We are going to code apex web service and distribute it to our clients for them to access.

The web service will take an input from the client to retrieve relevant data for each of them.

In this case, what are the best practices for the sharing settings(OWD's)? Should it be the most permissive or it doesn't matter as the web service is retrieving the data depending on the input from the client and will, therefore, can retrieve only their data?

This knowledge article https://help.salesforce.com/articleView?id=000176281&type=1 suggests having the most permissive access(ModifyAllData) to the integration user.

Your thoughts, please.

  • 1
    I don't think that article applies to you. An Integration User is a user that you create to integrate an application with Salesforce. For example, if you wanted to integrate Oracle and Salesforce, you might use a single integration user, which we'd call a proxy, to manage the data flow between both systems. Typically, if you're giving access to real users, they should each have their own username/password/user account (also, required by the MSA).
    – sfdcfox
    May 1, 2017 at 2:48
  • good catch sfdcfox! You might be right! I would want my users to have access to SF with their username/pwds and they are really not integration users. Thank you, it cleared the clouds, the terminology one's :)
    – SF Learner
    May 1, 2017 at 3:23

1 Answer 1


You should not change the OWD based on providing the data access only for integration user. OWD is applicable for whole organization's user.

OWD can be 'Private' or 'Public Read Only' based on your requirement and design decision.

Most important part is that, how to provide data access (secure) to integration user, in that case that article is good so far.

Also, I could suggest if the client wants to see the only for view purpose and don't need to perform any DML operation then 'Modify All Data' permission is not needed.

If your OWD is 'Private' and if you are maintaining Role-Hierarchy for record visibility, then you can create a separate role like 'Admin/Integration Role` and assign the user in that role. and define this role at the top most level. So, through the role hierarchy integration user will have visibility of all the data.

If your OWD is 'Public Read Only', then it doesn't depends on the role and integration user will have read only access to all the data.

If you want to provide integration user to perform DML operation then provide him 'Modify All Data' access so that user can perform upsert based on external id.

Modify All Data supersedes all the sharing access.

It is good practice to write a class with sharing.

  • Thanks, @Santanu, it makes sense. There is no mention of using 'with sharing' on that article. Generally speaking, is it a good practice? I know that it would depend on the object model and their sharing settings, but would using 'with sharing' considered a step towards a secure integration?
    – SF Learner
    May 1, 2017 at 2:21
  • Thanks for the answer. What are your thoughts about using 'with sharing' in this context of an integration user where the SOQL query would be based on an input provided by him? It seems unnecessary to me but would appreciate your thoughts, please.
    – SF Learner
    May 1, 2017 at 2:45
  • You can create a separate class and methods for integration and don't use 'with sharing' May 1, 2017 at 2:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .