I'm aware on how to run a query on FieldPermissions object to check the permissions for a specific field.

The question I have, and I haven't been able to find anything online yet, is:

If I run the query below:

SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,SobjectType,SystemModstamp 
FROM FieldPermissions 
WHERE SobjectType = 'Case' 

I get the following result (this is a small set of the result):

enter image description here

If a field isn't available for any Profile/Permission Set, the field will never show up in the query, for obvious reason.

Does anybody know if it's possible to query the history of a field's permission? Like if we removed access to a field to all profiles/permsets... What was the permission before the change was made?

Can't find anything online about it...


1 Answer 1


Only sort of, and likely not in the sense you're aiming at here.

You can query the SetupAuditTrail sObject, which is part of the Setup Audit Trail feature. The audit trail tracks changes in your org for 180 days, so it's not a complete history of any specific field.

Additionally, the SetupAuditTrail object isn't structured to track at a fine level of granularity. If you change the FLS on a standard field for some custom profile Custom Profile, the corresponding SetupAuditTrail record shows

Section: Manage Users
Display: Changed profile Custom Profile: field-level security for Account: Account Number was changed from No Access to Read/Write
Action: profileFlsChangedCustom

Note that the change detail is available only in the field Display, which is a human-readable string that exclusively uses labels, rather than developer names.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .