I have made a webservice to match a phone number and want to return the id of the record. When I test this in workbench this works and have a match. I have a public site with a public class where I call the URL this returns: exception System.ListException: List index out of bounds: 0

The Url I call is ../services/apexrest/Contact/1234567890

How can this be since workbench returns an Id?

Here is my code:

global with sharing class RestResource {
    webservice static void showContact() {
        Boolean isValid;
        String phone; 
        List<Contact> resultCon= new List<Contact>();
        RestRequest request = RestContext.request;
        RestResponse response = RestContext.response;

        try {
            phone = (request.requestURI.substring(request.requestURI.lastIndexOf('/')+1)).replaceAll('[^0-9]','');
            isValid = Regex_Validator.isValidPhone(phone);
            resultCon = [SELECT id, phone , lastname FROM Contact WHERE phone = :phone];
            response.addHeader('Content-Type', 'application/json');
            response.responseBody = Blob.valueOf(JSON.serialize(resultCon[0].id));
        } catch(exception e) {
            response.addHeader('Content-Type', 'text/plain');
            if(resultCon.IsEmpty()) { 
                response.responseBody = Blob.valueOf('Sorry no match');
            if(!isValid) {
                response.responseBody = Blob.valueOf('Check format phonenumber :+00 0000000000');
               response.responseBody = Blob.valueOf('exception '+e); 
  • have you tried adding some debug logs to your soql ? you should be checking List index out of bounds, you are getting a response from your web service
    – glls
    Commented Jul 17, 2018 at 4:00

1 Answer 1


Your class is declared with sharing, meaning that when you invoke this query:

  resultCon = [SELECT id, phone , lastname FROM Contact WHERE phone = :phone];

your organization's Org-Wide Defaults and Sharing Rules will be enforced on Contact. Presumably, your OWD is Private, and your site's associated Guest User does not have permissions that would allow it to see others' Contacts. When you authenticate via Workbench, you're likely a System Administrator or similar and have an overriding permission like View All Data, allowing this to succeed.

You need to decide what the appropriate security configuration is. It could be changing the class to be declared without sharing.

Anyway, you then directly access the first element of your queried list:

        response.responseBody = Blob.valueOf(JSON.serialize(resultCon[0].id));

without checking to see if the list in fact contains any Contacts. You may wish to consider checking for this state of affairs first, before simply letting an exception be thrown, to keep your code's behavior a little clearer and reserve exception handling for genuinely exceptional cases.

  • Thanks for the explanation with sharing was indeed the culprit
    – Thomas
    Commented Jul 17, 2018 at 4:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .