0

I am using Salesforce REST API fetch the list of log files and getting events/records from each log file. I have generated oauth2 token successfully. Using token I can query list of log files and can see contents of each log file as well.

But when I use identity URL to get the non-admin user's Email Info it fails with 404 ERROR (No_ACCESS) e.g. https://login.salesforce.com/id/org_ID/user_id

How can I use the access token to see other user's email info ? What settings I need to check for connected app ? How can I allow admin user to read other user's info via REST API ?

Please guide.

I have used following steps to access the IDentity URL: I have used following steps to get the access token.

curl --request POST 'https://login.salesforce.com/services/oauth2/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=password'
--data-urlencode 'client_id=<consumer_key_connected_app>'
--data-urlencode 'client_secret=<consumer_secret>
--data-urlencode 'username=<system_admin_user>'
--data-urlencode 'password=<password+security token>'

This gives me access token without any issues.

But the same access token when used with identity URL:

curl --request GET 'https://login.salesforce.com/id/ORG_ID/USER_ID'
--header 'Authorization: Bearer <ACCESS_TOKEN>'

Returns 404 error saying No_access.

Tried with WORKBENCH and same Identity URL works fine. So what's the difference between WORKBENCH and REST API access ?

I think I am still missing something. Please help.

0

The access rules are as follows:

  • The OAuth request for the access token includes the full or api scope.
  • The access token is for a user with the API Enabled permission.
  • The access token is for a user who has access to the other user according to the user sharing rules of the org.
  • The access token is for an internal user, meaning the user_type value in the response is STANDARD.

Assuming you meet these conditions, it should work. I just tested this in my org and got the expected response, so it certainly should be possible.

Alternatively, you can access similar data via /services/data/v51.0/sobjects/User/:user_id, but it'll have a different format.

4
  • Thanks a ton for the response. How did you achieve those 4 conditions ? I have 2 users. 1 is sys admin and other is non-admin. Can you show me how did you achieve that ? I can show you my setup for both users. My emailID is testmjvardhan@gmail.com we can chat if you are ok. – TestSalesforce May 11 at 12:51
  • @TestSalesforce (a) I used workbench (so, Full scope), (b) I used my admin account (so, Api Enabled, can see all users, and is internal user). I can set up a test org if you want a demo. I will be briefly unavailable this morning, but please feel free to message me on Hangouts, and I'll reply when I can. My user there is brianmfear. – sfdcfox May 11 at 13:25
  • I have used following steps to get the access token. Please let me know if it is missing anything. -- curl --request POST 'login.salesforce.com/services/oauth2/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=password' \ --data-urlencode 'client_id=<consumer_key_connected_app>' \ --data-urlencode 'client_secret=<consumer_secret> \ --data-urlencode 'username=<system_admin_user>' \ --data-urlencode 'password=<password+security token>' This gives me access token without any issues. -- – TestSalesforce May 12 at 6:51
  • I pinged you on your hangout ID: Please let me know the suitable time to reach you. – TestSalesforce May 12 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.