Could someone please explain how both of the following two statements are correct:

  1. A field hidden by field level security is not visible through the API.
  2. A user has not been granted field-level access to a field on a custom object. However, a field update will NOT fail if the user executes Apex logic that attempts to modify that field because APEX runs in system mode.

Honestly they sound like they contradict, unless I'm not seeing the difference.

3 Answers 3


APEX and API are two different things. Data Loader uses the API. APEX is executed on the Salesforce server in system mode.

  • Apex can run in the context of the USER or the SYSTEM, through the use of class attribute of WITH or WITHOUT SHARING.
    – Double A
    Oct 29, 2014 at 17:54
  • 1
    sharing on the apex class does not affect Field Level Security. Oct 30, 2014 at 2:09

The statements sound contradictory but they are independent from one another. Per the documentation about Workflow Field Updates:

Field updates function independently of field-level security.

Because of this allowance, even if the current user does not have visibility to the field, the system can still update the field data on their behalf.

  • What does Workflow Field Update have to do with the API? I thought API meant external calls to the SF platform?
    – JJCoolJ
    Oct 29, 2014 at 12:15

As I understand those statements...

Re API access, if you log in via the API with a tool like the dataloader, you will only have access to update fields that you have been granted access to via FLS.

With APEX though, it does not respect FLS - so if you ran the dataloader, and a trigger fired that updated field X, it would still update it even if your user does not have FLS access. This is also true with something like VF/Apex Controllers that don't use standard controllers - a user will see a field hidden via FLS unless you explicitly check for it in your code and only show it when they have access. This second point comes up a lot with Managed Packages and Security Review - if your apex code in a package updates a field without checking the FLS rules, it usually fails security review

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .