I want to update two fields in a custom object from a RestResource class. This is the code I used:

global class SampleClass{
    global static String updateDateAndTime(String messageId) {
        Datetime dateObj = DateTime.now();
        Date nowDate = dateObj.date();
        Time nowTime = dateObj.time();
        Decimal id = Decimal.valueOf(messageId);
        MailHistry__c mHistory= [SELECT ViewDate__c, ViewTime__c FROM MailHistory__c WHERE MessageId__c=:id LIMIT 1];
        if (Schema.sObjectType.MailHistory__c.fields.ViewDate__c.isUpdateable())
             mHistory.ViewDate__c = nowDate;
        if (Schema.sObjectType.MailHistory__c.fields.ViewTime__c.isUpdateable())
             mHistory.ViewTime__c = nowTime;
        update mHistory;
        return 'success';

This code is not working because both Schema.sObjectType.MailHistory__c.fields.ViewDate__c.isUpdateable() and Schema.sObjectType.MailHistory__c.fields.ViewTime__c.isUpdateable() returns false even though I have enabled all permissions in the Site Public Access Settings. But, the strange part is that If i mark both fields's Required property to true, this code works and both isUpdateable() returns true. So, why is this happening like this? Is there any other way to update the fields even if Required field is false?

1 Answer 1


Checking field level security via describes are so 2019. The modern way to do this is to use Security.stripInaccessible:

mHistory.ViewDate__c = nowDate;
mHistory.ViewTime__c = nowTime;
SecurityDecision s = Security.stripInaccessible(AccessType.UPDATABLE, new sObject[] { mHistory });
mHistory = s.getRecords()[0];

As far as why isUpdateable() returns false when it's not required, I'm not entirely sure. It could be that you're checking the wrong profile? This method definitely should work without the Required field; if not working as advertised, contact Support, there may be a bug in play.

  • I just want to mention that I am able to update the fields here. If I didn't check isUpdateable() , fields are updating fine. But when I check it, its returning false. Aug 19, 2020 at 16:16
  • @JayeshBabu Yes, Apex ignores field level security (mostly). This answer addresses what's considered best practice, which is to use stripAccessible to prevent users from updating fields they should not have access to.
    – sfdcfox
    Aug 19, 2020 at 16:18
  • K. Thanks. In your answer u mentioned you are checking the wrong profile. What do u mean by that? Aug 19, 2020 at 16:20
  • 1
    @JayeshBabu Make sure you're logged in as the person you think you are, and make sure you're looking at the right profile for that user.
    – sfdcfox
    Aug 19, 2020 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .