I have created a simple apex rest service that partner community users should access from an android mobile app. But I get a FORBIDDEN error saying "You do not have access to the Apex class named: xxx". The class in question is added to the community profile. The only way I am able to get around this issue is by going to Public Access settings of the Force.com site and adding this class but then it creates a problem of anyone being able to access the service. I need only the logged in partner community user to access the service. Has anyone come across this issue?

global with sharing class myfirstclass  {

    global static void doGET() {
        system.debug('Inside rest method');

        RestContext.response.statusCode   = 200;
        RestContext.response.responseBody = Blob.valueOf('Hello World');

Workbench request with internal platform user works fine

enter image description here

Same thing from the mobile application when logged in as a partner community user gives 403 Forbidden error with the error message You do not have access to the Apex class named: myfirstclass.

I have added this class to the Partner Community profile.

It only works when I add this class to the guest profile by following the below steps

  1. Setup > Sites
  2. Select the site corresponding to the Community
  3. Click on button Public Access Settings
  4. Add the class myfirstclass under 'Enabled Apex Class Access'

This causes a security issue where the service is now available to anyone. What I am hoping to achieve is only an authenticated user should be able to access this apex rest service. Let me know if you need any information.

  • Can you check if the profile of the community user is API enabled? salesforce.stackexchange.com/a/201012/19118 Nov 28 '18 at 14:10
  • We have exposed many webservices to community users as those licenses are cheaper than Salesforce full licenses Nov 28 '18 at 14:15
  • @pranay agree that it seems like something you would expect but for the life of me, I can't seem to avoid the forbidden error. I double checked the profile of the community user and I see both API Enabled and the new Apex Rest Services permissions checked.
    – DCBoy
    Nov 28 '18 at 20:42
  • Dont use workbench, Try using postman, I just tried with postman, it works Nov 28 '18 at 20:44
  • Also try to get access_token from postman as well, as the SessionId from Lightning community does not have API access Nov 28 '18 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.