We need to get some custom field ids thru apex - we used to do it by invoking tooling api request, but now this requires the user has to have the permission "View Setup and Configuration" on his profile and we don't want users to get that access. How Can we get it by running the query from a different user?

  • Check the accepted answer. It seems it is using tooling API via Standard Rest Service. you can give it a try.
    – Saroj Bera
    Commented Apr 11, 2019 at 10:15
  • what do you mean the accepted answer?
    – daveDev
    Commented Apr 12, 2019 at 11:10
  • My bad. I was trying to mention about this link salesforce.stackexchange.com/questions/94991/…
    – Saroj Bera
    Commented Apr 12, 2019 at 15:56
  • I did it as well, but then the user needs the permission "view setup and configuration" on his profile for that and we dont want to grant it to him. Can we do that request based on a different user?
    – daveDev
    Commented Apr 12, 2019 at 17:54

1 Answer 1


How Can we get it by running the query from a different user?

You can use a Named Credential to do this. Set up the Named Credential to use Named Principal authentication, assigning a user that has View Setup and Configuration permissions.

Then, make your Tooling API callout against the Named Credential:

Http h = new Http();
HttpRequest req = new HttpRequest();

req.setHeader('Content-Type', 'application/json');
req.setEndpoint('callout:My_Named_Credential/services/data/v45.0/tooling/query/?q=<your Tooling API query here>');
HttpResponse res = h.send(req);    

Salesforce handles the authentication part for you and your unprivileged user doesn't have to elevate privileges to get the Tooling API results.

  • Hi, I tried that but got the response -"Moved Temporarily, StatusCode=302" This is My method : HttpRequest req = new HttpRequest(); String metaDataQuery = 'Select+QualifiedApiName,DeveloperName,EntityDefinition.KeyPrefix,DurableId+from+FieldDefinition+Where+EntityDefinition.QualifiedApiName=\'Account\''; req.setHeader('Content-Type', 'application/json'); req.setMethod('GET'); req.setEndpoint('callout:Admin_User/services/data/v45.0/tooling/query/?q='+metaDataQuery); HttpResponse res = h.send(req);
    – daveDev
    Commented Apr 19, 2019 at 7:56
  • The named credential : Admin_User - URL - my sf url Authentication - Identity Type Named Principal, Authentication Protocol - Password Authentication Callout Options - Generate Authorization Header is checked
    – daveDev
    Commented Apr 19, 2019 at 7:57
  • @daveDev You'll probably want OAuth configuration on your Named Credential. Does your Endpoint URL have a path on it?
    – David Reed
    Commented Apr 19, 2019 at 8:09
  • Nope - its only the domain. How can I configure OAuth?
    – daveDev
    Commented Apr 19, 2019 at 8:12
  • I tried from the post : medium.com/dyno-dev/calling-tooling-api-from-apex-1913933284da and received response - [{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}]
    – daveDev
    Commented Apr 19, 2019 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .