We are integrating an External System (Drupal) with Salesforce . The corner case being , A user who may get access to the shell of the server the Drupal Instance is running , may have access to all of SF data which can be used to export all data .

How do we ensure "query" is restricted ?

Its my Understanding the "API Enableb" means , Query via Rest API is enabled too

Note : this User should be a super user with Sys Admin access to all data . All we need is the ability to query removed .

Thanks to @identigral for the Answer pointing to Transaction Security

enter image description here

While I am able to Block Query on URL Level

When I use the Same Query as part of a Subrequest in Composite API { "compositeRequest": [ { "method": "POST", "url": "/services/data/v57.0/sobjects/Account", "referenceId": "refAccount", "body": { "Name": "Sample Account" } }, { "method": "POST", "url": "/services/data/v56.0/query/?q=SELECT+name+from+Account", "referenceId": "refContact", "body": { "LastName": "Sample Contact", "AccountId": "@{refAccount.id}" } } ] }

enter image description here

This by-passes the Transaction Security Policy . Response

enter image description here Please Help how this can be averted



You must log in to answer this question.

Browse other questions tagged .