Specify "Install for" when installing package via Metadata API

Question

Trying to automate some package installs via Apex using the Metadata API.

When you install a package via the UI you get asked who to install for (Defaults to Admins Only):

Is there any way to specify "All Users" when performing via the Metadata API? I couldn't seem to find mention of it in the documentation..

Current XML being used to install a package (portions redacted)

<?xml version="1.0" encoding="UTF-8"?>
    <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <env:Header>
            <urn:SessionHeader xmlns:urn="http://soap.sforce.com/2006/04/metadata">
                <urn:sessionId>{sessionId}</urn:sessionId>
            </urn:SessionHeader>
        </env:Header>
        <env:Body>
            <createMetadata xmlns="http://soap.sforce.com/2006/04/metadata">
                <metadata xsi:type="InstalledPackage">
                    <versionNumber>2.4</versionNumber>
                    <fullName>{Namespace}</fullName>
                </metadata>
            </createMetadata>
        </env:Body>
    </env:Envelope>

Seems a big oversight to have not included the ability to set this as setting to Admins only by default causes issues....at least for me

Answer 1

I'm 90% certain it isn't currently possible based on the limited options with InstalledPackage. There just isn't anywhere to specify anything beyond password and versionNumber.

Nor are there any headers that appear to apply.

There are details in Install a Package that cover the steps each option does around permissions. E.g. Object permissions, Field-level security, enabling Apex classes, Visualforce pages, etc... It would in theory be possible to automate all of this, but still potentially labor intensive and will burn a number of API calls.

I'd be happy to be be proven wrong on the missing functionality.

Answer 2

This is possible in both the Metadata and Tooling APIs, but it's mostly undocumented and could change. The key is a parameter Security Type, which has the following permissible values:

"FULL"    // All profiles, the default
"CUSTOM"  // Custom profiles
"NONE"    // System Administrator only
"PUSH"    // No profiles, supported in Metadata API only

Metadata API

In the Metadata API, the Security Type field is a securityType element inside InstalledPackage:

<?xml version="1.0" encoding="UTF-8"?>
<InstalledPackage xmlns="http://soap.sforce.com/2006/04/metadata">
  <versionNumber>3.211</versionNumber>
  <securityType>PUSH</securityType>
</InstalledPackage>

Note that this is undocumented (see InstalledPackage) and could therefore change at any time.

Tooling API

In the Tooling API, the Security Type parameter is represented by the SecurityType field on PackageInstallRequest. Note that "PUSH" (add to no profiles) is not supported by the Tooling API.

See PackageInstallRequest for documentation.