I'm using Salesforce REST API for migration of customers' data and from time to time I encounter this error: 'Implementation restriction: activity aggregate relationships only allow security evaluation for non-admin users when no other filters are applied' in a number of varieties.

I gather it's related to sharing settings of particular Salesforce objects or methods and show up when user has insufficient permissions of some sort. Usually I work around it by asking customer to provide admin credentials. Also I'm aware of ModifyAllData permission which would presumably also work.

The question is - is there a lesser and/or more appropriate permission that being set on non-admin credentials would allow mass data manipulation via REST API?

UPD1: 1. There is no issue of performance. 2. The error happens when I move data into Salesforce, not from it. A permission that has to do with writes is likely to be the one required.

Thank you

  • I've never seen that error before. Which operation fails (query? retrieve? upsert?) Could it be something related to bottom notes on www.salesforce.com/us/developer/docs/api/Content/sforce_api_objects_activityhistory.htm?
    – eyescream
    Commented Jan 23, 2014 at 23:03
  • It's generally this error: help.salesforce.com/apex/…
    – Nic Nilov
    Commented Jan 23, 2014 at 23:05

1 Answer 1


OpenActivity and ActivityHistory have same usage considerations:

The following restrictions on users who don’t have “View All Data” permission help prevent performance issues:

  • In the main clause of the relationship query, you can reference only one record. For example, you can’t filter on all records where the account name starts with ‘A’; instead, you must reference a single account record.
  • You can’t use WHERE clauses.
  • You must specify a limit of 499 or fewer on the number of rows returned in the list.
  • You must sort on ActivityDate in ascending order and LastModifiedDate in descending order; you can display nulls last. For example: ORDER BY ActivityDate ASC NULLS LAST, LastModifiedDate DESC.

So if this is a query call I'd put some LIMIT or ORDER BY or follow the other things mentioned here. Can you post your query?

If you're using an apex class exposed as REST service or an update hits trigger that in turn utilizes a with sharing class - try removing the with sharing (class neither with nor without will inherit permissions from the calling context).

http://help.salesforce.com/apex/HTViewSolution?id=000176262 (to which you already linked) https://developer.salesforce.com/forums?id=906F000000096UUIAY

Or ask your clients for "View All Data"-enabled user. Which generally is a good idea during data migration.

  • Thanks for your input. Please see my UPD1 to the original question. In its context and from what you say it seems I still have to settle with Modify All Data. Does that seem correct to you?
    – Nic Nilov
    Commented Jan 24, 2014 at 13:33
  • 1
    Can you enable a debug log on the user you're using? If there is a trigger working that can hit this error - you should be able to see the trigger's name (and related classes - if any) in the debug log. Alternatively (if they don't want to do that or will not change the class definition) try asking your end client for an user with "View all data". It's less powerful than "Modify all data" and (according to documentation) should be enough.
    – eyescream
    Commented Jan 24, 2014 at 13:38
  • I can't ask customers for any configuration change, just for credentials empowered enough. So I'll go with these two permissions. Thank you.
    – Nic Nilov
    Commented Jan 28, 2014 at 11:37
  • ActivityDate also be in descending order. You have mentioned ascending order. Commented Sep 8, 2014 at 8:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .