I am attempting to update FLS using FieldPermission records for profiles and permission sets. This is working fine for unmanaged fields, but for managed fields I am getting an error saying that the field does not belong to the object, when I know it does.

I am building a tool that lets user mass edit FLS across profiles and permission sets and everything works fine for unmanaged fields.

For example, I query this data:

SELECT Id, PermissionsEdit, Field, ParentId, PermissionsRead, SobjectType
FROM FieldPermissions
WHERE Field = 'Account.SBQQ__ContractCoTermination__c'

Which returns some records - here is a record returned for a permission set in the org:

  "attributes": {
    "type": "FieldPermissions",
    "url": "/services/data/v46.0/sobjects/FieldPermissions/01k2J00005ITcelQAD"
  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": true,
  "Field": "Account.SBQQ__ContractCoTermination__c",
  "ParentId": "0PS50000000ZpQ0GAK",
  "PermissionsRead": true,
  "SobjectType": "Account"

Then, when I attempt to update this record - for example, sending an update with the following data (or even the same data as Salesforce returned):

  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": false,
  "PermissionsRead": true,

The error response I get is this:

INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST:Cannot find Field Account.SBQQ__ContractCoTermination__c for SobjectType Account:--

I have tried a few variations with the same error each time:

  1. Insert new record which no existing permissions exist (same error)
  2. Use the Durable Id format (e.x. Account.00N50000004RBWE which produces the identical error)
  3. remove namespace from the field Account.ContractCoTermination__c and Account.SBQQ.ContractCoTermination__c (I was just trying anything at this point)
  • 1
    Does your running user have FLS to this field and (if necessary) a license for the managed package? – David Reed Jan 3 at 16:03
  • My user is system admin (dev org) and does have a user for the managed package. It is really odd - If no permission exists on a field (which means no FieldPermission record is returned), then I can update the FLS in the SFDC UI and then re-query the FieldPermission record and it shows up - then if I attempt to update the record without even changing any of the fields, it produces the same restricted picklist error. – Austin Turner Jan 3 at 17:04
  • @DavidReed - WOW - actually, I double checked and realized I had some other user I was using for testing and the license was NOT assigned. I tried again with a different user and everything worked. Thank you so much! – Austin Turner Jan 3 at 17:12

As pointed out by @davidreed - the user making the change must have a license assigned to the managed package. Any user, even without the managed package license, can query the FieldPermission object and see all records across all packages, but only users with an assigned license can make updates to FieldPermission records.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.