9

We are building a product that offers two routes to the back-end data:

  1. JSON calls to @RestResource Apex class APIs
  2. LWC calls to @AuraEnabled Apex classes

Is there a profile setup that keeps these routes open but stops all other APIs from working e.g. the normal REST API mechanism?

The reason to ask is that the security model we require is quite simple to implement via the Apex classes but would be much more challenging to impose via sharing rules.

(This for a Community.)

Improve this question

1 Answer 1

Reset to default
9

In Winter '18, they added an ability to control access to Apex REST Services that is distinct from the API Enabled permission on profiles that provides access to the standard APIs.

This allows you to set up a profile that does not have access to the standard APIs, but gives you access to Apex REST Services. The user will also need access to the apex class itself. I do not believe you need to contact Salesforce for this setting to appear (even though it says so in the Winter '18 release notes), you should see it on the profile under Administrative Permissions

enter image description here

enter image description here

Improve this answer
4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .