Loading
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Add an Apex Class Permissions Checker (Managed Package)

            You are here:

            1. Salesforce Help
            2. Docs
            3. Omnistudio for Managed Packages

            Add an Apex Class Permissions Checker (Managed Package)

            For the managed package runtime, enable specific access to the VlocityOpenInterface Apex class used by remote action APIs for each user or profile, permission set, or permission set group. Use the Apex class check setting to enable users with permission sets or permission set groups to call allowlisted Apex classes remotely. Configure an Apex class permissions checker to ensure that users require explicit access to the Apex class that administers the remote action called from an Omniscript, Integration Procedure, Flexcard, Classic Card, or REST API.

            Managed Package app icon This information is for Omnistudio for Managed Packages. For Omnistudio on standard runtime, see Omnistudio Help.

            For example, after you create a Lightning Platform site, publicly available APIs are enabled for the Site User profile based on the profile's Apex class access to RestResource Apex classes. When you add an Apex class permissions checker, you ensure that unauthorized users, such as a guest user, can't access classes through the Vlocity/V1/GenericInvoke/ API.

            Important
            Important

            Enable the ApexClassCheck setting to ensure the principle of least privilege and that unintentional unauthorized access isn’t provided to guest users through the Vlocity/V1/GenericInvoke/ API.

            Important
            Important During the week of February 2, 2026, Salesforce enables the ApexClassCheck setting by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions.

            Previously, Apex class checks were performed only for the Apex classes assigned to the user’s profile. With the new advanced Apex class check setting, perform Apex class checks for both the Apex classes assigned to the user’s profile and the Apex classes assigned to the user's permission sets or permission set groups.

            Note
            Note In Vlocity Industries managed package orgs, Apex class validation during direct Integration Procedure execution is enforced through the ApexClassCheckForIP flag, as this scenario is not covered by the ApexClassCheck flag alone. This behaviour applies to Insurance (INS), Communications, Media, and Energy (CME), and Financial Services Cloud – Insurance (FSC-INS). See Advanced Apex Class Check for Integration Procedures in Omnistudio for Managed Packages.

            If you're an Omnistudio customer, review your configuration for these insecure configurations, which could provide broader unintentional access to unauthorized Apex classes than desired:

            • Implemented the InvokeMethod of VlocityOpenInterface class within an Omniscript, Integration Procedure, a Flexcard, or a Data Mapper.
            • Added sensitive implementation inside InvokeMethod.
            • Provided Apex class access to the BusinessProcessDisplayController, ApplicationService, and ComponentController classes for the guest user profile.
            • Disabled the ApexClassCheck setting.
            1. If the Omnistudio license isn’t available in your Salesforce org (for example, if you have installed Omnistudio as part of the CME or Insurance managed package), enable the ApexClassCheck setting from the General Settings section.
              1. From Setup, in the Quick Find box, enter Custom Settings, and then select Custom Settings.
              2. Click General Settings.
              3. Click Manage.
              4. Click New.
              5. In Name, enter ApexClassCheck.
              6. In Value, enter true.
                ApexClassCheck in General Settings
              7. Save your changes.
            2. If the Omnistudio license is enabled in your org, enable the ApexClassCheck setting from the Omni Interaction Configuration section:
              1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, and then select Omni Interaction Configuration.
              2. Click New Omni Interaction Configuration.
              3. In Name and in Label, enter ApexClassCheck.
              4. In Value, enter true.
                New Omni Interaction Configuration
              5. Save your changes.
             
            Loading
            Salesforce Help | Article