{"id":"meta_permissionset","title":"PermissionSet","content":"

PermissionSet

\n
Represents a set of permissions that's used to grant\n more access to one or more users without changing their profile or reassigning profiles.\n You can use permission sets to grant access but not to deny access.
\n\n
\n

This type extends the Metadata metadata type and inherits its\n fullName field.

\n\n

In API version 40.0 and later, when you retrieve permission set metadata, all content\n exposed in Metadata API for the permission sets is included. The metadata includes\n Apex associated with the permission set, CRUD, and so on. Likewise, when you deploy\n a permission set, you must include all of its metadata to avoid accidentally\n overwriting the permission set’s contents.

\n\n

In API version 39.0 and earlier, retrieving or deploying permission set metadata\n returns only app and system permissions assigned to the permission set. Junction\n metadata (such as Apex, CRUD) are included only if the metadata for the related\n component is also included in the package definition.

\n\n

In API version 29.0 and later, you can retrieve and\n deploy access settings for these managed components in profiles and permission\n sets:

\n\n

For more information, see the Managed Component Access section of Sample package.xml Manifest Files in the\n Metadata API Developer Guide.

\n\n
\n\n
\n

Declarative Metadata File Suffix and Directory Location

\n\n \n

Permission sets are stored in the permissionsets directory. The\n file name matches the permission set API name and the extension is\n .permissionset. For example, a permission set with the name\n User_Management_Perms is stored in\n permissionsets/User_Management_Perms.permissionset.

\n\n
\n\n
\n

Version

\n\n \n

Permission sets are available in API version 22.0 and later.

\n\n
\n\n
\n

Special Access Rules

\n
\n

As of Summer ’20 and later, only users who\n have one of these permissions can access this type:

\n
    \n
  • View Setup and Configuration
    • \n\n
  • Manage Session Permission Set Activations
    • \n\n
  • Assign Permission Sets
    • \n\n
  • Manage Profiles and Permission Sets
    • \n\n
\nTo view the following settings, assignments, and permissions for standard and\n custom objects in a specified permission set, the View Setup and Configuration\n permission is required.
    \n
  • Client settings
    • \n\n
  • Field permissions
    • \n\n
  • Layout assignments
    • \n\n
  • Object permissions
    • \n\n
  • Permission dependencies
    • \n\n
  • Permission set tab settings
    • \n\n
  • Permission set group components
    • \n\n
  • Record types
    • \n\n
\n
\n
\n\n
\n

Fields

\n\n \n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
agentAccesses\nPermissionSetAgentAccess[]Indicates which agents are visible to users assigned to this\n permission set. Available in API version 63.0 and later.
applicationVisibilities\nPermissionSetApplicationVisibility[]Indicates which apps are visible to users assigned to this\n permission set. Available in API version 29.0 and later. In API\n version 29.0, this field supports custom apps only. In API version\n 30.0 and later, this field supports both standard and custom\n apps.
classAccesses\nPermissionSetApexClassAccess[]Indicates which top-level Apex classes have methods that users\n assigned to this permission set can execute. Available in API\n version 23.0 and later.
customMetadataTypeAccesses\nPermissionSetCustomMetadataTypeAccess[]Indicates the custom metadata types that are read-accessible to a\n user assigned to this permission set. Available in API version 47.0\n and later.
customPermissions\nPermissionSetCustomPermissions[]Indicates which custom permissions are available to users\n assigned to this permission set. Available in API version 31.0 and\n later.
customSettingAccesses\nPermissionSetCustomSettingAccesses[]Indicates the custom settings that are read-accessible to a user\n assigned to this permission set. Available in API version 47.0 and\n later.
descriptionstringThe permission set description. Limit: 255 characters.
emailRoutingAddressAccesses\nPermissionSetEmailRoutingAddressAccess[]Indicates the Email Routing Address permissions that are\n available to users assigned to a permission set. Available in API\n version 62.0 and later.
externalCredentialPrincipalAccesses\nPermissionSetExternalCredentialPrincipalAccess[]Indicates which external credential principals are available to\n users assigned to this permission set. Available in API version 59.0\n and later.
externalDataSourceAccesses\nPermissionSetExternal DataSourceAccess[]Indicates which data sources with identity type of Per\n User are available to users assigned to this\n permission set. Available in API version 27.0 and later.
fieldPermissions\nPermissionSetFieldPermissions[]Indicates which fields are accessible to a user assigned to this\n permission set, and the kind of access available (readable or\n editable). Available in API version 23.0 and later.
flowAccesses\nPermissionSetFlowAccess[]Indicates which flows can be accessed by a user assigned to this\n permission set. Available in API version 47.0 and later.
hasActivationRequiredbooleanIndicates whether the permission set requires an associated\n active session (true) or not\n (false). Available in API\n version 37.0 and later.
labelstringRequired. The permission set label. Limit: 80 characters.
licensestringEither the related permission set license or the user license\n associated with this permission set. Available in API version 38.0\n and later. Use this field instead of\n userLicense, which is deprecated and only\n available up to API Version 37.0.
objectPermissions\nPermissionSetObjectPermissions[]Indicates the objects that are accessible to a user assigned to\n this permission set, and the kind of access available (create, read,\n edit, delete, and so on). Available in API version 23.0 and\n later.
pageAccesses\nPermissionSetApexPageAccess[]Indicates which Visualforce pages that users assigned to this\n permission set can execute. Available in API version 23.0 and\n later.
recordTypeVisibilities\nPermissionSetRecordTypeVisibility[]Indicates which record types are visible to users assigned to\n this permission set. Available in API version 29.0 and later. This\n field is never retrieved or deployed for inactive record\n types.
ServicePresenceStatusAccessesPermissionSetServicePresenceStatusAccess[]Indicates which Service presence statuses that the user assigned\n to this profile can execute. Available in API version 64.0 and\n later.
tabSettings\nPermissionSetTabVisibility[]Indicates the tab visibility settings for this permission set.\n Available in API version 26.0 and later.
userLicensestringDeprecated. The user license for the permission set. A user\n license determines the baseline of features that the user can\n access. Every user must have exactly one user license. Available up\n to API version 37.0. In API version 38.0 and later, use\n license.
userPermissions\nPermissionSetUserPermissions[]Specifies an app or system permission (such as “API\n Enabled”) and whether it's enabled for this permission set.\n In API version 28.0 and earlier, this field retrieves all user\n permissions, enabled or disabled. In API version 29.0 and later,\n this field retrieves only enabled user permissions. In API Version\n 40.0 and later, if a permission isn’t specified for a deployment,\n it’s disabled.
\n\n
\n\n
\n

PermissionSetAgentAccess

\n\n \n

PermissionSetAgentAccess represents the agent access configuration for users assigned\n through a permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
Field NameField TypeDescription
agentNamestringRequired. The name of the employee agent.
enabledbooleanRequired. Indicates whether users assigned to this permission set\n can use the Agentforce Employee Agent (true) or not (false).
\n\n
\n\n
\n

PermissionSetApplicationVisibility

\n\n \n

PermissionSetApplicationVisibility\n determines whether an app is visible to a user assigned to this permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
Field NameField TypeDescription
applicationstringRequired. The app name.
visiblebooleanRequired. Indicates whether this app is visible to users assigned\n to this permission set (true) or\n not (false).
\n\n
\n\n
\n

PermissionSetApexClassAccess

\n\n \n

PermissionSetApexClassAccess represents the\n Apex class access for users assigned to a permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
apexClassstringRequired. The Apex class name.
enabledbooleanRequired. Indicates whether users assigned to this permission set\n can execute methods in the top-level class (true) or not (false).
\n\n
\n\n
\n

PermissionSetCustomMetadataTypeAccess

\n\n \n

PermissionSetCustomMetadataTypeAccess\n represents the custom metadata type access for users assigned to a permission set.\n Available in API version 47.0 and later.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether the records for this custom metadata\n type are readable (true) or not\n (false).
namestringRequired. The custom metadata type name.
\n\n
\n\n
\n

PermissionSetCustomPermissions

\n\n \n

PermissionSetCustomPermissions represents the custom permissions access for users\n assigned to a permission set. Only enabled custom permissions are retrieved.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
Field NameField TypeDescription
enabledbooleanRequired. Indicates whether the custom permission is enabled\n (true) or not (false).
namestringRequired. The custom permission name.
\n\n
\n\n
\n

PermissionSetCustomSettingAccesses

\n\n \n

PermissionSetCustomSettingAccesses represents the custom setting access for users\n assigned to a permission set. Available in API version 47.0 and later.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether the records for this custom setting\n are readable (true) or not\n (false).
namestringRequired. The custom setting name.
\n\n
\n\n
\n

PermissionSetEmailRoutingAddressAccess

\n\n \n

PermissionSetEmailRoutingAddressAccess represents the Email Routing Address access\n for users assigned to a permission set. Only enabled email routing addresses are\n retrieved.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether the custom permission is enabled\n (true) or not (false).
namestringRequired. Represents an organization's Email-to-Case routing\n address.
\n\n
\n\n
\n

PermissionSetExternalCredentialPrincipalAccess

\n

PermissionSetExternalCredentialPrincipalAccess represents the access to the external credential’s principals. Users assigned to\n the permission set can make callouts using a named credential that references the\n external credential. Available in API version 59.0 and later.

\n\n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether external credential principal access\n is enabled on the permission set (true) or not (false).
externalCredentialPrincipalstringRequired. The name of the external credential and principal,\n separated by a dash. For example, myExternalCredential-myPrincipal.

If the external\n credential and principal are part of a package, include the\n package’s namespace prefix with the principal’s name using this\n format: namespacePrefix__myExternalCredential-myPrincipal.\n Use two underscores (__) between the namespace prefix and the\n external credential principal’s name.

\n\n
\n
\n\n
\n

PermissionSetExternalDataSourceAccess

\n\n \n

PermissionSetExternalDataSourceAccess\n represents the data source access for users with identity type of Per\n User. Available in API version 27.0 and later.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether the data source is enabled (true) or not (false).
externalDataSourcestringThe name of the external data source.
\n\n
\n\n
\n

PermissionSetFieldPermissions

\n\n \n

PermissionSetFieldPermissions represents the\n field permissions for users assigned to a permission set. In API version 30.0 and\n later, permissions for required fields can’t be retrieved or deployed. In API\n version 54.0 and later, only field permissions enabled in the permission set are\n returned in queries.

\n\n

As of API version 38.0, you can change field permissions to make a field editable\n using the Metadata API for fields that you can't change through the user interface.\n For example, you can deploy Asset.ProductCode\n as an editable field even though you can't through the user interface.

\n\n
\n\"Note\"
\n

Note

\n

If the View All Fields object permission is enabled for an object in the\n permission set, the individual fields aren't returned under fieldPermissions.\n However, if you later disable the View All Fields object permission, the fields are\n returned under fieldPermissions and you can remove access to the fields\n manually.

\n
\n
\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
editablebooleanRequired. Indicates whether the field can be edited by the users\n assigned to this permission set (true) or not (false).
fieldstringRequired. The API name of the field (such as Warehouse__c.Description__c).

When referencing\n shared Activity fields, specify Event or Task. For example,\n Event.Meeting__c.

\n
readablebooleanIndicates whether the field can be read by the users assigned to\n this permission set (true) or not\n (false).
\n\n
\n\n
\n

PermissionSetFlowAccess

\n\n \n

PermissionSetFlowAccess represents which\n flows a permission set grants access to. Available in API version 47.0 and\n later.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether users assigned this permission set\n can access the flow (true) or not\n (false) The default value is\n false.
flowstringRequired. The name of the flow to which access is\n granted.
\n\n
\n\n
\n

PermissionSetObjectPermissions

\n\n \n

PermissionSetObjectPermissions represents the object permissions for a permission set.\n Use one of these elements for each permission.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
allowCreatebooleanRequired. Indicates whether the object referenced by the object field can be created by the users assigned to this\n permission set (true) or not\n (false).
allowDeletebooleanRequired. Indicates whether the object referenced by the object field can be deleted by the users assigned to this\n permission set (true) or not\n (false).
allowEditbooleanRequired. Indicates whether the object referenced by the object field can be edited by the users assigned to this\n permission set (true) or not\n (false).
allowReadbooleanRequired. Indicates whether the object referenced by the object field can be viewed by the users assigned to this\n permission set (true) or not\n (false).
modifyAllRecordsbooleanRequired. Indicates whether all records for the object referenced\n by the object field can be viewed, edited, or deleted by the users\n assigned to this permission set (true) or not (false), regardless of the sharing settings for the object.\n Includes private records (records with no parent object). Similar to\n the Modify All Data user permission, but limited to the individual\n object level.
objectstringRequired. The API name of the object (such as Warehouse__c).
viewAllFieldsstringIndicates whether all fields and field data for the object\n referenced by the object field can be viewed by the users assigned to this\n permission set (true) or not\n (false). Available in API\n version 63.0 and later.
viewAllRecordsbooleanRequired. Indicates whether all records for the object referenced\n by the object field can be viewed by the users assigned to this\n permission set (true) or not\n (false), regardless of the\n sharing settings for the object. This setting includes private\n records (records with no parent object). The\n viewAllRecords field is similar to the View\n All Data user permission but limited to the individual object\n level.
\n\n
\n\n
\n

PermissionSetApexPageAccess

\n\n \n

PermissionSetApexPageAccess represents the\n Visualforce page access for users assigned to a permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
apexPagestringRequired. The Visualforce page name.
enabledbooleanRequired. Indicates whether users assigned to this permission set\n can execute the Visualforce page (true) or not (false).
\n\n
\n\n
\n

PermissionSetRecordTypeVisibility

\n\n \n

PermissionSetRecordTypeVisibility represents\n the visibility of record types for this permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
recordTypestringRequired. The record type name, for example Account.MyRecordType.
visiblebooleanRequired. Indicates whether the record type is visible to users\n assigned to this permission set (true) or not (false).
\n\n
\n\n
\n

PermissionSetTabSetting

\n\n \n

PermissionSetTabSetting represents the\n tab settings for a permission set.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
tabstringRequired. The tab name.
visibilityPermissionSetTabVisibility (enumeration of type string)Required. Indicates the visibility settings for the tab. Valid\n values are:
    \n
  • \nAvailable—The tab\n is available on the All Tabs page. Individual users can\n customize their display to make the tab visible in any\n app.
    • \n\n
  • \nNone—The tab isn’t\n available on the All Tabs page or visible in any apps.
    • \n\n
  • \nVisible—The tab is\n available on the All Tabs page and appears in the visible\n tabs for its associated app. Individual users can customize\n their display to hide the tab or make it visible in other\n apps.
    • \n\n
\n
\n\n
\n\n
\n

PermissionSetUserPermission

\n\n \n

In API version 28.0 and earlier, PermissionSetUserPermission represents an app or system permission for a permission\n set. In API version 29.0 and later, this field retrieves only enabled user\n permissions. Use one of these elements for each permission.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
enabledbooleanRequired. Indicates whether the permission is enabled (true) or disabled (false).
namestringRequired. The name of the permission.
\n\n
\n\n
\n

PermissionSetServicePresenceStatusAccess

\n\n \n

Represents the presence statuses that reps assigned to this profile have access.\n Available in API version 64.0 and later.

\n\n \n
\n \n \n \n \n \n \n\n \n\n \n\n \n\n \n\n \n \n \n\n \n\n \n\n \n\n \n \n\n \n\n \n\n \n\n \n\n
FieldField TypeDescription
servicePresenceStatusstringRequired. The name of Service Presence Status.
enabledbooleanRequired. Indicates whether the rep assigned to this profile has\n access to the presence status (true) or not (false).
\n\n
\n\n
\n

Declarative Metadata Sample Definition

\n\n \n

The following is an example of a PermissionSet component.

\n\n 
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<PermissionSet xmlns=\"http://soap.sforce.com/2006/04/metadata\">\n    <description>Grants all rights needed for an HR administrator to manage employees.</description>\n    <label>HR Administration</label>\n    <userLicense>Salesforce</userLicense>\n    <applicationVisibilities>\n        <application>JobApps__Recruiting</application>\n        <visible>true</visible>\n    </applicationVisibilities>\n    <userPermissions>\n        <enabled>true</enabled>\n        <name>ApiEnabled</name>\n    </userPermissions>\n    <objectPermissions>\n        <allowCreate>true</allowCreate>\n        <allowDelete>true</allowDelete>\n        <allowEdit>true</allowEdit>\n        <allowRead>true</allowRead>\n        <viewAllRecords>true</viewAllRecords>\n        <modifyAllRecords>true</modifyAllRecords>\n        <viewAllFields>true</viewAllFields>\n        <object>Job_Request__c</object>\n    </objectPermissions>\n    <fieldPermissions>\n        <editable>true</editable>\n        <field>Job_Request__c.Salary__c</field>\n        <readable>true</readable>\n    </fieldPermissions>\n    <pageAccesses>\n        <apexPage>Job_Request_Web_Form</apexPage>\n        <enabled>true</enabled>\n    </pageAccesses>\n    <classAccesses>\n      <apexClass>Send_Email_Confirmation</apexClass>\n      <enabled>true</enabled>\n    </classAccesses>\n    <tabSettings>\n        <tab>Job_Request__c</tab>\n        <visibility>Available</visibility>\n    </tabSettings>\n    <recordTypeVisibilities>\n        <recordType>Recruiting.DevManager</recordType>\n        <visible>true</visible>\n    </recordTypeVisibilities>\n</PermissionSet>
\n\n

The following is an example package.xml manifest used to retrieve the PermissionSet\n metadata for an organization. When you retrieve permission sets, also retrieve the\n related components with assigned permissions. For example, to retrieve\n objectPermissions and fieldPermissions\n for a custom object, you must also retrieve the CustomObject component.

\n\n 
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Package xmlns=\"http://soap.sforce.com/2006/04/metadata\">\n    <types>\n        <members>Job_Request__c</members>\n        <name>CustomTab</name>\n    </types>\n    <types>\n        <members>Job_Request__c</members>\n        <name>CustomObject</name>\n    </types>\n    <types>\n        <members>JobApps__Recruiting</members>\n        <name>CustomApplication</name>\n    </types>\n    <types>\n        <members>Recruiting.DevManager</members>\n        <name>RecordType</name>\n    </types>\n    <types>\n        <members>*</members>\n        <name>PermissionSet</name>\n    </types>\n    <version>65.0</version>\n</Package>
\n\n
\n\n
\n

Wildcard Support in the Manifest File

\n\n \n

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest\n file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.

\n\n
\n\n
"}