Updating a FieldPermission record produces a INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST error

Question

I am attempting to update FLS using FieldPermission records for profiles and permission sets. This is working fine for unmanaged fields, but for managed fields I am getting an error saying that the field does not belong to the object, when I know it does.

I am building a tool that lets user mass edit FLS across profiles and permission sets and everything works fine for unmanaged fields.

For example, I query this data:

SELECT Id, PermissionsEdit, Field, ParentId, PermissionsRead, SobjectType
FROM FieldPermissions
WHERE Field = 'Account.SBQQ__ContractCoTermination__c'

Which returns some records - here is a record returned for a permission set in the org:

{
  "attributes": {
    "type": "FieldPermissions",
    "url": "/services/data/v46.0/sobjects/FieldPermissions/01k2J00005ITcelQAD"
  },
  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": true,
  "Field": "Account.SBQQ__ContractCoTermination__c",
  "ParentId": "0PS50000000ZpQ0GAK",
  "PermissionsRead": true,
  "SobjectType": "Account"
}

Then, when I attempt to update this record - for example, sending an update with the following data (or even the same data as Salesforce returned):

{
  "Id": "01k2J00005ITcelQAD",
  "PermissionsEdit": false,
  "PermissionsRead": true,
}

The error response I get is this:

INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST:Cannot find Field Account.SBQQ__ContractCoTermination__c for SobjectType Account:--

I have tried a few variations with the same error each time:

1. Insert new record which no existing permissions exist (same error)
2. Use the Durable Id format (e.x. Account.00N50000004RBWE which produces the identical error)
3. remove namespace from the field Account.ContractCoTermination__c and Account.SBQQ.ContractCoTermination__c (I was just trying anything at this point)

Answer 1

As pointed out by @davidreed - the user making the change must have a license assigned to the managed package. Any user, even without the managed package license, can query the FieldPermission object and see all records across all packages, but only users with an assigned license can make updates to FieldPermission records.

Answer 2

For my custom object, I'm able to create a FieldPermissions to a PermissionSet with the following. Notice SObjectType & Field are needed. Hope this helps!

fieldPermissionsParams = {}
fieldPermissionsParams["ParentId"] = '0PSi00000010KnrGAE'
fieldPermissionsParams["SObjectType"] = 'Receipt__c'
fieldPermissionsParams["Field"] = 'Receipt__c.Notes__c'
fieldPermissionsParams["PermissionsEdit"] = true
fieldPermissionsParams["PermissionsRead"] = true
restforceClient.create!('FieldPermissions', fieldPermissionsParams)