I would like to give an API user^ the least necessary permissions to interact with (particularly edit) objects. Ideally, I would enable only the fields they need to be able to edit.

First I tried giving the new Permission Set Read Object Permissions and Edit Access Field Permissions on just two fields, MTC_Photo__c and MTC_Photo_date__c:
Read access to Object, Edit Access to fields

When I try to update the fields using the REST API (in Ruby via the restforce gem) it fails. Trying again with the bang method to see the error reveals an error code of CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY:

> client.update('Contact', Id: '0039o000003Sv6DAAS', MTC_Photo__c: nil, MTC_Photo_date__c: nil)
=> false
client.update!('Contact', Id: '0039o000003Sv6DAAS', MTC_Photo__c: nil, MTC_Photo_date__c: nil)
=> ... CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY: entity type cannot be updated: Contact (Restforce::ErrorCode::CannotInsertUpdateActivateEntity)
RESPONSE: [{"message":"entity type cannot be updated: Contact","errorCode":"CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY","fields":[]}]

I then tried enabling Edit Object Permissions but leaving all the other Field Permissions set to Read Access (other than the two I want to be able to edit):
Edit enabled for object, most fields restricted to Read

When I do that, I can now edit the two fields I want to be able to edit but I can also edit a whole bunch of other fields I only expected to be able to read. For example MobilePhone does not have Edit Access ticked but I can still edit it:

> client.update('Contact', Id: '0039o000003Sv6DAAS', MobilePhone: '0412 345 678')
=> true

Is it possible to grant edit access via the REST API at the field level?

^User details:
User License: Salesforce Integration
Profile: Salesforce API Only System Integrations



Browse other questions tagged .