{"id":395,"date":"2025-11-10T18:46:04","date_gmt":"2025-11-10T18:46:04","guid":{"rendered":"https:\/\/blog.coffee.ai\/security-and-compliance-requirements-ai-crm-for-sales\/"},"modified":"2026-06-24T05:06:02","modified_gmt":"2026-06-24T05:06:02","slug":"security-and-compliance-requirements-ai-crm-for-sales","status":"publish","type":"post","link":"https:\/\/www.coffee.ai\/articles\/security-and-compliance-requirements-ai-crm-for-sales","title":{"rendered":"Security &amp; Compliance for Automating Salesforce Data Entry"},"content":{"rendered":"<p><em>Written by: Doug Camplejohn, CEO &amp; Co-Founder, Coffee | Last updated: June 21, 2026<\/em><\/p>\n<h2 id=\"key-takeaways\">Key Takeaways<\/h2>\n<ul>\n<li>Manual Salesforce data entry creates compliance risks, and AI agents reduce human error when you use least-privilege integration accounts and OAuth authentication.<\/li>\n<li>Least-privilege object and field security, combined with MFA and short-lived JWT tokens, prevents privilege escalation and limits exposure for AI agents.<\/li>\n<li>Comprehensive audit trails, SIEM integration, and immutable logs with 2-year retention satisfy GDPR, SOC 2, and HIPAA requirements for traceable AI activity.<\/li>\n<li>Encryption standards (AES-256 at rest, TLS 1.3 in transit), zero-training contractual clauses, and verified vendor compliance certifications protect customer data throughout the AI workflow.<\/li>\n<li>Explore how Coffee delivers these native security and compliance controls for Salesforce automation on <a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\">Coffee&#8217;s pricing page<\/a>.<\/li>\n<\/ul>\n<h2>1. Dedicated Integration Accounts for AI Agents<\/h2>\n<p><strong>Configuration steps:<\/strong> In Salesforce Setup, create a new user with the profile type \u201cSalesforce Integration\u201d and assign a custom permission set rather than a standard profile. Disable UI login so the account functions only as a non-human integration identity. The permission-set JSON baseline below grants read and edit access where needed, while blocking delete and view-all permissions to keep the agent tightly scoped:<\/p>\n<pre> { \"label\": \"Coffee_Agent_Integration\", \"userLicense\": \"Salesforce Integration\", \"objectPermissions\": [ {\"object\": \"Contact\", \"allowRead\": true, \"allowCreate\": true, \"allowEdit\": true, \"allowDelete\": false}, {\"object\": \"Opportunity\", \"allowRead\": true, \"allowCreate\": false, \"allowEdit\": true, \"allowDelete\": false} ], \"userPermissions\": [ {\"name\": \"ApiEnabled\", \"enabled\": true}, {\"name\": \"ViewAllData\", \"enabled\": false} ] } <\/pre>\n<p>Set a named credential in Setup \u2192 Security \u2192 Named Credentials to store the OAuth token, and avoid embedding credentials in configuration files.<\/p>\n<p><strong>Coffee implementation:<\/strong> Coffee&#8217;s Companion App authenticates to Salesforce through a single OAuth handshake tied to a dedicated integration identity. No shared admin credentials are used, and the agent\u2019s Salesforce user is provisioned only with the objects and fields Coffee needs to write enriched contact, activity, and opportunity data.<\/p>\n<p><em>Coffee satisfies this control natively because its authentication model is built around non-human identity from day one, so admins do not need extra configuration.<\/em><\/p>\n<h2>2. Least-Privilege Object and Field Security in Salesforce<\/h2>\n<p><strong>Configuration steps:<\/strong> Use Field-Level Security (FLS) within the permission set to restrict sensitive fields. <a href=\"https:\/\/synebo.io\/blog\/salesforce-ai-security-in-ai-driven-orgs\" target=\"_blank\" rel=\"noindex nofollow\">Salesforce AI agents like Agentforce may access sensitive fields beyond their intended scope, creating opportunities for privilege escalation or data leakage<\/a>. Scope FLS explicitly so the agent can only touch the data it truly needs:<\/p>\n<pre> { \"fieldPermissions\": [ {\"field\": \"Contact.SSN__c\", \"readable\": false, \"editable\": false}, {\"field\": \"Contact.HomePhone\", \"readable\": false, \"editable\": false}, {\"field\": \"Contact.Email\", \"readable\": true, \"editable\": true}, {\"field\": \"Opportunity.Amount\", \"readable\": true, \"editable\": true} ] } <\/pre>\n<p>The effective permission set for an AI agent should be the intersection of user-level and service-level permissions, with sensitive fields redacted before output and the redaction event logged.