0

I want to set some alerts and restrictions for API calls using Shield Event monitoring. I am not able to figure out how can I create real-time monitoring using Transaction security policy to allow only POST method by API calls and restrict others. The condition builder doesn't gives any suitable option, so I believe this must be done using enhanced (custom) APEX implementation but I can't find any method or Property under APIEvent class to determine the method (GET/POST/DELETE etc).

Following this help article link the step 4 where it suggests to select the type of Event, if I select API Event, I can't find any property or method on APIEvent class to determine the HTTP method type GET/POST/DELETE etc.

2
  • could you just implement CRUD via profile or permission set on the objects where Create/Edit is not permitted for the API's running user?
    – cropredy
    Commented Mar 27, 2023 at 22:15
  • Thanks @cropredy for response, but CRUD won't help in scenarios where we want user to be able to perform those operations until certain limit is reached. We don't want to allow certain users/profiles to be able to make more than 1 POST API call in 24hrs.
    – Mona
    Commented Mar 28, 2023 at 11:42

1 Answer 1

1

The ApiEvent only tracks read-only calls upon SFDC (i.e. queries) plus SOAP and Bulk API. No REST

Tracks these user-initiated read-only API calls: query(), queryMore(), and count(). Captures API requests through SOAP API and Bulk API for the Enterprise and Partner WSDLs. Tooling API calls and API calls originating from a Salesforce mobile app aren’t captured. You can use ApiEvent in a transaction security policy. ApiEvent is a big object that stores the event data of ApiEventStream. This object is available in API version 46.0 and later.

What you want is the LightningUriEvent or UriEvent that will tell you in the Operation field whether it is a Read / Create / Edit. / Delete

HOWEVER, LightningUriEvent or UriEvent can't be used in Transaction Security Policies (as of V57)

You could, I suppose, subscribe in a trigger to (Lightning)UriEvent and dynamically change the running user's CRUD permission set once they exceeded some limit, then run a scheduled job / flow once a day to reset

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .