code"]." "; $msg .= "Body: ".$theResponse["body"]." "; failWithError($msg); } 31

Slide 32: Login Sample Code (Part 2 of 3) // extract authorization token $ret = $theResponse["body"]; if(ereg("Auth=(.*) ",$ret,$regs)) { $this->authToken = $regs[1]; // authenticaion token } else { failWithError("Authorization token not found in response from Google Calendar. "); } // make subsequent (authenticated) request to Calendar $ch = curl_init("http://www.google.com/calendar/feeds/default/private/full"); unset($header); $header[] = "Authorization: GoogleLogin auth=".$this->authToken; $header[] = "Content-type: application/atom+xml"; curl_setopt($ch, CURLOPT_HTTPHEADER, $header); curl_setopt($ch, CURLOPT_HEADER, 1); // include the header in the output curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // store the output in a variable curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); // DON'T follow the (expected) redirect $tmp = curl_exec($ch); curl_close($ch); // parse the response and check for authentication success/failure $theResponse = $this->parse_response($tmp); switch($theResponse["code"]) { case "302": // success break; default: $msg = "Unrecognized response status code (not 302) on authenticated request to Google Calendar. "; $msg .= "Status code: ".$theResponse["code"]." "; $msg .= "Body: ".$theResponse["body"]." "; failWithError($msg); } 32

Slide 33: Login Sample Code (Part 3 of 3) // extract session id $ret = $theResponse["header"]["Location"]; if(ereg("([^?]*).*gsessionid=(.*) ",$ret,$regs)) { $this->sessionID = $regs[2]; // authentication token $this->feedURL = $regs[1]; // feed URL } else { failWithError("Session ID not found in response from Google Calendar."); } debug("Connected to Google and authenticated."); } ?> 33