Can I edit field-level security for a profile using REST API?

Question

If so, how? What endpoints to I need to use? Is there any documentation for this function?

If I can't do this through the REST API, is there a client-side API that can do this?

Answer 1

I ended up using the jsForce package to interact with the API. It's roughly as simple as

var conn = new jsforce.Connection({accessToken: getCookie('sid')});

conn.metadata.read('Profile', profile_name, function (err, metadata) {
  if (err) {
    return console.error(err);
  }

  // set the permissions you want in the metadata object

  conn.metadata.update('Profile', metadata, function (err, results) {
    if (err) {
      return console.error(err);
    }

    console.log('Done');
  });
});

Answer 2

You should be able to achieve this using Metadata API. I cannot think of achieving it with any other option. Check this out to get started:How to update field-level-security using Metadata-API via Apex (using MetadataService.cls)

Answer 3

I am developing an application in nodejs using salesforce api. Here I had this issue where I needed to create a field in salesforce with metadata and update filed-level security for profiles for that field. I found the solution from YodaDaCoda's answer. Thanks to him.

using jsforce it is easy process. Here I share my code. profile update does not take more than 10 profiles at a request. So I had to create three request to update 30 types of profiles in a developer edition org. this is an express middleware function.

exports.createExternalIdField = catchAsync(async (req, res, next) => {
  const conn = new jsforce.Connection({
    instanceUrl: req.user.instanceUrl,
    accessToken: req.user.accessToken
  });

  
  const primaryProfiles = [
    { fullName: 'Admin' },
    { fullName: 'Standard' },
    { fullName: 'ReadOnly' },
    { fullName: 'ContractManager' },
    { fullName: 'SolutionManager' },
    { fullName: 'Identity User' },
    { fullName: 'External Identity User' },
    { fullName: 'MarketingProfile' },
    { fullName: 'Force.com - Free User' },
    { fullName: 'Work.com Only User' }
  ];

  const secondaryProfiles = [
    { fullName: 'Customer Community Plus User' },
    { fullName: 'Authenticated Website' },
    { fullName: 'Analytics Cloud Integration User' },
    { fullName: 'Analytics Cloud Security User' },
    { fullName: 'Custom: Marketing Profile' },
    { fullName: 'Custom: Sales Profile' },
    { fullName: 'Custom: Support Profile' },
    { fullName: 'Customer Community Login User' },
    { fullName: 'Customer Community Plus Login User' },
    { fullName: 'StandardAul' }
  ];

  const tertiaryProfiles = [
    { fullName: 'High Volume Customer Portal User' },
    { fullName: 'Customer Community User' },
    { fullName: 'Cross Org Data Proxy User' },
    { fullName: 'Customer Portal Manager Standard' },
    { fullName: 'Customer Portal Manager Custom' },
    { fullName: 'Force.com - App Subscription User' },
    { fullName: 'Partner App Subscription User' },
    { fullName: 'Partner Community Login User' },
    { fullName: 'Partner Community User' },
    { fullName: 'HighVolumePortal' }
  ];

  const fieldPermission = {
    field: `${req.params.object}.ExternalId__c`,
    editable: true,
    readable: true
  };

  // eslint-disable-next-line no-return-assign
  const firstPerm = primaryProfiles.map(el => ({ ...el, fieldPermissions: fieldPermission }));
  // eslint-disable-next-line no-return-assign
  const secondPerm = secondaryProfiles.map(el => ({ ...el, fieldPermissions: fieldPermission }));
  // eslint-disable-next-line no-return-assign
  const thirdPerm = tertiaryProfiles.map(el => ({ ...el, fieldPermissions: fieldPermission }));
  const metadata = [
    {
      fullName: `${req.params.object}.ExternalId__c`,
      label: 'External Id',
      length: 40,
      type: 'Text',
      unique: true,
      externalId: true,
      caseSensitive: true
    }
  ];
  conn.metadata.create('CustomField', metadata, function(err, results) {
    
    if (results.success === false) {
      next();
    }

    if (results.success === true) {
      console.log(results);
      conn.metadata.update('Profile', firstPerm, function(error, firstResults) {
        if (error) {
          return console.error(error);
        }
        console.log(firstResults);
        console.log('Done');
      });

      conn.metadata.update('Profile', secondPerm, function(error, secondResults) {
        if (error) {
          return console.error(error);
        }
        console.log(secondResults);
        console.log('Done');
      });

      conn.metadata.update('Profile', thirdPerm, function(error, thirdResults) {
        if (error) {
          return console.error(error);
        }
        console.log(thirdResults);
        console.log('Done');
        next();
      });
    }
  });

});