RestrictionRule

Represents a restriction rule or a scoping rule. A restriction rule has EnforcementType set to Restrict and controls the access that specified users have to designated records. A scoping rule has EnforcementType set to Scoping and controls the default records that your users see without restricting access.

Introduced in API version 47.0.

create(), delete(), describeSObjects(), query(), retrieve(), update(), upsert()

DELETE, GET, HEAD, PATCH, POST, Query

• Only users with the View Restriction and Scoping Rules permission can view restriction rules and scoping rules via the API. Only users with the Manage Sharing permission can view, create, update, and delete restriction rules and scoping rules.

• Type: textarea

• Required: No

• Properties: Filter, Group, Nillable, Sort

• Introduced: API version 47.0

• Description: Required. The description of the rule.

• Type: string

• Required: No

• Properties: Filter, Group, Sort

• Description: The unique name for the RestrictionRule object.

This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores. This field is automatically generated, but you can supply your own value if you create the record using the API.

Only users with View DeveloperName OR View Setup and Configuration permission can view, group, sort, and filter this field.

• Type: picklist

• Required: No

• Properties: Defaulted on create, Filter, Group, Restricted picklist, Sort

• Introduced: API version 47.0

• Description: Required. The type of rule.

• Possible values:

  • Scoping — Scoping (default) — Scoping rule.

  • Restrict — Restrict — Restriction rule.

  • FieldRestrict — FieldRestrict — Don’t use.

  • D360_Restrict — D360_Restrict

• Default value: Scoping

• Type: string

• Required: No

• Properties: Create, Group, Nillable

• Introduced: API version 47.0

• Description: Required. The full name of the associated RestrictionRule in Metadata API. The full name can include a namespaceprefix.

Query this field only if the query result contains no more than one record. Otherwise, an error is returned. If more than one record exists, use multiple queries to retrieve the records. This limit protects performance.

• Type: boolean

• Required: No

• Properties: Defaulted on create, Filter, Group, Sort

• Introduced: API version 47.0

• Description: Indicates whether the rule is active (true) or not (false). The default value is false.

• Default value: false

• Type: picklist

• Required: No

• Properties: Defaulted on create, Filter, Group, Nillable, Restricted picklist, Sort

• Description: The language of the rule. The value for this field is the language value of the org.

• Possible values:

  • en_US — English

  • de — German

  • es — Spanish

  • fr — French

  • it — Italian

  • ja — Japanese

  • sv — Swedish

  • ko — Korean

  • zh_TW — Chinese (Traditional)

  • zh_CN — Chinese (Simplified)

  • pt_BR — Portuguese (Brazil)

  • nl_NL — Dutch

  • da — Danish

  • th — Thai

  • fi — Finnish

  • ru — Russian

  • es_MX — Spanish (Mexico)

  • no — Norwegian

• Type: picklist

• Required: No

• Properties: Filter, Group, Nillable, Restricted picklist, Sort

• Description: Indicates the manageable state of the specified component that is contained in a package.

• Possible values:

  • beta — beta

  • deleted — deleted

  • deprecated — deprecated

  • deprecatedEditable — deprecatedEditable

  • installed — installed

  • installedEditable — installedEditable

  • released — released

  • unmanaged — unmanaged

• Type: string

• Required: No

• Properties: Filter, Group, Sort

• Description: Label for the rule.

• Type: complexvalue

• Required: No

• Properties: Create, Nillable, Update

• Introduced: API version 47.0

• Description: The restriction rule’s metadata.

Query this field only if the query result contains no more than one record. Otherwise, an error is returned. If more than one record exists, use multiple queries to retrieve the records. This limit protects performance.

• Type: string

• Required: No

• Properties: Filter, Group, Nillable, Sort

• Description: The namespace prefix associated with this object. Each Developer Edition organization that creates a managed package has a unique namespace prefix. Limit: 15 characters. You can refer to a component in a managed package by using the namespacePrefix__componentName notation.

The namespace prefix can have one of the following values:

• In Developer Edition organizations, the namespace prefix is set to the namespace prefix of the organization for all objects that support it. There is an exception if an object is in an installed managed package. In that case, the object has the namespace prefix of the installed managed package. This field’s value is the namespace prefix of the Developer Edition organization of the package developer.
• In organizations that are not Developer Edition organizations, NamespacePrefix is only set for objects that are part of an installed managed package. There is no namespace prefix for all other objects.

• Type: reference

• Required: No

• Properties: Filter, Group, Nillable, Sort

• Relationship name: Parent

• Relationship type: relationship

• Refers to: DataspaceScope

• Type: textarea

• Required: No

• Properties: Filter, Group, Nillable, Sort

• Introduced: API version 47.0

• Description: Required. The criteria that determine which records are accessible via the rule.

• Type: picklist

• Required: No

• Properties: Filter, Group, Restricted picklist, Sort

• Introduced: API version 47.0

• Description: Required. The object for which you’re creating the rule. We recommend that you don’t edit this field after the rule is created.

If EnforcementType is set to Restrict, custom objects, external objects, and these objects are supported:

• Contract
• Event
• Quote
• Task
• TimeSheet
• TimeSheetEntry

If EnforcementType is set to Scoping, custom objects and these objects are supported:

• Account
• Case
• Contact
• Event
• Lead
• Opportunity
• Task

• Type: textarea

• Required: No

• Properties: Nillable

• Introduced: API version 47.0

• Description: Required. The users that this rule applies to, such as all active users or users with a specified role or profile.

• Type: int

• Required: No

• Properties: Filter, Group, Sort

• Introduced: API version 47.0

• Description: Required. The rule’s version number.

The following is an example of a RestrictionRule representing a restriction rule.

1{
2    "FullName":"restriction_rule_tasks_you_own",
3    "Metadata": {
4        "active":true,
5        "description":"Allows users of a specific profile to see only tasks that they own.",
6        "enforcementType":"Restrict",
7        "masterLabel":"Tasks You Own",
8        "recordFilter":"OwnerId = $User.Id",
9        "targetEntity":"Task",
10        "userCriteria":"$User.ProfileId = '00exxxxxxxxxxxx'",
11        "version":1
12    }
13}

The following is an example of a RestrictionRule representing a scoping rule.

1{
2    "FullName":"Department A contact scoping rule",
3    "Metadata": {
4         "active":true,
5         "description":"View contacts from Department A.",
6         "enforcementType":"Scoping",
7         "masterLabel":"SR for Department A",
8         "recordFilter":"Department=$User.Department",
9         "targetEntity":"Contact",
10         "userCriteria":"$User.UserRoleId = '00Exxxxxxxxxxxx'",
11         "version":1
12    }
13}