5

I have configured a named credential/external credential to perform an http callout from an apex class.

The named credential : Named Credential

The External credential : External credential

Everything works fine when I execute the code as System Administrator, however, when I log as a business user and invokes the apex class, I get this error : common.apex.runtime.impl.ExecutionException: The callout couldn't access the endpoint. You might not have the required permissions, or the named credential "My_Named_Credential" might not exist.

The business User has the Permission Set "Named_Credential_PS" assigned, I just don't understand why it works with System Admin and not with a business user profile. I did a lot of system debug with the business user profile and everything works fine until the http request is performed and I get the error :

EXCEPTION_THROWN|[25]|System.CalloutException: The callout couldn't access the endpoint. You might not have the required permissions, or the named credential Any idea what I did wrong here ? Many thanks for your help.

3 Answers 3

13

Ok I found out the root cause : the profile was missing Read access on the object User External Credentials.

2
  • 2
    Presto! Thanks for posting your solution - Exactly my issue too! May 20, 2023 at 11:06
  • Thanks for following up, helped me out.
    – dmgig
    Dec 11, 2023 at 22:25
4

In addition to the other answers, note that System Administrator profile automatically has R access to User External Credentials and you may still get an error stating that external credentials don't exist.

Even users with System Administrator need to have the External Credential Principal enabled

  1. From Setup, in the Quick Find box, enter either Permission Sets or Profiles, and then select either Permission Sets or Profiles.

  2. Click the name of the permission set or profile that you want to modify.

  3. Take one of these steps.

For a permission set, click External Credential Principal Access in the Apps section.

For a profile, click Enabled External Credential Principal Access. The Guest User profile isn’t supported for named credentials.

  1. Click Edit.

The Edit page displays two columns: one for available external credential principals, and one for external credential principals that are currently enabled.

External credential principals take the form

external credential name - external credential principal parameter name

For example, an external credential principal might have a name like ‘JWT OAuth Credential - Marketing User’.

  1. Select one or more external credential principals from the list of available principals. Click the Add arrow to move them into the Enabled column.

  2. Save your changes.

0

There are couple of things you can check.

  • It is possible that the business user profile does not have the necessary permissions to access the Named Credential. To check this, you can go to the profile settings and verify if the profile has "API Enabled" and "Named Credential" permissions.

  • If the permissions are already enabled, you can try assigning the Named Credential to a permission set and then assign the permission set to the business user profile.

  • If the issue still persists, you can also check if the External Credential is accessible to the business user profile. You can verify this by going to the External Credential settings and checking the access settings for the business user profile.

  • Additionally, you can also try debugging the code to see if there are any other issues related to the business user profile's permissions or access to the external system.

1
  • Hello, The profile does have API Enabled. With the new Named Credentials you cannot assign them in permission sets or on Profiles (they are not listed), it's the opposite way : you select the permission set in the external credential. Your third bulletpoint does not seem feasible as well, I don't know of such settings you mention, can you please elaborate ? Finally,I did make intensive debugging and the only thing that appears is the error message I put in the question.
    – Chris
    Mar 3, 2023 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .