Once the Connected App is created, how is access granted to various endpoints exposed as REST Services via Apex REST?

For example, if we have a Class called CreateCustomer, and it is decorated like so:

global with sharing class RESTCustomerController

    global static void CreateCustomer(String firstName, String lastName)
        //do stuff

Is there any way to restrict access to this specific class? Or, does a login with API access have access to all REST endpoints, and its own security settings take over, in terms of basic CRUD?

The documents are not particularly helpful in this regard. Any help is greatly appreciated!

1 Answer 1


The REST API functions are secured in the same way as other top-level functions. The user's profile must have Author Apex, or must have access provided to the class by profile or permission set (e.g. there is a PermissionSetAssignment that associates a PermissionSet to a user that contains permission for that class).

  • Awesome! Thank you for the fast response. We will test this ASAP. Commented Jul 20, 2015 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .