I was looking at this post :


Lately many developers are looking into jquery/ javascript/ ajax based approach to make UI better and to avoid controller(in some cases).

How would you respect the sharing setting in such cases, in case of visualforce + controller approach by using sharing keyword on the controller apex runs in current logged in user context mode.

How do I make sure if the user has read/write access on an object? If the user does not have access he might end up seeing insufficient privileges( I guess, never tested)


The REST API is identical to the SOAP API in terms of basic functionality. The only major difference is the lack of "bulk" processing capabilities as you'd find in the SOAP API (e.g. passing in a list of 200 records to be processed at once), as well as differences to describe calls, the way headers are formatted, etc, all of which are presentation differences as opposed to actual differences in system logic.

In other words, the system basically respects the same settings that the SOAP API does. Notably, it does not respect read-only fields at the page layout/record type level, just like the SOAP API does not, but it does honor read-only and universally required fields as specified at the database level. It also runs standard and custom validation rules, uniqueness constraints, workflow rules, headless flows, triggers, owner change notifications, roll-up summary updates, and obeys the sharing model for queries, updates, and deletes, just as it would in the UI.

You must code your applications to expect the possibility that a user will receive some validation error while trying to update the record. You should also generally take advantage of the describe calls and UserRecordAccess object to present the appropriate standard buttons (edit, delete), but the system will protect those records and fields anyways if you choose not to perform access checks ahead of time and/or the settings change. You don't have to "do anything" special to actually get the system to protect the records, objects, and fields that should be protected.


This Exposing Data with Apex REST Web Service Methods page includes the statement:

Also, sharing rules (record-level access) are enforced only when declaring a class with the with sharing keyword. This requirement applies to all Apex classes, including to classes that are exposed through Apex REST API. To enforce sharing rules for Apex REST API methods, declare the class that contains these methods with the with sharing keyword. See Using the with sharing or without sharing Keywords.

So the with sharing is respected by the platform for REST API classes.

But as far as profile/permission set visibility/editability you have to implement that yourself. From the same page:

Apex class methods that are exposed through the Apex REST API don't enforce object permissions and field-level security by default. We recommend that you make use of the appropriate object or field describe result methods to check the current user’s access level on the objects and fields that the Apex REST API method is accessing. See DescribeSObjectResult Class and DescribeFieldResult Class.

The describe APIs are easy enough to use. But a couple of gotchas are that (the last time I tried to use them) the default value methods didn't work in all cases and also there is no direct Apex API to get picklist values per record type so you have to resort to workarounds like this.


For the platform's built in REST API at URLs such as /vXX.X/query/?q=SOQL query the documentation I can find isn't very explicit e.g.:

Sharing—The query will use an index based on the user’s sharing rules. If there are sharing rules that limit which records are visible to the current user, those rules can be used to optimize the query.

Perhaps someone else will answer with better reference information.

  • In the post the author never used a class, he oauths using session and gets the data, how would sharing be respected in this case?
    – Rao
    Jul 21 '15 at 18:14
  • @Rao Sorry I missed that as I've built custom APIs3 for JavaScript clients . Hopefully someone else will be able to give a definitive answer.
    – Keith C
    Jul 21 '15 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.