I am unable to successfully delete a file from Salesforce with Apex when executed as a web service call from an external service. Running the following code behaves differently depending on whether it is executed anonymously via dev console or from the external service via the SOAP API. I've simplified the code to keep it succinct, but this captures the essence of what I'm trying to do.

global with sharing class CRMDocumentIntakeService{

    // CRM Document Metadata elements
    global class CRMDocMetadata{
        webservice String filenetGUID;
        webservice String documentID;
        webservice String docTitle;
        webservice String docDescription;
        webservice String docType;
        webservice Date   docReceivedDate;
        webservice String source;
        webservice String channel;
        webservice String workflowSubscription;
        webservice String indicator1; // defaults to 'CRM'
        webservice String objectType; // eg CRM Docs
        webservice String recordID;    //  eg Says Source and required

global with sharing class CRMSFDCDocumentService{

    WebService static void processCRMDocument(CRMDocumentIntakeService.CRMDocMetadata filenetDoc,String messageID) {
        System.debug('Running user: ' + UserInfo.getUserName());

public with sharing class CRMSFDCDocumentServiceHelper {
  public static void processCRMDocument(Id documentId) {

      ContentDocument objContentDoc;
      objContentDoc = [SELECT Id FROM ContentDocument WHERE Id = :documentId];

      delete objContentDoc;


I created a file by uploading a PDF to a Case record with my own user account. I have the Salesforce Files setting enabled to automatically use the "set by record" sharing option.

Salesforce Files Settings

When I execute the code via the external service (triggered by outbound message), then I receive the following error message: Delete failed. First exception on row 0 with id 0691g000000GkaNAAS; first error: INSUFFICIENT_ACCESS_OR_READONLY, insufficient access rights on object id: []

If I log in as the same service account user and execute the code via developer console, then no error occurs and the file is successfully deleted. Here's the anonymous apex block I'm running:

CRMDocumentIntakeService.CRMDocMetadata filenetDoc = new CRMDocumentIntakeService.CRMDocMetadata();
filenetDoc.source = 'P8';
filenetDoc.indicator1 = 'CRM-a0g1g000000mT9p';
filenetDoc.filenetGUID = '{70949B73-0000-C210-9788-ECC0F8579CCE}';
filenetDoc.documentID = 'a0g1g000000mT9p';
filenetDoc.channel = 'WEB';

CRMSFDCDocumentService.processCRMDocument(filenetDoc, '6bc2316ed1bf13eaaef8');

I am aware that permissions around Salesforce Files work much differently than the old attachments object, but the fact that the service account user is able to delete the file from the Files tab in the UI and through Anonymous Apex leads me to believe that this difference may be due to how the web service call runs within system context. I tried changing the classes to be "without sharing", but that did not make any difference. I also updated the API version on all 3 classes to no avail. I also confirmed that the user has a CRM Content feature license and that the profile has the "Manage Salesforce CRM Content" permission enabled.

Any help would be most appreciated.


  • when the web service user logs in to sfdc, there's an explicit API version. Any chance it is an "older" version; execute anonymous would be using the current version (v49)
    – cropredy
    Jul 29, 2020 at 22:50
  • @cropredy I'm sure it is an older version, but would the API version of the authentication request override the API versions of the Apex classes being executed?
    – Terry Post
    Jul 29, 2020 at 23:30

1 Answer 1


This ended up being an issue with API version. I thought I had updated all of the classes to 49.0, but I missed one. Changing it resolved the permissions issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .