Deploying a Profile Update via Tooling RESP API - INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY

Question

I was wondering if anyway has ever been able to make updates to Profiles via the Tooling REST API?

I have recently built an application which creates CustomFields via the API, and I would then like to update profiles with permissions to those new fields. Fields are deploying fine using a POST to the CustomField resource, however I'm unable to update any profiles using a PATCH request as per the Tooling API documentation.

I have tried numerous examples of a profile update, but I am returned INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY - insufficient access rights on cross-reference id: 00eb0000000hlse.

Where the ID is the ID of my profile I'm trying to update.

I am posting my request to the URL: https://eu2.salesforce.com/services/data/v33.0/tooling/sobjects/Profile/00eb0000000hlseAAA

Where eu2 is my instance and 00eb0000000hlseAAA is my Profile ID. That all works as expected, including for other resources (CustomFIeld, ApexClass etc).

My data payload - I have tried numerous examples:

Example 1 - Update field permission

{
    "Metadata": {
        "fieldPermissions": [
            {
                "field": "Account.Test__c",
                "editable": true,
                "readable": true
            }
        ]
    }
}

Example 2 - Simple Update to Description

{
    "Metadata": {
        "description": "Test description"
    },
}

I've tried different Metadata examples - including querying for the profile and then simply re-submitting it - but still receive the error.

I've tried different profiles, different fields and many different permissions.

Any help would be appreciated. I understand the Profile object has only been available since Winter '15 so I'm starting to consider it's just not supported as per the documentation.

I'm looking at you Andy Fawcett...

EDIT As an FYI, the same concept works fine using the updateMetadata method from the Metadata API. That method being sending an update of a single field with permissions. My example code as follows (Python):

# Load WSDL
metadata_client = Client('http://fieldcreator.herokuapp.com/static/metadata-33.xml')

# Set up request URL
metadata_url = 'https://eu2.salesforce.com/services/Soap/m/33.0/ORG_ID'

# Set session settings
session_header = metadata_client.factory.create("SessionHeader")
session_header.sessionId = 'ACCESS_TOKEN'
metadata_client.set_options(soapheaders = session_header)

# Create field permission for new field
field_permission = metadata_client.factory.create('ProfileFieldLevelSecurity')
field_permission.field ='Account.Test__c'
field_permission.editable = True
field_permission.readable = True

# Create new profile and apply field permission
new_profile = metadata_client.factory.create("Profile")
new_profile.fullName = 'Test Profile'
new_profile.fieldPermissions = [field_permission]

# Deploy profile update
result = metadata_client.service.updateMetadata(profiles_to_update)

Answer 1

If you want to update userPermissions on Profile via REST API, you can remove tooling from the URL (and adjust body).

E.g.:

PATCH https://{YOUR_INSTANCE}/services/data/v46.0/sobjects/Profile/{PROFILE_ID}
{
    "IsSsoEnabled": false
}

I know it's a different case than in original question, but maybe somebody will find it useful.