I have a post-install handler that is executed as part managed package installation. One of the tasks performed by the post-install handler is to create a Permission Set, and assign some object permissions to this Permission Set. This works all well and good; You create an instance of a PermissionSet SObject and insert it, and then create instances of ObjectPermission objects, specifying the SObject Type and the CRUD permissions you wish to grant and then set the ParentId of the ObjectPermission objects to the Id of the PermissionSet you created earlier. No problem. But now I have a new requirement. I need to grant access to certain Record Types within this Permission Set. For example, there's an Account Record Type that is included as part of our managed package. I want to make this Record Type "visible" in the Permission Set as part of the post-install task. I cannot figure out the mechanism for doing this via Apex code. In fact, I'm not sure it is supported. There doesn't seem to be an SObject equivalent to the ObjectPermissions object for Record Type permissions. There IS something called a SetupEntityAccess object, but this appears to be used for granting access to Apex classes and/or Visualforce pages. Anyone out there know how to do what I'm trying to do, or if it is even possible with straight Apex / DML?

  • Presume you are trying to avoid the Metadata API?
    – Keith C
    Jul 15, 2015 at 19:53
  • Yes, I was trying to do this as a Apex operation executed at post-install time. I can pursue that route if it's the only option, but I was hoping that I would just be able to amend the code that I already have that creates the PermissionSet and adds the ObjectPermissions.
    – tlfu
    Jul 15, 2015 at 19:55

2 Answers 2


You might need to use the Metadata API currently. PermissionSet exposes the recordTypeVisibilities collection of PermissionSetRecordTypeVisibility records.

Indicates which record types are visible to users assigned to this permission set. Available in API version 29.0 and later. This field is never retrieved or deployed for inactive record types.

There is also the existing idea: Record Type Assignment for Permission Sets via Apex


I think you can't assign record type in permission set from code. My Answer is based on the following Analysis:-

1. Permission has only three child objects
a. ObjectPermissions
b. FieldPermissions
c. SetupEntityAccess

As Name represents ObjectPermissions and FieldPermisssions are to assign object and field permissions.
SetupEntityAccess is use to assign permission for the following :-
a) ApexClass for Apex classes
b) ApexPage for Visualforce pages
c) ConnectedApplication for OAuth connected apps
d) CustomPermission for custom permissions
e) ServiceProvider for service providers
f) TabSet for apps

SetupEntityAccess type is defined by a picklist SetupEntityType. Which has the the values mentioned above, So There is no way to specify Record type in SetupEntityAccess.

You can Refer the same in salesforce documentation :-

  1. According to salesforce documentation Permission Set in Packages:-
    Apps, Tabs, Page layouts, and Record types aren’t included in permission set package components and its not a better practice to rely on permission set for these kind of permissions.These permissions can be packaged in profile.Please Refer the Notes and Best Practice section of the documentation.

So if you conclude from both points salesforce doesn't give any way to specify permission for Apps, Tabs, Page layouts, and Record types in PermissionSet from Apex.

  • It sounds like @tlfu said most of what you said in his original Q so this doesn't appear to be much of an answer
    – daveespo
    Jul 15, 2015 at 21:30
  • 1
    Thank you Vikas. I basically did the same analysis, and came to the same conclusion you did. I was hoping there was something I missed. I even tried creating SetupEntityAccess objects and setting SetupEntityId to point to the Record Type I was trying to grant permission to. This gave me a FIELD_INTEGRITY_EXCEPTION upon insert.
    – tlfu
    Jul 16, 2015 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .