12

If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on arbitrary logic, will such an app pass the security review and is it eligible to be listed on the AppExchange? Or does SFDC have any objections against such use-cases?

Note that a call to the Metadata API is a SOAP over HTTP call, one would typically import the Metadata WSDL into an org to generate Apex stubs to be able to make calls. Alternative is to construct SOAP envelops manually.

Improve this question

1 Answer 1

Reset to default
6

Assuming you are not masquerading credentials (e.g. the user you're acting on behalf of has permissions to create pages, etc), or tampering with data the user does not expect to be modified, your app should be allowed on the AppExchange.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .