Migrate from Paradym to Salesforce Sales Cloud

Paradym's credential definition record — containing schema, issuer, and type — maps to a Salesforce custom object we create with Label 'Credential Definition' and API Name Credential_Definition__c. All metadata fields on the Paradym definition become custom fields on this object.

Paradym presentation records are stored as separate API objects but are logically children of credential definitions. We map them as a custom field on Credential_Definition__c — Presentation_JSON__c (Long Text Area) — holding the full presentation payload for reference and audit.

The holder of a Paradym credential is identified by claims in the credential subject. We map the primary holder identifier to a Salesforce Contact record using email or subject ID match. Additional holder claims become custom fields on the Contact record.

The Paradym credential issuer URI maps to an Account record in Salesforce. The Account.Name holds the issuer name; the Website field holds the issuer URI for audit reference. We create one Account per unique issuer across all credential definitions. We also create a custom text field, Issuer_ID__c, to store the Paradym issuer identifier, and link each credential definition to its Account via a lookup relationship for reporting.

Paradigm credentials reference a JSON Schema document by URL. We store this URL as a custom Text field (Schema_Reference_URL__c) on Credential_Definition__c. The schema itself is not migrated as a separate object — it remains a reference URL for re-validation. We also add a custom formula field, Schema_Version__c, to capture schema version details, and maintain a schema registry external object for reference during verification.

The SD-JWT exp claim maps to a custom DateTime field on Credential_Definition__c. Salesforce stores this as Credential_Expiry__c so that reports can surface expired credentials by running DateTime-based filters. We also configure a Salesforce Flow that evaluates Credential_Expiry__c and triggers email alerts when a credential is nearing expiration, helping compliance teams proactively manage renewal workflows.

Paradigm revocation state (revoked / active) maps to a Salesforce custom checkbox field on the credential definition record. We capture the current revocation status at migration time; ongoing revocation tracking requires a post-migration Apex or Flow integration. Additionally, we add a Revocation_Date__c DateTime field to capture when a credential was revoked, and a Revocation_Reason__c text field for recording the cause, enabling detailed audit histories and automated revocation alerts via Apex.

Paradym nested attribute groups (e.g., person.name, person.address) cannot map to standard Salesforce fields because Salesforce uses a flat, relational model. We flatten common attribute groups into separate custom fields (e.g., Person_Name__c, Person_Address__c) or serialize the entire group as a Long Text Area field (Credential_Subject_JSON__c) for reference.

Paradigm presentation records carry their own expiry timestamp. We map this to a custom DateTime field on the presentation custom field set so that Salesforce reports can flag expired presentations without querying the Paradym API. This field, Presentation_Expiry__c, also feeds a scheduled Flow that sends notifications to the holder when a presentation is about to expire, supporting timely renewal.

Paradym verification results (verified / failed / pending) have no native Salesforce equivalent. We create a custom picklist field on Credential_Definition__c to record the last known verification state at migration time. Ongoing verification must be implemented as an Apex callout to the Paradym verification endpoint post-migration.

We store the Paradigm presentation record ID as a custom Text field on the credential definition for traceability. This allows delta-sync runs to match Salesforce records back to Paradigm source records without relying on Salesforce IDs alone. Additionally, the field enables audit queries that cross-reference credential activity in Salesforce with Paradigm event logs.

Paradigm allows different verification methods (e.g., cryptographic proof, presentation exchange). We store this as a custom text field on the credential definition record so that the Salesforce admin can see which verification path was used for each credential. The field also supports reporting on verification method distribution, helping identify trends and ensure appropriate method selection across credential types.