I have set my Account
to Private
.
I have Activity
(Task
) set to Private
I have two users - Joe Schmoe
and Karen Hoyts
.
I have created an account Joe's Account
.
Under that account, i create a task Karen's task
and assign it to Karen Hoyts
.
Using the UI, Karen
can see the account name on that task, but when she clicks on it, she gets
Looks like there's a problem. Unfortunately, there was a problem. Please try again. If the problem continues, get in touch with your administrator with the error ID shown here and any other related details. The requested resource does not exist
(that is good and expected).
Now, using the REST API (the standard REST API, /services/data/v48.0/query
), i run the query as Karen
SELECT Id, Account.Name, Account.My_Custom_Field__c FROM Task WHERE Id = '<<task id here>>'
And boom -> Karen just pulled out data from Account that she does not have sharing to.
Why is that?
Karen
authorised that and i get an access token. I can use her access token to issue queries to REST API. – zaitsman Apr 23 '20 at 3:16