Change Field-Level Security for custom field via REST API [duplicate]

Question

I created a custom field through this tooling REST API /services/data/v54.0/tooling/sobjects/CustomField The API call succeed and I could see the custom fields under Setup > Object Manager > Lead.

I tried to add a lead using this REST API /services/data/v54.0/sobjects/Lead It says the fields does not exist. I am aware that we need to add field level Security for the custom field to make it work. It is mentioned in this thread that it can be done via REST API. Can someone please share the query on how to give access to System Administrator via REST API?

Answer 1

As sfdcfox mentioned in this answer that you can now Create, Read, Update, and Delete FieldPermissions via the REST API, you need to do a REST API call to insert the field permission for the newly created field via tooling API.

The FieldPermissions Object has mainly 5 fields ParentId, SobjectType, Field, PermissionsEdit and PermissionsRead. The ParentId field contains the Id of the PermissionSet. In Your case it is Id of the PermissionSet attached to the System Admin Profile.

You can do multiple REST API calls to get the PermissionSet Id from the Profile and the insert FieldPermissions or do a single composite request. The composite request Payload looks like this.

URL: /services/data/v54.0/composite/
Method: POST
Body:
{
    "allOrNone": true,
    "compositeRequest": [
        {
            "referenceId": "Profile",
            "url": "/services/data/v54.0/query/?q=SELECT+Id+FROM+Profile+Where+Name='System Administrator'",
            "method": "GET"
        },
        {
            "referenceId": "PermissionSet",
            "url": "/services/data/v54.0/query/?q=SELECT+Id+FROM+PermissionSet+WHERE+ProfileId='@{Profile.records[0].Id}'",
            "method": "GET"
        },
        {
            "referenceId": "NewFieldPermission",
            "body": {
                "ParentId": "@{PermissionSet.records[0].Id}",
                "SobjectType": "Lead",
                "Field": "Lead.My_NewField__c",
                "PermissionsEdit": "true",
                "PermissionsRead": "true"
            },
            "url": "/services/data/v54.0/sobjects/FieldPermissions/",
            "method": "POST"
        }
    ]
}