Apex SOQL Query not working for Guest User

Question

I´m new to Apex and programming in general so I would be very glad to follow advice from the community.

Basically, I have a Phone App that sends a POST request via Webhook to my Salesforce site everytime a call is started or finished. So you get a different json for each call event (start and end) with different valuable info, but both of them have the same id since they are part of the same call.

This is the expected process:

1. Call starts. Apex class receives and processes the callStarted json and creates a newCall__c record.
2. Call ends. Apex class receives and processes the callfinished json but instead of creating a new record it should query the ID to find and update the record already created in step one.

So far. I have been able to process the callStarted json succesfully and create the newCall__c record when the call starts.

Problem comes when I get the callFinished json and try to query the existing newCall__c record. The debug log always throws: System.QueryException: List has no rows for assignment to SObject

This is the method that is supposed to find the record.

private static void updateCall(callEnd blueprint){
    String id_call = blueprint.id; 
    
    newCall__c call = [SELECT Id, Name, endCallDateTime FROM newCall__c WHERE Name = :id_call LIMIT 1];
    
    //call Id from the App is saved in the Name field.
    
    if(call!=null){
        DateTime fh = DateTime.newInstance(blueprint.calltime);
        call.endCallDateTime = fh;
        update call;
    }
}

So far i have tried this to solve the issue with no results:

• I tried the same query from developer console and it worked so i thin query syntax is ok.
• Initialized the id_call variable with the exact ID i want to find. No results.
• Modified the permissions of the Guest User profile that runs the Class and made sure it has read/edit access to the custom object and each of its fields.

Arte there any other permissions I should give to the profile or is there something else I might be missing? I am working in Sandbox since you can´t create classes directly in prod. Does this environment have limits regarding SOQL? Thanks in advance.

Answer 1

Just to add some context here - as Phil W states, a few years ago, SFDC added more restrictions to the Guest Site User. There were two main changes - in the standard user context, GSU could no longer update records - only Create or Read. In addition, standard sharing rules (Internal and External) no longer applied - you had to create specific sharing rules for each GSU, and you could only share them as Read Only.

Furthermore, GSU could no longer own records - they had to be owned by a standard user. It is important not to confuse this with other users like Community Users - GSU has its own specific rules - so things like Sharing Sets don't apply here. That is why only implementing Without Sharing works in this scenario - it bypasses the platform's restrictions on what the GSU can do. And remember that any classes you call from this code that perform SOQL or DML likely need to either implement Inherited Sharing or Without Sharing as well.

Final note - any use of Without Sharing in a managed package is very carefully scrutinized in a security review and has to be thoroughly documented to be accepted.

Answer 2

Experience site have their own Sharing Sets, so if you can't see any record I will recommend to create a new sharing for your custom object.

This is the link to the documentation: https://help.salesforce.com/s/articleView?id=sf.networks_setting_light_users.htm&type=5