3

Assume Contact.DoNotCall and Opportunity.ContractId are FLS invisible for the standard profile "System Administrator".

Both fields are visible in the setup and are reported by describe calls in Apex classes having "without sharing".

However using the API, FLS seems to be enforced. So the fields are:

  • not visible in eclipse schema.xml (plugin v31)
  • not accessible in Developer Console (Query Editor Tab, it uses v32 soap api under the hood)
  • not accessible for executeAnonymous invoked via toolingApi (v32)

It boils down to something like: The UI and apex have access to these fields - but the API doesn't.

Is this behavior on purpose? Shouldn't FLS accessibility of fields be consistent all over Apex/UI/API?

This question is a spinoff from this one: Standard field accessiblity inconsistent : feature or simply strange?

2

Modify-all-data permission refers to the ability for a user to have access to all record data, bypassing role hierarchy security, and field read-only criteria. Field Level Security, will permanently hide those fields for specified profiles, as this indicates that certain profiled are not permitted access.

Both fields, along with some others I have noticed are defaulted to hidden for all profiles including system administrator, in my dev org, and in other orgs I have worked in.

Setting the field level security to visible for System Administrator makes these accessible through the Dev Console, Query Tab (and other API tools).

|improve this answer|||||
  • I have already seen that making them accessible via FLS will make them usable for the API.... My question is: why is this necessary at all? Shouldn't override ModifyAllData=true the FLS? – Uwe Heim Feb 11 '15 at 15:39
  • @UweHeim No, MAD only refers to editing records, not fields within the record. There's no permission that overrides FLS "view" permission. – sfdcfox Feb 11 '15 at 16:48
  • Ahh... yes, agree. Modify all data give access to all data. Some fields are just not relevant to users or the entire org and so fls is a good way to "disappear" them. – dacology Feb 11 '15 at 17:06
  • @sfdcfox thanks for that clarification on modifyAllData - I got this wrong. Now it still leaves the question, why API and UI/Apex behave different. With the same user I have access to these fields in UI/Apex but via the API I have not. For me this look very inconsistent and does not make sense. – Uwe Heim Feb 11 '15 at 18:28
  • I removed all mentioning of ModifyAllData from my question. I will keeping this open, because still I can't see the reason for the different visibility. – Uwe Heim Feb 11 '15 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.