I am attempting to update FLS using FieldPermission records for profiles and permission sets. This is working fine for unmanaged fields, but for managed fields I am getting an error saying that the field does not belong to the object, when I know it does.

I am building a tool that lets user mass edit FLS across profiles and permission sets and everything works fine for unmanaged fields.

For example, I query this data:

SELECT Id, PermissionsEdit, Field, ParentId, PermissionsRead, SobjectType
FROM FieldPermissions
WHERE Field = 'Account.SBQQ__ContractCoTermination__c'

Which returns some records - here is a record returned for a permission set in the org:

  "attributes": {
    "type": "FieldPermissions",
    "url": "/services/data/v46.0/sobjects/FieldPermissions/01k2J00005ITcelQAD"
  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": true,
  "Field": "Account.SBQQ__ContractCoTermination__c",
  "ParentId": "0PS50000000ZpQ0GAK",
  "PermissionsRead": true,
  "SobjectType": "Account"

Then, when I attempt to update this record - for example, sending an update with the following data (or even the same data as Salesforce returned):

  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": false,
  "PermissionsRead": true,

The error response I get is this:

INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST:Cannot find Field Account.SBQQ__ContractCoTermination__c for SobjectType Account:--

I have tried a few variations with the same error each time:

  1. Insert new record which no existing permissions exist (same error)
  2. Use the Durable Id format (e.x. Account.00N50000004RBWE which produces the identical error)
  3. remove namespace from the field Account.ContractCoTermination__c and Account.SBQQ.ContractCoTermination__c (I was just trying anything at this point)
  • 1
    Does your running user have FLS to this field and (if necessary) a license for the managed package?
    – David Reed
    Jan 3, 2020 at 16:03
  • My user is system admin (dev org) and does have a user for the managed package. It is really odd - If no permission exists on a field (which means no FieldPermission record is returned), then I can update the FLS in the SFDC UI and then re-query the FieldPermission record and it shows up - then if I attempt to update the record without even changing any of the fields, it produces the same restricted picklist error. Jan 3, 2020 at 17:04
  • @DavidReed - WOW - actually, I double checked and realized I had some other user I was using for testing and the license was NOT assigned. I tried again with a different user and everything worked. Thank you so much! Jan 3, 2020 at 17:12

2 Answers 2


As pointed out by @davidreed - the user making the change must have a license assigned to the managed package. Any user, even without the managed package license, can query the FieldPermission object and see all records across all packages, but only users with an assigned license can make updates to FieldPermission records.


For my custom object, I'm able to create a FieldPermissions to a PermissionSet with the following. Notice SObjectType & Field are needed. Hope this helps!

fieldPermissionsParams = {}
fieldPermissionsParams["ParentId"] = '0PSi00000010KnrGAE'
fieldPermissionsParams["SObjectType"] = 'Receipt__c'
fieldPermissionsParams["Field"] = 'Receipt__c.Notes__c'
fieldPermissionsParams["PermissionsEdit"] = true
fieldPermissionsParams["PermissionsRead"] = true
restforceClient.create!('FieldPermissions', fieldPermissionsParams)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .