If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on arbitrary logic, will such an app pass the security review and is it eligible to be listed on the AppExchange? Or does SFDC have any objections against such use-cases?

Note that a call to the Metadata API is a SOAP over HTTP call, one would typically import the Metadata WSDL into an org to generate Apex stubs to be able to make calls. Alternative is to construct SOAP envelops manually.


Assuming you are not masquerading credentials (e.g. the user you're acting on behalf of has permissions to create pages, etc), or tampering with data the user does not expect to be modified, your app should be allowed on the AppExchange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.