# Who has what permission?

#### A few housekeeping items

The permission set object is an amalgamation of Permission Sets and Profiles. You can determine if a record is a profile by using the "IsOwnedByProfile" field. You can also query on the permission set permissions to limit results.

[SOAP API Developer Documentation](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_permissionset.htm)

#### Field Level Security (FLS)

[SOAP API Developer Documentation](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_fieldpermissions.htm?search_text=Field%20Permissions)

##### Who has access to a field by a specific Profile?

```
SELECT Id, Field, PermissionsRead, PermissionsEdit, SobjectType, Parent.Profile.Name
FROM FieldPermissions
WHERE Parent.Profile.Name = 'System Administrator' AND Field = 'Account.Type'
```

##### Who has access to a field by specific Permission Set?

```
SELECT Id, Field, PermissionsRead, PermissionsEdit, SobjectType, Parent.Profile.Name, Parent.Label
FROM FieldPermissions
WHERE Field = 'Account.Type'
```

##### Who has access to a specific field?

<p class="callout info">The absence of records indicates that they have *no* access to that field.</p>

```
SELECT Id, Field, PermissionsRead, PermissionsEdit, SobjectType, Parent.Profile.Name, Parent.Label
FROM FieldPermissions
WHERE Field = 'Account.Type'
```

##### Who does not have access to a field?

```
SELECT Id, Label, Profile.Name
FROM PermissionSet
WHERE ID NOT IN (SELECT ParentID
                 FROM FieldPermissions
                 WHERE Field = 'Account.Type')
```

### Object Level Security

[SOAP API Developer Documentation](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_objectpermissions.htm)

##### Who has access to an object by a specific Profile?

```
SELECT Id, Field, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords, SobjectType, Parent.Profile.Name
FROM ObjectPermissions
WHERE Parent.Profile.Name = 'System Administrator' AND SobjectType = 'Account'
```

##### Who has access to an object by a specific Permission Set?

```
SELECT Id, Field, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords, SobjectType, Parent.Label
FROM ObjectPermissions
WHERE Parent.Label = 'Account Permission Set' AND SobjectType = 'Account'
```

##### Who has access to a specific object?

<p class="callout info">The absence of records indicates that they have *no* access to that object.</p>

```
SELECT Id, Field, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords, SobjectType, Parent.Label, Parent.Profile.Name
FROM ObjectPermissions
WHERE SobjectType = 'Account'
```

##### Who does not have access to an object?

```
SELECT Id, Label, Profile.Name
FROM PermissionSet
WHERE ID NOT IN (SELECT ParentID
                 FROM ObjectPermissions
                 WHERE SobjectType = 'Account')
```

### Setup Entity Access

This object is for querying many object permissions in Salesforce. Those are:

<table border="1" id="bkmrk-type-object-api-name" style="border-collapse: collapse; width: 100%;"><tbody><tr><td style="width: 50%;">**Type**</td><td style="width: 25%;">**Object API Name**</td><td style="width: 25%;">**Name Field**</td></tr><tr><td style="width: 50%;">Apex Class</td><td style="width: 25%;">ApexClass</td><td style="width: 25%;">Name</td></tr><tr><td style="width: 50%;">Visualforce Page</td><td style="width: 25%;">ApexPage</td><td style="width: 25%;">Name</td></tr><tr><td style="width: 50%;">Custom Metadata Type</td><td style="width: 25%;">EntityDefinition</td><td style="width: 25%;">QualifiedAPIName</td></tr><tr><td style="width: 50%;">Custom Setting</td><td style="width: 25%;">EntityDefinition</td><td style="width: 25%;">QualifiedAPIName</td></tr><tr><td style="width: 50%;">Applications (Apps in app launcher)</td><td style="width: 25%;">AppMenuItem</td><td style="width: 25%;">Name</td></tr><tr><td style="width: 50%;">Connected Applications</td><td style="width: 25%;">ConnectedApplication</td><td style="width: 25%;">Name</td></tr><tr><td style="width: 50%;">Custom Permission</td><td style="width: 25%;">CustomPermission</td><td style="width: 25%;">MasterLabel</td></tr></tbody></table>

[SOAP API Developer Documentation](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_setupentityaccess.htm)

The process is the same for all of the above in the below examples. Just replace the object API name with the one for which you are looking to find permissions and the "Name" value in the where clause with the appropriate name field in the table above. For Custom Settings, use "IsCustomSetting" to filter. For Custom Metadata types, add QualifiedApiName LIKE '%\_\_mdt' to the filter.

```
SELECT Parent.Label, Parent.Profile.Name
FROM SetupEntityAccess
WHERE SetupEntityID IN (SELECT Id 
						FROM ApexClass 
                        WHERE Name = 'MyGreatApexClass')
```

##### Custom Tab Settings

<p class="callout info">Pro-tip: You can update the settings from here with "Default On" or "Default Off". Deleting the row will make it "Hidden".</p>

[Tooling API Documentation](https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/tooling_api_objects_permissionsettabsetting.htm)

Name is prepended with "standard-" for standard objects. Name is the API name of a custom object.

```
SELECT Parent.Name, Parent.Profile.Name, Visibility, Name
FROM PermissionSetTabSetting
WHERE Name = 'standard-Account'
```

##### Profile Page Layout Settings

<p class="callout info">The below are using the tooling API.</p>

[Tooling API Documentation](https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/tooling_api_objects_profilelayout.htm)

##### Standard Objects

```
SELECT Layout.Name, TableEnumOrId, Profile.Name, RecordType.Name
FROM ProfileLayout
WHERE TableEnumOrId = 'Account'
```

##### Custom Objects

First, retrieve the "Durable ID" of the object:

```
SELECT DurableId 
FROM EntityDefinition 
WHERE QualifiedAPIName = 'Account_Retention_Rate__c'
```

Then, query the Page Layout Settings:

```
SELECT Layout.Name, TableEnumOrId, Profile.Name, RecordType.Name
FROM ProfileLayout
WHERE TableEnumOrId = '01Io0000001KyaB'
```

<div data-row="0" id="bkmrk-"></div><div data-row="1" id="bkmrk--0"></div><div data-row="2" id="bkmrk--1"></div><div data-row="3" id="bkmrk--2"></div><div data-row="4" id="bkmrk--3"></div><div data-row="5" id="bkmrk--4"></div><div data-row="6" id="bkmrk--5"></div><div data-row="7" id="bkmrk--6"></div><div data-column="0" id="bkmrk--7"></div><div data-column="1" id="bkmrk--8"></div><div data-column="2" id="bkmrk--9"></div>