I'm trying to use the Tooling REST API to create a new CustomField and then add it to certain Profile and PermissionSet metadata with read/edit access appropriate to those profiles / permissionsets. Creating the field itself is straightforward, but I haven't been able to successfully retrieve or manipulate the field-level access for my newly created fields.

I can accomplish this same task using the Metadata API by accessing ProfileFieldLevelSecurity and PermissionSetFieldPermissions respectively, but I'm wondering if it's possible to do the same thing using the Tooling API (which is presumably faster).

I can retrieve MyPermissionSet using this SOQL query on the /query endpoint, but it doesn't include field level permissions:


Similar SOQL queries over the Tooling API to fetch PermissionSetFieldPermissions or ProfileFieldLevelSecurity return with an error saying those objects are not supported.

Is it possible to update field-level security over the Tooling API? If so, what would an example request look like? Thanks.

3 Answers 3


The objects you're looking for are UserEntityAccess and UserFieldAccess, for object security and field security, respectively. Unfortunately, it appears that these tables are read-only, so you're still stuck with using the Metadata API, as far as I can tell.

Edit: You can now Create, Read, Update, and Delete FieldPermissions via the REST API, (note: not the Tooling API, just the normal REST API), so it is possible to automate this process as a separate step after using the Tooling API to create the field.


It is possible to add field to permission set with FieldPermissions (if your permission set isn't from managed package, of course):

insert new FieldPermissions(
        ParentId = '0PS...', //permission set ID
        SobjectType = SObjectType.Account.getName(), //your object here
        Field = SObjectType.Account.getName() + '.' + Account.Type.getDescribe().getName(), //your object.field here
        PermissionsRead = true,
        PermissionsEdit = false 

How to use this code through Tooling API: Execute Anonymous Apex.

Lots of gratitude goes to @sfdcfox, who pointed out, that Profile is now represented by PermissionSet with IsOwnedByProfile = TRUE. So you can retrieve PermissionSet.Id that represents necessary profile with this query:

SELECT Id FROM PermissionSet WHERE Profile.Name = 'PROFILE_NAME'

... and set that Id to FieldPermissions.

  • 1
    +1 but know this: the profiles are also exposed as Permission Sets (with IsOwnedByProfile=true), so you can indeed update profiles now. This is a relatively new feature, if I recall, I couldn't find this 3 years ago when my answer existed.
    – sfdcfox
    Commented Dec 2, 2021 at 21:08
  • Wow, that really is cool! I'll try it and update my answer with related code snippets. Commented Dec 2, 2021 at 21:10
  • Yeah, I also edited my answer, you can now use the REST API to manipulate FieldPermissions as well.
    – sfdcfox
    Commented Dec 2, 2021 at 21:21

Turns out setting required to true when creating the field will also set the visibility to true, so this kinda works but you just need to make sure when updating an account you always post this field.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .