USE CASE:
1.We have connected app that is used by an external web service user to connect to Salesforce
2.We have a PC Orders custom Object its OWD is private, this external web service user will update records on daily bases.
3.On API profile since we want this web service to update all records we granted MODIFY ALL permission on the profile, So when we give MODIFY ALL the profile automatically grants DELETE access (which we don't want but DELETE comes with MODIFY ALL)
PROBLEM:
Out of the box, Salesforce has defined some general REST CRUD - methods(https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/dome_delete_record.htm) to perform CURD actions on Salesforce records which does not require a REST APEX CLASS
curl https://yourInstance.salesforce.com/services/data/v50.0/sobjects/Account/001D000000INjVe -H "Authorization: Bearer token" -X DELETE
So this external user can technically use any of this DELETE API to delete records, we don't want this to happen.
QUESTION:
How can I let this external user keep updating all records, but don't let this user access the DELETE REST method?