---
schema_version: "1"
id: 12b901c2c194cb1fdd09c46991f1222ba9fa11c0b5281a0170d1d00d754900e3
title: Control Which Objects Guest and Community Users Can Query in Omnistudio
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_flexcard_datasource_allowlist.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_flexcard_datasource_allowlist.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b7ee04355ee76fb7d27d5c9f4fd442b27793fb83d8f7dc28edf77f052f20888f
description: Protect your org data by specifying which objects Experience Cloud guest users and authenticated community or portal users can query through Omnistudio. Omnistudio now blocks SOQL queries and SOSL searches that external users run through the HandleData() and HandleDataCards() methods unless every object in the query is on an allowlist that you maintain. Allowed queries run in user mode, so the user's object permissions, field-level security, and sharing rules apply.
products:
  - Cross Cloud
release: "264"
---
# Control Which Objects Guest and Community Users Can Query in Omnistudio

Protect your org data by specifying which objects Experience Cloud guest users and authenticated community or portal users can query through Omnistudio. Omnistudio now blocks SOQL queries and SOSL searches that external users run through the HandleData() and HandleDataCards() methods unless every object in the query is on an allowlist that you maintain. Allowed queries run in user mode, so the user's object permissions, field-level security, and sharing rules apply.

**Where:** This change applies to Experience Cloud Aura sites accessed through Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions with Omnistudio for Managed Packages.

**Who:** This change affects Experience Cloud guest users and authenticated community, portal, partner, and customer users who use components that load data through SOQL or SOSL queries, such as Flexcards, Vlocity Cards, custom Lightning components, and Industries cloud features. Internal users aren't affected. Data Mappers, Integration Procedures, Apex Remote actions, and REST data sources aren't affected.

**Why:** The allowlist is enforced by default and starts empty. Until you add the objects that your site components query, external users can't query any object through these methods, and affected components show no records. A fixed set of security and code objects, such as Apex classes and profiles, is always blocked and can't be added to the allowlist.

#### See Also

- [_Salesforce Help for Omnistudio_: Omnistudio for Managed Packages](https://help.salesforce.com/s/articleView?id=xcloud.os_setup_datasource_allowlist.htm&language=en_US)