1

My requirement is to make the API calls from any third party app to salesforce using OAuth2.0

So, I created "Connected App" within Salesforce and from the generated "Consumer Key" and "Consumer Secret", I am making the calls from POSTMAN to Salesforce using OAuth2.0 authorization. And I have created two Rest APIs within Salesforce which will execute the calls and will send the data as response.

But my problem is, I would like to make the API calls only for REST API. I knew that there are some standard API calls within Salesforce to retrieve the data like

https://{domain}/services/data/v40.0/sobjects/Account/{ID}

But I would like to restrict all other API calls except the calls which are having "/apexrest/" within the URL.

Is it possible to do like this? Please advice.

  • Just curious - why do you want to restrict all other "standard API" calls? – SfdcBat Oct 9 '17 at 8:05
1

No you can't restrict user to access standard rest/soap endpoint i.e. /services/data/v40.0/sobjects/Account but API that access your organization's Salesforce data are subject to the same security protections that are used in the Salesforce user interface.

It means they will only have access to the objects/records where permission is granted at profile level.

  • Yes, That is the exact issue for me @Himanshu. I don't want to show all the data to that particular user. Only some records need to be shown. And I can't change the OWD or Profile access for a single user. I cannot create n number of profiles and permission sets for n number of users. – Subhash Oct 9 '17 at 8:18
  • How you are handling this on UI? – Himanshu Oct 9 '17 at 8:26
  • I have made the user as "API Only User". Even the user tries to log in from UI, There it will show as Insufficient privileges and if any tab is clicked, the user will return back to login page automatically. – Subhash Oct 9 '17 at 9:01
  • 1
    remove object Read permission to handle your scenario. – Himanshu Oct 9 '17 at 9:08
  • 1
    @Subhash You must either change the OWD, or you must remove read access for all the objects. Since data is meant to only be exposed via the API you created, there shouldn't be any problem turning off Read permission for the entire profile. – sfdcfox Oct 9 '17 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.