Disable DELETE REST service for a API user accessing Salesforce through a Connected APP

Question

USE CASE:

1.We have connected app that is used by an external web service user to connect to Salesforce

2.We have a PC Orders custom Object its OWD is private, this external web service user will update records on daily bases.

3.On API profile since we want this web service to update all records we granted MODIFY ALL permission on the profile, So when we give MODIFY ALL the profile automatically grants DELETE access (which we don't want but DELETE comes with MODIFY ALL)

PROBLEM:

Out of the box, Salesforce has defined some general REST CRUD - methods(https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/dome_delete_record.htm) to perform CURD actions on Salesforce records which does not require a REST APEX CLASS

curl https://yourInstance.salesforce.com/services/data/v50.0/sobjects/Account/001D000000INjVe -H "Authorization: Bearer token" -X DELETE

So this external user can technically use any of this DELETE API to delete records, we don't want this to happen.

QUESTION:

How can I let this external user keep updating all records, but don't let this user access the DELETE REST method?

Answer 1

Modify All is not the right permissions that should be granted here. It will give them delete access which is not desired!

You can instead use a simple criteria-based sharing rule(say criteria is designed to pick all record types or alternatively records with the created date not equal to null)/ owner based sharing rule and add your Integration users to a Public Group and share records with edit access to this group.