<\/p>\n<p><strong>Coffee implementation:<\/strong> Coffee writes only to the fields required for contact enrichment, activity logging, and opportunity updates. Fields outside that scope are never read or written by the agent.<\/p>\n<p><em>Coffee satisfies this control natively because its field-access model is scoped at the product level, not left to admin discretion during setup.<\/em><\/p>\n<p><a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\">Get started with Coffee and see how least-privilege Salesforce automation works in practice.<\/a><\/p>\n<h2>3. MFA and OAuth Controls for Agent Access<\/h2>\n<p><strong>Configuration steps:<\/strong> Enable \u201cHigh Assurance\u201d session security for the integration profile under Setup \u2192 Session Settings. Use the OAuth 2.0 JWT Bearer Flow for server-to-server authentication so no interactive login is required. Rotate the private key every 90 days. Session expiration after 15 minutes of inactivity and re-authentication for high-risk actions limits overbroad standing access for automated agents.<\/p>\n<pre> { \"oauthPolicy\": { \"flow\": \"jwt_bearer\", \"tokenExpiry\": 900, \"keyRotationDays\": 90, \"ipRestrictions\": [\"203.0.113.0\/24\"] } } <\/pre>\n<p><strong>Coffee implementation:<\/strong> Coffee uses the JWT Bearer Flow with IP allowlisting scoped to Coffee\u2019s infrastructure. Tokens expire and rotate automatically, and no long-lived credentials persist.<\/p>\n<p><em>Coffee satisfies this control natively because its OAuth implementation enforces short-lived tokens and key rotation without requiring a separate identity provider.<\/em><\/p>\n<h2>Recommended Architecture for Secure Salesforce Automation<\/h2>\n<p>The diagram below illustrates three critical security boundaries in a compliant AI agent architecture: OAuth JWT Bearer authentication removes standing credentials, the data warehouse layer enforces encryption at rest before any Salesforce write occurs, and all agent activity flows into an immutable SIEM log for audit compliance.<\/p>\n<pre> [Sales Rep \/ Email \/ Calendar] \u2502 \u25bc [Coffee Agent (OAuth JWT Bearer)] \u2502 \u2190 TLS 1.3 in transit \u25bc [Coffee Data Warehouse (AES-256 at rest)] \u2502 \u251c\u2500\u2500\u25ba [Salesforce CRM via Named Credential] \u2502 \u2514\u2500\u2500 FLS-scoped writes only \u2502 \u2514\u2500\u2500\u25ba [SIEM \/ Event Monitoring Stream] \u2514\u2500\u2500 Immutable audit log (2-yr retention) <\/pre>\n<p>TLS 1.3 for data in transit and AES-256 for data at rest are the recommended encryption baselines, with credentials stored in a secrets manager rather than configuration files.<\/p>\n<h2>4. Audit Trails, Event Monitoring, and SIEM Integration<\/h2>\n<p><strong>Configuration steps:<\/strong> Enable Salesforce Event Monitoring (add-on license) under Setup \u2192 Event Manager. Stream the following event types to your SIEM: LoginEvent, ApiEvent, FieldHistoryEvent, and ReportEvent. <a href=\"https:\/\/synebo.io\/blog\/salesforce-ai-security-in-ai-driven-orgs\" target=\"_blank\" rel=\"noindex nofollow\">Tracking API calls, AI-agent activity, and irregular data access trends, then incorporating logs deeply into SIEM platforms, produces traceable audit records.<\/a><\/p>\n<pre> { \"eventMonitoring\": { \"enabledEvents\": [\"LoginEvent\",\"ApiEvent\",\"FieldHistoryEvent\",\"ReportEvent\"], \"storageRetentionDays\": 730, \"siemForward\": true, \"siemEndpoint\": \"https:\/\/siem.yourcompany.com\/sf-events\" } } <\/pre>\n<p>Immutable, structured audit logs must contain user_id, timestamp, query text, tools_called, data_accessed, output_summary, and pii_redacted fields, stored separately from the agent with at least 2-year retention for GDPR compliance.<\/p>\n<p><strong>Coffee implementation:<\/strong> Every write Coffee makes to Salesforce is logged with a structured payload that includes the Coffee agent session ID, the Salesforce record modified, the field changed, and a timestamp. These logs can be forwarded to the customer\u2019s SIEM on request.<\/p>\n<p><em>Coffee satisfies this control natively because its internal audit architecture mirrors the immutable log schema required by GDPR and SOC 2 without a separate logging bolt-on.<\/em><\/p>\n<h2>5. Encryption Standards and Salesforce Shield<\/h2>\n<p><strong>Configuration steps:<\/strong> Enable Salesforce Shield Platform Encryption under Setup \u2192 Platform Encryption. <a href=\"https:\/\/vantagepoint.io\/blog\/sf\/blog\/insights\/data-privacy-2026-business-leaders-guide\" target=\"_blank\" rel=\"noindex nofollow\">Salesforce Shield provides field-level encryption, event monitoring, and platform encryption integrated with the Hyperforce architecture for PCI DSS, HIPAA, and GDPR compliance.<\/a> Encrypt the following field types at minimum: Email, Phone, custom PII fields, and any field tagged as PHI.<\/p>\n<pre> { \"shieldEncryption\": { \"encryptedFields\": [\"Contact.Email\",\"Contact.Phone\",\"Contact.SSN__c\"], \"keyManagement\": \"Salesforce_BYOK\", \"keyRotationDays\": 90, \"deterministicEncryption\": false } } <\/pre>\n<p><strong>Coffee implementation:<\/strong> Coffee\u2019s data warehouse encrypts all stored data with AES-256 at rest and transmits data to Salesforce exclusively over TLS 1.3. Coffee does not cache unencrypted PII outside the active agent session.<\/p>\n<p><em>Coffee satisfies this control natively because its encryption posture meets the AES-256 \/ TLS 1.3 baseline required by HIPAA and GDPR without Shield being a prerequisite for Coffee\u2019s own data handling.<\/em><\/p>\n<p>Encryption protects data in transit and at rest, but it does not stop a vendor from using that data to train AI models once decrypted for processing. The next control addresses this risk directly.<\/p>\n<h2>6. Zero-Training AI Clauses and PII Ingestion Controls<\/h2>\n<p><strong>Configuration steps:<\/strong> Before connecting any AI vendor to Salesforce, require a contractual zero-training clause, a written commitment that customer data is never used to train, fine-tune, or improve the vendor\u2019s models. <a href=\"https:\/\/transcend.io\/blog\/the-best-tools-for-managing-ai-data-privacy-risks-in-2026\" target=\"_blank\" rel=\"noindex nofollow\">Enterprise buyers are making Do Not Train compliance and verifiable data deletion conditions of doing business with AI vendors in 2026.<\/a> At the Salesforce level, implement a pre-ingestion PII filter:<\/p>\n<pre> { \"piiIngestionPolicy\": { \"scanBeforeWrite\": true, \"blockedPatterns\": [\"SSN\",\"passport_number\",\"credit_card\"], \"onDetection\": \"redact_and_log\", \"retentionDays\": 365 } } <\/pre>\n<p><a href=\"https:\/\/blackthorn-vision.com\/blog\/ai-in-data-governance\" target=\"_blank\" rel=\"noindex nofollow\">Organizations should adopt a metadata tagging standard at ingestion so every dataset carries structured metadata including source, timestamp, owner, consent status, and retention classification.<\/a><\/p>\n<p><strong>Coffee implementation:<\/strong> Coffee is contractually committed to a zero-training policy, so customer data is never used to train public or shared models. <a href=\"https:\/\/www.coffee.ai\/changelog\" target=\"_blank\">Coffee completed SOC 2 Type II re-certification in January 2026<\/a>, which independently verifies these data handling commitments.<\/p>\n<p><em>Coffee satisfies this control natively because its zero-training commitment is a product-level architectural decision, not a configurable toggle.<\/em><\/p>\n<p><a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\">Get started with Coffee and review Coffee\u2019s zero-training and SOC 2 posture before your next vendor review.