Trying to automate some package installs via Apex using the Metadata API.

When you install a package via the UI you get asked who to install for (Defaults to Admins Only):

enter image description here

Is there any way to specify "All Users" when performing via the Metadata API? I couldn't seem to find mention of it in the documentation..

Current XML being used to install a package (portions redacted)

<?xml version="1.0" encoding="UTF-8"?>
    <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <urn:SessionHeader xmlns:urn="http://soap.sforce.com/2006/04/metadata">
            <createMetadata xmlns="http://soap.sforce.com/2006/04/metadata">
                <metadata xsi:type="InstalledPackage">

Seems a big oversight to have not included the ability to set this as setting to Admins only by default causes issues....at least for me

  • Ugh, I can't get into the Org62 SalesforceDX pilot chatter group at the moment, but I'm wondering if that is something they've addressed there. That said, if the Metadata API doesn't support more than password and versionNumber on InstalledPackage then there aren't many more options. Maybe it's an extra post install step SF are performing. Commented Jun 2, 2017 at 1:40
  • @DanielBallinger - Possibly. Maybe I should ask there...Since it was not Dx related I did not want to impose.....Wish they would have thought the InstalledPackage through or maybe it is coming . Or is it just me that finds the Admin Only default a problem....I can deal with not being able to do profiles. Guess I am going to just open a popup with the install using the Identity Org Urls after authentication and check for popup being closed. Not perfect but it will work
    – Eric
    Commented Jun 2, 2017 at 1:42
  • The more I think about it, the more I think it is an additional post Metadata API step they are performing. It would be labor intensive, but you could apply the settings outlined in the help docs manually (with more API calls). Install a Package Commented Jun 2, 2017 at 1:45
  • @DanielBallinger - Yea, no way I am going through that trouble for almost 1K pieces of metadata and 4 packages....I'll just popup a new window with the install url for their org as the location and let them click through then close window. If you feel confident that it is currently not possible please post as an answer and I will just close this out.
    – Eric
    Commented Jun 2, 2017 at 1:47

2 Answers 2


I'm 90% certain it isn't currently possible based on the limited options with InstalledPackage. There just isn't anywhere to specify anything beyond password and versionNumber.

Nor are there any headers that appear to apply.

There are details in Install a Package that cover the steps each option does around permissions. E.g. Object permissions, Field-level security, enabling Apex classes, Visualforce pages, etc... It would in theory be possible to automate all of this, but still potentially labor intensive and will burn a number of API calls.

I'd be happy to be be proven wrong on the missing functionality.

  • 1
    Thanks for confirming my suspicions. One day it will be an option. Most likely at the same time the provide it for push upgrades from the LMA which needs it as well.
    – Eric
    Commented Jun 2, 2017 at 2:01
  • Have you raised a corresponding idea? I'd vote for it :) Commented Jun 2, 2017 at 2:02
  • 1
    No. Unfortunately my opinion of their usefulness well...lets just leave it at that.
    – Eric
    Commented Jun 2, 2017 at 2:06
  • Looks like this still isn't possible. We're trying to automate our push upgrades process; but will have to live with the install center option it looks like
    – CodeMad
    Commented Jul 29, 2020 at 13:41

This is possible in both the Metadata and Tooling APIs, but it's mostly undocumented and could change. The key is a parameter Security Type, which has the following permissible values:

"FULL"    // All profiles, the default
"CUSTOM"  // Custom profiles
"NONE"    // System Administrator only
"PUSH"    // No profiles, supported in Metadata API only

Metadata API

In the Metadata API, the Security Type field is a securityType element inside InstalledPackage:

<?xml version="1.0" encoding="UTF-8"?>
<InstalledPackage xmlns="http://soap.sforce.com/2006/04/metadata">

Note that this is undocumented (see InstalledPackage) and could therefore change at any time.

Tooling API

In the Tooling API, the Security Type parameter is represented by the SecurityType field on PackageInstallRequest. Note that "PUSH" (add to no profiles) is not supported by the Tooling API.

See PackageInstallRequest for documentation.

  • This is the correct answer. The APIs have also been updated, and Security Type is documented for both, although the values are different from what is currently in this answer. InstalledPackage from Metadata API allows values for securityType of "AdminsOnly" or AllUsers" for first-generation packages. PackageInstallRequest from Tooling API allows values for SecurityType of "Custom" (custom profiles), "Full" (all users), or "None" (admins only) for first- or second-generation packages.
    – Zosoled
    Commented May 16, 2023 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .