--- schema_version: "1" id: 8dca77568ad4a367aac4a0e0636837ce9fdab5b8a9f98e1d2c5afc5a09876bef title: Add an Apex Class Permissions Checker (Managed Package) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/os_add_an_apex_class_permissions_checker_1.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.os_add_an_apex_class_permissions_checker_1.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 528a9e1584777b24ad56b9f38e432de2806d0ca49d8c94433ecd128bfaef3655 description: For the managed package runtime, enable specific access to the VlocityOpenInterface Apex class used by remote action APIs for each user or profile, permission set, or permission set group. Use the Apex class check setting to enable users with permission sets or permission set groups to call allowlisted Apex classes remotely. Configure an Apex class permissions checker to ensure that users require explicit access to the Apex class that administers the remote action called from an Omniscript, Integration Procedure, Flexcard, Classic Card, or REST API. products: - Omnistudio release: "264" --- # Add an Apex Class Permissions Checker (Managed Package) For the managed package runtime, enable specific access to the VlocityOpenInterface Apex class used by remote action APIs for each user or profile, permission set, or permission set group. Use the Apex class check setting to enable users with permission sets or permission set groups to call allowlisted Apex classes remotely. Configure an Apex class permissions checker to ensure that users require explicit access to the Apex class that administers the remote action called from an Omniscript, Integration Procedure, Flexcard, Classic Card, or REST API. ![Managed Package app icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/resources-global/_corporate/images/managedpackageicon.png) This information is for Omnistudio for Managed Packages. For Omnistudio on standard runtime, see [Omnistudio Help](https://help.salesforce.com/s/articleView?id=xcloud.os_omnistudio_standard.htm&language=en_US). For example, after you create a Lightning Platform site, publicly available APIs are enabled for the Site User profile based on the profile's Apex class access to RestResource Apex classes. When you add an Apex class permissions checker, you ensure that unauthorized users, such as a [guest user](https://developer.salesforce.com/docs/atlas.en-us.community_templates.meta/community_templates/rss_config_guest_user_profile.htm), can't access classes through the Vlocity/V1/GenericInvoke/ API. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important Enable the `ApexClassCheck` setting to ensure the principle of least privilege and that unintentional unauthorized access isn’t provided to guest users through the Vlocity/V1/GenericInvoke/ API. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important During the week of February 2, 2026, Salesforce enables the ApexClassCheck setting by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions. Previously, Apex class checks were performed only for the Apex classes assigned to the user’s profile. With the new advanced Apex class check setting, perform Apex class checks for both the Apex classes assigned to the user’s profile and the Apex classes assigned to the user's permission sets or permission set groups. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_note.png) Note In Vlocity Industries managed package orgs, Apex class validation during direct Integration Procedure execution is enforced through the ApexClassCheckForIP flag, as this scenario is not covered by the ApexClassCheck flag alone. This behaviour applies to Insurance (INS), Communications, Media, and Energy (CME), and Financial Services Cloud – Insurance (FSC-INS). See [Advanced Apex Class Check for Integration Procedures in Omnistudio for Managed Packages](https://help.salesforce.com/s/articleView?id=xcloud.os_ip_advanced_apex_class_check.htm&release=264.0.0&type=5 "The advanced Apex class check is performed through the ApexClassCheckForIP security flag. The ApexClassCheckForIP flag strengthens Omnistudio security by enforcing Apex class access checks during Integration Procedure execution. This enhancement makes sure that users have the required permissions to run custom Apex classes referenced within Integration Procedures."). If you're an Omnistudio customer, review your configuration for these insecure configurations, which could provide broader unintentional access to unauthorized Apex classes than desired: - Implemented the `InvokeMethod` of `VlocityOpenInterface` class within an Omniscript, Integration Procedure, a Flexcard, or a Data Mapper. - Added sensitive implementation inside `InvokeMethod`. - Provided Apex class access to the `BusinessProcessDisplayController`, `ApplicationService`, and `ComponentController` classes for the guest user profile. - Disabled the `ApexClassCheck` setting. 1. If the Omnistudio license isn’t available in your Salesforce org (for example, if you have installed Omnistudio as part of the CME or Insurance managed package), enable the `ApexClassCheck` setting from the General Settings section. 1. From Setup, in the Quick Find box, enter Custom Settings, and then select **Custom Settings**. 2. Click **General Settings**. 3. Click **Manage**. 4. Click **New**. 5. In Name, enter ApexClassCheck. 6. In Value, enter true. ![ApexClassCheck in General Settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/omnistudio_for_managed_packages/images/os_apex_class_check.png) 7. Save your changes. 2. If the Omnistudio license is enabled in your org, enable the `ApexClassCheck` setting from the Omni Interaction Configuration section: 1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, and then select **Omni Interaction Configuration**. 2. Click **New Omni Interaction Configuration**. 3. In Name and in Label, enter ApexClassCheck. 4. In Value, enter true. ![New Omni Interaction Configuration](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/omnistudio_for_managed_packages/images/os_vlocity_new_omni_interaction_config.png) 5. Save your changes.