Example Queries for Troubleshooting Access Issues

Object Permissions

Return permission sets that have the Read object permission for cases enabled.

SELECT ParentId,Parent.ProfileId,Parent.Name,Parent.PermissionSetGroupId
    FROM ObjectPermissions
    WHERE SobjectType = 'Case' 
    AND PermissionsRead = true 

Return permission sets that a user is assigned that grant the Read object permission for cases.

SELECT AssigneeId,ExpirationDate,Id,IsActive,PermissionSetGroupId,PermissionSetId,
PermissionSet.Name FROM PermissionSetAssignment
    WHERE PermissionSetId IN
        (SELECT ParentId
        FROM ObjectPermissions WHERE SobjectType = 'Case' 
        AND PermissionsRead = true)
    AND AssigneeId = '005XXXXXXXXXXXXQAT' 

Field Permissions

Return field permissions associated with a permission set.

SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,SobjectType,SystemModstamp
    FROM FieldPermissions
    WHERE ParentId = '0PSXXXXXXXXXXXX'

Return permission sets that have a specific field permission enabled.

SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,SobjectType,SystemModstamp
    FROM FieldPermissions 
    WHERE Field = 'Account.CustomerPriority__c'
    AND PermissionsEdit = true

Return the permission sets that a user is assigned that grant a specific field permission.

SELECT AssigneeId,ExpirationDate,Id,IsActive,PermissionSetGroupId,PermissionSetId,
PermissionSet.Name FROM PermissionSetAssignment
    WHERE PermissionSetId IN
         (SELECT ParentId
          FROM FieldPermissions 
          WHERE Field = 'Account.CustomerPriority__c'
          AND PermissionsEdit = true)
    AND AssigneeId = '005XXXXXXXXXXXXQAT'

User Permissions

Return the permission sets that a user is assigned that grant specified permissions.

SELECT AssigneeId,ExpirationDate,Id,IsActive,
PermissionSetGroupId,PermissionSetId,
PermissionSet.Name,PermissionSet.PermissionsViewAllData,
PermissionSet.PermissionsCustomizeApplication 
    FROM PermissionSetAssignment
    WHERE AssigneeId = '005XXXXXXXXXXXXIAS' AND 
    (PermissionSet.PermissionsViewAllData = true OR
    PermissionSet.PermissionsCustomizeApplication = true)

Return the user permissions that a user has when logged in as that user.

SELECT <All Fields> FROM UserPermissionAccess   // or specify permissions

Profiles and Permission Set Groups

Each profile or permission set group has an associated permission set. You can first get the associated permission set ID for a profile or permission set group, then use this permission set ID in other queries. The two queries below can be modified for object permissions, user permissions, and access settings.

Return permissions associated with a profile, using the associated permission set.

#Get the profile's associated permission set
SELECT Id from PermissionSet 
    WHERE ProfileId = '00eXXXXXXXXXXXX'

SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,
SobjectType,SystemModstamp 
    FROM FieldPermissions
    WHERE ParentId = '0PSXXXXXXXXXXXXWAU'      //ID of the associated permission set

Return permissions associated with a permission set group, using the associated permission set.

#Get the permission set groups's associated permission set.
SELECT Id from PermissionSet 
    WHERE PermissionSetGroupId = '0PGXXXXXXXXXXXX'

SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,
SobjectType,SystemModstamp 
    FROM FieldPermissions
    WHERE ParentId = '0PSXXXXXXXXXXXXWAU'      //ID of the associated permission set

Record Access

Return whether a user has access to a record and what level of access is given.

SELECT RecordId,HasReadAccess,HasEditAccess,HasDeleteAccess,HasTransferAccess,HasAllAccess,MaxAccessLevel 
     FROM UserRecordAccess 
     WHERE RecordId = '001XXXXXXXXXXXXIAC'
     AND UserId = '005XXXXXXXXXXXXQAT'

Return the users that have access to a specific account record.

SELECT AccountAccessLevel,AccountId,CaseAccessLevel,ContactAccessLevel,Id,IsDeleted, LastModifiedById,LastModifiedDate,OpportunityAccessLevel,RowCause,UserOrGroupId     
    FROM AccountShare
    WHERE AccountId = '001XXXXXXXXXXXXIAC'

Return whether the queried user has Read and Transfer access to a record, and the user’s maximum access level for the record.

SELECT RecordId,HasReadAccess,HasTransferAccess,MaxAccessLevel
    FROM UserRecordAccess
    WHERE UserId = '005XXXXXXXXXXXXQAT'
    AND RecordId = '001XXXXXXXXXXXXIAC'      //or Record IN [list of IDs]

Return all records that the queried user has Read access to.

SELECT RecordId
    FROM UserRecordAccess
    WHERE UserId = '005XXXXXXXXXXXXQAT'
    AND RecordId IN [list of IDs]
    AND HasReadAccess = true

Access Settings (SetupEntityAccess)

Access settings can be specified in permission sets and profiles and include Visualforce pages, Apex classes, and custom permissions. For more information, see Permissions and Access Settings in Salesforce Help and SetupEntityAccess in the Object Reference for the Salesforce Platform Developer Guide.

Return the permission sets that have the specified access setting enabled.

SELECT Id,ParentId,SetupEntityId,SetupEntityType,
SystemModstamp 
    FROM SetupEntityAccess
    WHERE SetupEntityId = '0H4XXXXXXXXXXXX' //ID of Apex class, Visualforce page, etc.

Return the permission sets assigned to a user that have the specified access setting enabled.

SELECT AssigneeId,ExpirationDate,Id,IsActive,
PermissionSetGroupId,PermissionSetId,
PermissionSet.Name 
    FROM PermissionSetAssignment
    WHERE PermissionSetId IN 
        (SELECT ParentId 
        FROM SetupEntityAccess
        WHERE SetupEntityId = '0H4XXXXXXXXXXXX' )
    AND AssigneeId = '005XXXXXXXXXXXXQAT'