<\/a><\/p>\n<h2>7. SOC 2 Type II, GDPR, and HIPAA Vendor Verification<\/h2>\n<p><strong>Configuration steps:<\/strong> Before granting any AI agent API access to Salesforce, collect and verify a current SOC 2 Type II report (issued within 12 months), a signed GDPR Data Processing Agreement, a HIPAA Business Associate Agreement if PHI is in scope, and evidence of annual third-party penetration testing. <a href=\"https:\/\/technovapartners.com\/en\/insights\/security-gdpr-enterprise-ai-agents\" target=\"_blank\" rel=\"noindex nofollow\">SOC 2 Type II verifies that controls operate effectively over a minimum 6-month period across the five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.<\/a><\/p>\n<pre> { \"vendorVerification\": { \"soc2TypeII\": {\"required\": true, \"maxAgeMonths\": 12}, \"gdprDPA\": {\"required\": true}, \"hipaaBaa\": {\"required\": \"if_phi_in_scope\"}, \"penTest\": {\"required\": true, \"frequencyMonths\": 12}, \"dataResidencyOptions\": {\"required\": true} } } <\/pre>\n<p><a href=\"https:\/\/fin.ai\/learn\/hipaa-gdpr-compliant-ai-agents\" target=\"_blank\" rel=\"noindex nofollow\">HIPAA and GDPR compliance evaluations for AI agents commonly require verification of SOC 2 Type II certification, regular third-party penetration testing, data residency options, zero-retention agreements with LLM providers, and explicit confirmation that customer data is never used for model training.<\/a><\/p>\n<p><strong>Coffee implementation:<\/strong> As noted earlier, Coffee\u2019s SOC 2 Type II certification, re-certified in January 2026, provides independent verification of these controls. Coffee is also GDPR compliant and provides a Data Processing Agreement on request.<\/p>\n<p><em>Coffee satisfies this control natively because its compliance certifications are current, independently audited, and available without a custom enterprise negotiation.<\/em><\/p>\n<h2>8. Consent Management and Data 360 Handling<\/h2>\n<p><strong>Configuration steps:<\/strong> Map every personal data field in Salesforce to a consent basis (legitimate interest, explicit consent, or contractual necessity) using a custom Consent__c object. Implement bidirectional sync so that a deletion or opt-out in any connected system propagates to Salesforce within 72 hours. <a href=\"https:\/\/technovapartners.com\/en\/insights\/security-gdpr-enterprise-ai-agents\" target=\"_blank\" rel=\"noindex nofollow\">GDPR\u2019s accuracy principle requires bidirectional synchronization so that changes in the CRM are reflected in the agent and vice versa, as outdated data violates the principle.<\/a><\/p>\n<pre> { \"consentManagement\": { \"consentObject\": \"Consent__c\", \"fields\": [\"LegalBasis__c\",\"ConsentDate__c\",\"ExpiryDate__c\",\"DataSubjectRights__c\"], \"deletionPropagationHours\": 72, \"dsrAutomation\": true } } <\/pre>\n<p><a href=\"https:\/\/technovapartners.com\/en\/insights\/security-gdpr-enterprise-ai-agents\" target=\"_blank\" rel=\"noindex nofollow\">The three most frequent GDPR compliance vulnerabilities in AI agent audits are absence of explicit informed consent (47% of cases), indefinite storage without a defined retention policy (39%), and absence of mechanisms to exercise GDPR rights such as erasure or portability (31%).<\/a><\/p>\n<p><strong>Coffee implementation:<\/strong> Coffee\u2019s agent respects deletion and opt-out signals propagated from Salesforce and does not retain contact data beyond the active enrichment session. Retention periods are configurable per customer data processing agreement.<\/p>\n<p><em>Coffee satisfies this control natively because its data lifecycle model is designed around consent-basis processing, not bulk data retention.<\/em><\/p>\n<h2>Common Mistakes to Avoid with AI Salesforce Integrations<\/h2>\n<ul>\n<li><strong>Using an admin account as the integration user.<\/strong> <a href=\"https:\/\/synebo.io\/blog\/salesforce-ai-security-in-ai-driven-orgs\" target=\"_blank\" rel=\"noindex nofollow\">98% of environments contain unverified apps<\/a>, many connected with over-privileged credentials that were never rotated.