0

I have an issue, I created a CMT to store a token for a integration with thirdparty system, with the SA user works fine, but it doesn't work for other users, when I check the debug logs I saw this error: "System.NoAccessException: Not allowed to install or modify metadata via Apex"

This is the code to update the CMT:

Metadata.CustomMetadata customMetadata =  new Metadata.CustomMetadata();
        customMetadata.fullName = 'PDB_Token.Token';
        customMetadata.label = 'Token';

        Metadata.CustomMetadataValue customFieldDate = new Metadata.CustomMetadataValue();
        customFieldDate.field = 'Fecha_Token__c';
        system.debug('#####token:');
        system.debug(t);
        customFieldDate.value = System.now().addSeconds(Integer.valueOf(t.expires_in));

        customMetadata.values.add(customFieldDate);

        Metadata.CustomMetadataValue customFieldToken = new Metadata.CustomMetadataValue();
        customFieldToken.field = 'Token__c';
        customFieldToken.value = t.access_token;

        customMetadata.values.add(customFieldToken);

        Metadata.DeployContainer mdContainer = new Metadata.DeployContainer();
        mdContainer.addMetadata(customMetadata);

        CustomMetadataCallback callback = new CustomMetadataCallback();

         Id jobId = Metadata.Operations.enqueueDeployment(mdContainer, callback);

I already gave these permissions: "Modify Metadata Through Metadata API Functions" and also I enabled the CMT that store the token.

So any of you knows what other permission I need to assign to the users so they can update the CMT via Apex?

Improve this question

4 Answers 4

Reset to default
2

From the Metadata API doc

Users must have the Customize Application permission to create, update, and delete metadata records. Thereafter, users with the Modify Metadata Through Metadata API Functions permission can edit metadata (including Apex) through Metadata API even if they don’t also have the Modify All Data permission.

Note, I found this GitHub andyinthecloud package useful to avoid some custom code

Improve this answer
2
2

I am running into a nearly identical issue in my org that started just days ago.

cropredy posted a link to A Possible Clue

After looking at this post and the comments, there was some additional information provided in the first comment that I personally tested in a sandbox and found an answer to your question.

I was originally assigning the Customize Application and Modify Metadata Through Metadata API Functions permissions through a permission set that I had created. I received the same error:

System.NoAccessException: Not allowed to install or modify metadata via Apex

The Workaround

The only way I was able to bypass this issue was by creating a duplicate copy of the profile which the user was assigned, and assigned the Customize Application and Modify Metadata Through Metadata API Functions permissions to the profile itself.

After assigning the original user the newly created profile with the additional permissions, my code worked as expected.

UPDATE(S)

2/21/20230 - I have opened a Case with Salesforce to report what I believe is a bug. I will keep this responses updated with the findings of the Case.

Improve this answer
4
  • kudos for reproducing -- sadly, this workaround goes against the grain of not using Profiles (these are being deprecated in 2026) and we can only hope SFDC will fix this issue before then
    – cropredy
    Feb 15 at 19:49
  • I agree completely. I attempted to open a ticket with Salesforce to report the issue, but due to some "performance degradation". I'll continue to try and open a ticket for the issue.
    – SalesforceMike
    Feb 15 at 20:03
  • I'd also suggest @mentioning Cheryl Feldman, the PM for Profiles; she can be found on Twitter at twitter.com/CherFeldman.
    – cropredy
    Feb 15 at 20:13
  • Thanks to all for your replies, I made a schedule class to get the token with a sa profile as executor the schedule class, so this is the workaround I found to solve this.
    – Angello Camacho
    Feb 16 at 19:31
2

This is a known issue with 6 reports, currently tagged as Solution in Progress

Improve this answer
0

I suffered the same problem - couldn't save Custom Metadata records using APEX.

So I opened a Case with the Partner Support Team and they have enabled the Aloha Perm on our packaging org, and ta-da, I don't need the checkbox 'Deploy Metadata from Non-Certified Package Versions via Apex' ticked anymore for the latest version of the App!

Thank you to all of the above subscribers for putting me on the right track.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .