We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. A custom profile has been created with limited access for End users. SSO OAth settings are also being used in Salesforce. This results in exposing queries on browser console. We are using Custom Settings to store some data and this Custom Setting (Visibility- Protected) is being used in the Rest API.

We have a field (INFO_API_header_key__c) in this Custom Setting (List) which though not included in front-end query but gets accessible if we edit the query and add this field's api name through query call on postman (A direct query is not being made on Custom Setting but they are being as headers which are coming in front-end response). This exposes the stored data.

Since there is no option to set Field-level Security in Custom Settings, can this be done by adding a validation rule/Formula to hide this field

My requirement is this field's data should not be accessible on front-end (or postman) in query calls and for external users ,and this field should only be accessible in SalesForce API only through the field names.


global with sharing class REST_GetDocInfo {

  global static postJson doPOST(Details customer) {

RestRequest req = RestContext.request;
RestResponse res = RestContext.response;
postJson response = new postJson();

validateInput(customer, response);

if(response.status != 'Failure') { 
 if(isAuthorizedUser(customer.Id)) {
        response.rawRecord.addAll(getResponseModelList(customer, response));
        if(response.status != 'Failure') { 
        response.status = 'Success';
        response.message.add('Operation successful');
    } else {
        response.status = 'Failure';
        response.message.add('You are not allowed to view the information');

  return response;

 //this class has the response data fields 
 global class postJson {
public List<ResponseModel> rawRecord;
public String status;
public String [] message;
public String [] errorCode;
public Boolean leadcustomer;

public postJson(){
    rawRecord = new List<ResponseModel>();
    message = new List<String>();
    errorCode = new List<String>();

//this is custom response data model 
global class ResponseModel {
public String receiptId;
public String customerName;
public String customerNumber;
public String receiptType;
public String valReceipt ;
public String receiptName;
public String leadcustomer;
public Decimal isReceiptListAvailable;
public String recOrderNumber;

   public ResponseModel(String receiptId, String customerName, String 
   customerNumber, String receiptType, 
    String valReceipt , String receiptName, String leadcustomer, Decimal 
    isReceiptListAvailable, String recOrderNumber){
    this.receiptId = receiptId;
    this.customerName = customerName;
    this.customerNumber = customerNumber;
    this.receiptType = receiptType;
    this.valReceipt  = valReceipt ;
    this.receiptName = receiptName;
    this.leadcustomer = leadcustomer;
    this.isReceiptListAvailable = isReceiptListAvailable;
    this.recOrderNumber = recOrderNumber;

        public ResponseModel(){}

     //call to server and return info as string
    private static String getInfo(String receipt , postJson response){ 
        String valReceipt ;

        JSONToApex jsonRequest = new JSONToApex();
        jsonRequest.receiptUrl = receipt ; 

        Http http = new Http();
        HttpRequest req = new HttpRequest();
        Custom_Settings__c settings = Custom_Settings__c.getValues('App');
        String reqBody= JSON.serialize(jsonRequest);  
        req.setHeader('x-api-key', settings.INFO_API_header_key__c);

        try {
        HTTPResponse res = http.send(req);
        valReceipt  = res.getBody();
        } catch(Exception e) {
        valReceipt  = 'blank';
        response.status = 'Failure';
        response.message.add('Not able to get receipt. ' + e);
        return valReceipt ;
  • I don't think a protected custom setting record can be accessed outside of apex code through Standard SF API. If you are returning this data through your own custom API then you need to apply check in your code. – Mr.Frodo Jun 12 '18 at 6:23
  • Thanks for the info. The data is accessible through a postman query. What check can we apply in our custom API. Could you please suggest. Thanks – Salesforce Learner Jun 12 '18 at 6:58
  • Assuming you are an enterprise org (not an ISV) - Option 1) create a separate managed package that uses protected custom settings and exposes an Apex interface to the rest of your org. This in effect creates two code repos for your org - one for all your normal stuff, and one to manage the protected custom settings. Option 2) save/fetch in Platform cache – cropredy Jun 14 '18 at 0:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.