1

My requirement is to make the API calls from any third party app to salesforce using OAuth2.0

So, I created "Connected App" within Salesforce and from the generated "Consumer Key" and "Consumer Secret", I am making the calls from POSTMAN to Salesforce using OAuth2.0 authorization. And I have created two Rest APIs within Salesforce which will execute the calls and will send the data as response.

But my problem is, I would like to make the API calls only for REST API. I knew that there are some standard API calls within Salesforce to retrieve the data like

https://{domain}/services/data/v40.0/sobjects/Account/{ID}

But I would like to restrict all other API calls except the calls which are having "/apexrest/" within the URL.

Is it possible to do like this? Please advice.

Improve this question
1
  • Just curious - why do you want to restrict all other "standard API" calls?
    – SfdcBat
    Oct 9, 2017 at 8:05

1 Answer 1

Reset to default
1

No you can't restrict user to access standard rest/soap endpoint i.e. /services/data/v40.0/sobjects/Account but API that access your organization's Salesforce data are subject to the same security protections that are used in the Salesforce user interface.

It means they will only have access to the objects/records where permission is granted at profile level.

Improve this answer
9
  • Yes, That is the exact issue for me @Himanshu. I don't want to show all the data to that particular user. Only some records need to be shown. And I can't change the OWD or Profile access for a single user. I cannot create n number of profiles and permission sets for n number of users.
    – Subhash
    Oct 9, 2017 at 8:18
  • How you are handling this on UI?
    – Himanshu
    Oct 9, 2017 at 8:26
  • I have made the user as "API Only User". Even the user tries to log in from UI, There it will show as Insufficient privileges and if any tab is clicked, the user will return back to login page automatically.
    – Subhash
    Oct 9, 2017 at 9:01
  • 1
    remove object Read permission to handle your scenario.
    – Himanshu
    Oct 9, 2017 at 9:08
  • 1
    @Subhash You must either change the OWD, or you must remove read access for all the objects. Since data is meant to only be exposed via the API you created, there shouldn't be any problem turning off Read permission for the entire profile.
    – sfdcfox
    Oct 9, 2017 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .