PermissionSet

Supported Calls

create(), delete(), describeSObjects(), query(), retrieve(), search(), update(), upsert()

Child Relationships

PermissionSet has a read-only child relationship with PermissionSetGroup. PermissionSet contains the aggregated permissions for the group.

Special Access Rules

Fields

Usage

Use the PermissionSet object to query existing permission sets.

For example, to search for all permission sets that contain the “Modify All Data” permission:

1SELECT Name, PermissionsModifyAllData
2FROM PermissionSet
3WHERE PermissionsModifyAllData=true

When combined with the PermissionSetAssignment object, you can create a nested query that returns all users assigned to a particular permission like “Modify All Data”:

1SELECT Name, (SELECT AssigneeId FROM Assignments)
2FROM PermissionSet
3WHERE PermissionsModifyAllData=true

If the permission set isn’t assigned to a user, you can also create or delete a permission set.

User Licenses

The user license controls the permissions that are available in a permission set.

Every permission set can be associated with a user license or permission set license. If you plan to assign a permission set to multiple users with different user and permission set licenses, leave LicenseId empty. If only users with one type of license use this permission set, set the LicenseId to that single user or permission set license. If you want a permission set associated with a permission set license, then set LicenseId to the permission set license. To get the LicenseId, run this query:

1SELECT Id, Name
2FROM UserLicense

Alternatively, to query a user or profile for the LicenseId.

1SELECT Id, Profile.UserLicenseId
2FROM User

Child Objects

When using the API, think of each permission set or related set of access controls as an empty container that you fill with permission records.

In these child objects, access is stored in a record, while the absence of a record indicates no access. To return a record in a SOQL query, a minimum permission or setting is required for each child object.

Because permissions are stored in related objects, it’s important to understand what questions to ask when using SOQL. For example, let’s say you want to know which permission sets have “Delete” on an object. You also want to know which ones include permissions that allow approval of a return merchandise authorization (where the approval checkbox is controlled with field permissions). Asking the right questions when using SOQL with permission sets ensures that you get the information you need, such as whether to migrate permissions or assign a permission set to a user.

For example, the following returns all permission sets where the “Read” permission is enabled for the Merchandise__c object.

1SELECT SobjectType, ParentId, PermissionsRead
2FROM ObjectPermissions
3WHERE PermissionsRead = True AND SobjectType = 'Merchandise__c'

You can query for all permission sets that have “Read” on an object. However, you can’t query for permission sets that have no access on an object, because no records exist for that object. For example, the following returns no records because the object must have at least “Read” to return any records.

1SELECT SobjectType, ParentId, PermissionsRead
2FROM ObjectPermissions
3WHERE PermissionsRead = False AND SobjectType = 'Merchandise__c'

If you have at least the “Read” permission on an object, you can create a conditional query on other permissions in the same object. For example, the following returns any records where the object has at least the “Read” permission but not the “Edit” permission.

1SELECT ParentId, PermissionsRead, PermissionsEdit
2FROM ObjectPermissions
3WHERE PermissionsEdit = False AND SobjectType = 'Merchandise__c'

To set an object or field permission to no access, delete the record that contains the permission. For example, to disable all object permissions in the Merchandise__c object for a particular permission set, first query to retrieve the ID of the object permission record.

1SELECT Id
2FROM ObjectPermissions
3WHERE SobjectType = 'Merchandise__c'

Then delete the IDs returned from the query.

View a Permission Set with Nested Queries

You can build on the PermissionSet object using child relationships that show all of the permissions in a single permission set. For example, the following returns all permission sets and displays the “Transfer Leads” permission, as well as any “Read” permissions on any objects and fields.

1SELECT Label, PermissionsTransferAnyLead,
2(SELECT SobjectType, PermissionsRead FROM ObjectPerms),
3(SELECT SobjectType, Field, PermissionsRead FROM FieldPerms)
4FROM PermissionSet

Associated Profiles

In API version 25.0 and later, every profile is associated with a permission set that stores the profile’s user, object, and field permissions, as well as setup entity access settings. You can query permission sets that are owned by profiles but not modify them.

The following example returns all permission sets, including those owned by a profile.

1SELECT Id, Label, ProfileId, Profile.Name
2FROM PermissionSet

1SELECT Id, Label, ProfileId, Profile.Name, IsOwnedByProfile
2FROM PermissionSet
3WHERE IsOwnedByProfile = FALSE

1SELECT Id,ParentId, PermissionsRead, SobjectType, Parent.ProfileId
2FROM ObjectPermissions
3WHERE Parent.IsOwnedByProfile = TRUE

1SELECT Assignee.Name, PermissionSet.Id, PermissionSet.isOwnedByProfile
2FROM PermissionSetAssignment
3WHERE PermissionSetId
4IN (SELECT ParentId
5FROM ObjectPermissions
6WHERE SObjectType = 'Merchandise__c' AND PermissionsRead = true)