<\/li>\n<li><strong>Skipping Field-Level Security on the integration permission set.<\/strong> Object-level access without FLS leaves sensitive fields readable by the agent even when the use case does not require them.<\/li>\n<li><strong>Storing OAuth tokens in environment variables or config files.<\/strong> Use a secrets manager. Credentials stored outside a secrets manager are a leading cause of token exfiltration in SaaS breaches.<\/li>\n<li><strong>Enabling Event Monitoring but not forwarding to a SIEM.<\/strong> Logs that stay inside Salesforce are not actionable for incident response and do not satisfy most SOC 2 or HIPAA audit evidence requirements.<\/li>\n<li><strong>Accepting a vendor\u2019s verbal zero-training assurance.<\/strong> <a href=\"https:\/\/transcend.io\/blog\/the-best-tools-for-managing-ai-data-privacy-risks-in-2026\" target=\"_blank\" rel=\"noindex nofollow\">Effective Do Not Train controls exclude data from training pipelines at the system level<\/a>, so require this in writing and verify it in the SOC 2 report.<\/li>\n<li><strong>Not configuring session expiration for the integration user.<\/strong> Session expiration after 15 minutes of inactivity is a recommended baseline that most admins leave at the Salesforce default of 2 hours.<\/li>\n<li><strong>Treating consent as a one-time checkbox.<\/strong> GDPR requires ongoing bidirectional sync, so a deletion request processed in your marketing platform must propagate to Salesforce within 72 hours.<\/li>\n<\/ul>\n<h2>Vendor Security Questionnaire Template<\/h2>\n<p>Use this questionnaire during vendor evaluation to confirm that an AI agent meets the security baseline described in this guide. The \u201cExpected Answer\u201d column defines the minimum acceptable response, and the \u201cCoffee\u2019s Answer\u201d column shows how Coffee satisfies each control natively.<\/p>\n<table>\n<thead>\n<tr>\n<th>Control Area<\/th>\n<th>Question<\/th>\n<th>Expected Answer<\/th>\n<th>Coffee&#8217;s Answer<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Certification<\/td>\n<td>Do you hold a current SOC 2 Type II report (issued within 12 months)?<\/td>\n<td>Yes, with report available under NDA<\/td>\n<td>Yes \u2014 re-certified January 2026<\/td>\n<\/tr>\n<tr>\n<td>Data Training<\/td>\n<td>Is customer data used to train, fine-tune, or improve your models?<\/td>\n<td>No, with contractual zero-training clause<\/td>\n<td>No \u2014 contractual commitment, not a toggle<\/td>\n<\/tr>\n<tr>\n<td>Encryption<\/td>\n<td>What encryption standards apply to data at rest and in transit?<\/td>\n<td>AES-256 at rest; TLS 1.3 in transit<\/td>\n<td>AES-256 at rest; TLS 1.3 in transit<\/td>\n<\/tr>\n<tr>\n<td>Access Model<\/td>\n<td>Does the agent use a dedicated, least-privilege Salesforce integration user?<\/td>\n<td>Yes, with permission-set JSON available<\/td>\n<td>Yes \u2014 scoped OAuth, no admin credentials<\/td>\n<\/tr>\n<tr>\n<td>Audit Logging<\/td>\n<td>Are agent actions logged with structured, immutable records?<\/td>\n<td>Yes, with 2-year minimum retention<\/td>\n<td>Yes \u2014 SIEM-forwardable structured logs<\/td>\n<\/tr>\n<tr>\n<td>GDPR \/ HIPAA<\/td>\n<td>Do you provide a signed DPA and BAA on request?<\/td>\n<td>Yes, without enterprise-tier requirement<\/td>\n<td>Yes \u2014 available on request<\/td>\n<\/tr>\n<tr>\n<td>Pen Testing<\/td>\n<td>How frequently is third-party penetration testing conducted?<\/td>\n<td>Annually at minimum<\/td>\n<td>Annually<\/td>\n<\/tr>\n<tr>\n<td>Data Residency<\/td>\n<td>Can data processing be restricted to a specific geographic region?<\/td>\n<td>Yes, with documented options<\/td>\n<td>Available \u2014 confirm scope with Coffee team<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Frequently Asked Questions<\/h2>\n<h3>How deeply does Coffee integrate with Salesforce compared to generic AI automation tools?<\/h3>\n<p>Coffee\u2019s Companion App is purpose-built for Salesforce\u2019s data model, including required fields, validation rules, record types, opportunity stages, and forecasting categories. Generic automation platforms treat Salesforce as one of hundreds of connected apps and lack awareness of CRM-specific constructs like quotas, pipeline stages, and custom object relationships. Coffee writes enriched contact, activity, and opportunity data back to Salesforce in a way that respects existing field dependencies and avoids validation rule failures, which are common with tools that lack deep CRM integration knowledge.<\/p>\n<h3>Where is my Salesforce data processed and stored by Coffee?<\/h3>\n<p>Coffee processes data between your communication tools (email, calendar, call transcripts) and Salesforce. Data at rest is encrypted with AES-256, and data in transit uses TLS 1.3. For customers with specific data residency requirements under GDPR or state privacy laws, Coffee\u2019s team can confirm available processing regions during onboarding. Coffee\u2019s zero-training policy ensures no customer data enters any shared or public model training pipeline.<\/p>\n<h3>What does Coffee\u2019s pricing model look like, and are compliance features gated behind higher tiers?<\/h3>\n<p>Coffee uses straightforward seat-based pricing, so you pay for human seats and the agent\u2019s work is included without metering on API calls, LLM usage, or automated processes. Security and compliance capabilities, including the SOC 2 Type II posture, zero-training data handling, and OAuth-based Salesforce integration, are architectural properties of the product rather than add-on features. There is no separate \u201centerprise security tier\u201d required to access the controls described in this guide. Full pricing details are available on <a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\">Coffee&#8217;s pricing page<\/a>.<\/p>\n<h2>Conclusion<\/h2>\n<p>Every control in this guide, including dedicated integration accounts, least-privilege FLS, OAuth with key rotation, Event Monitoring forwarded to a SIEM, AES-256 Shield encryption, zero-training clauses, SOC 2 \/ GDPR \/ HIPAA vendor verification, and consent-basis data handling, maps directly to a native capability in Coffee\u2019s Companion App for Salesforce. <a href=\"https:\/\/pkware.com\/blog\/2026-data-breaches\" target=\"_blank\" rel=\"noindex nofollow\">The 2026 breach landscape, where social engineering of a single employee credential was enough to exfiltrate tens of millions of Salesforce records<\/a>, makes over-privileged AI agent access an unacceptable risk. Coffee\u2019s agent architecture is designed from the ground up to satisfy every one of these controls without bolt-ons, custom middleware, or a dedicated security engineering project.<\/p>\n<p>RevOps leaders and Salesforce admins who need to close compliance gaps while eliminating manual data entry gain a single architecture that satisfies both requirements at the same time.<\/p>\n<p><a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\">Get started with Coffee and bring every control in this guide live on your Salesforce instance.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Protect your CRM with Coffee&#8217;s AI Salesforce automation. SOC 2, GDPR &amp; HIPAA-ready with zero-training clauses, TLS 1.3, and least-privilege access.<\/p>\n","protected":false},"author":11,"featured_media":1445,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-395","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/comments?post=395"}],"version-history":[{"count":5,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/395\/revisions"}],"predecessor-version":[{"id":7892,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/395\/revisions\/7892"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/media\/1445"}],"wp:attachment":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/media?parent=395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/categories?post=395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/tags?post=395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}