Salesforce Docs Portal

Set Up the Object Allowlist for External User Queries in Omnistudio

Specify which objects Experience Cloud guest users and authenticated community or portal users can query through Omnistudio, so that external users reach only the data that your site needs.

Omnistudio components such as Flexcards, Vlocity Cards, custom Lightning components, and Industries cloud features run SOQL queries and SOSL searches through the Omnistudio HandleData() and HandleDataCards() methods. When an external user runs one of these queries, Omnistudio checks every object that the query references against the OmniStudioGuestAllowedObjects allowlist. If any object isn't on the allowlist, the query returns no data.

Enforcement is on by default. Until you add objects to the allowlist, external users can't query any object through these methods, so components on your Experience Cloud sites show no records. Internal users aren't affected. Data Mappers, Integration Procedures, Apex Remote actions, and REST data sources aren't affected.

Allowed queries run in user mode. The external user's object permissions, field-level security, and sharing rules apply, so a guest user sees only what the guest user profile allows.

These security and code objects are always blocked for external users, even if you add them to the allowlist:

  • ApexClass
  • ApexTrigger
  • ApexPage
  • ApexComponent
  • AuthProvider
  • ConnectedApplication
  • Certificate
  • NamedCredential
  • PermissionSet
  • PermissionSetAssignment
  • Profile
  • SetupEntityAccess

Allowlist Entry Rules

  • Use the object API name, not the label. For example, enter Product2, not Product.

  • For custom objects, include __c. For objects in a managed package, also include the namespace prefix, for example, vlocity_ins__InsurancePolicy__c.

  • Separate objects with commas. Entries aren't case-sensitive, and spaces around commas are ignored.

  • Wildcards aren't supported. Enter each object by name.

  • Include every object that the query references: the object in the FROM clause, objects reached through relationship fields such as Owner.Name (User), objects in child subqueries, and every object in a SOSL RETURNING clause.

  • The allowlist applies to the whole org, including every component on every Experience Cloud site.

Add the Allowlist in Orgs with an Omnistudio License That Use the Standard Data Model

  1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, and then select Omni Interaction Configuration.
  2. If EnforceCardDatasourceSecurity is listed, make sure its value is set to true. If the setting isn't listed, enforcement is on.

    Don't turn off EnforceCardDatasourceSecurity. Turning off enforcement makes setup objects accessible to external users.

  3. If EnforceCardDatasourceSecurity is not listed in the Omni Interaction Configuration page, click New Omni Interaction Configuration.
  4. In the Label field, enter EnforceCardDatasourceSecurity.
  5. In the Value field, enter true.
  6. Save your changes.
  7. Click New.
  8. In the Label and Name fields, enter OmniStudioGuestAllowedObjects.
  9. In the Value field, enter the API names of the objects that your site components query, separated by commas. For example, to let external users query accounts, contacts, and cases, enter Account,Contact,Case.
  10. Save your changes.
Tip
Tip If you aren't sure which data model your org uses, check which page exists in Setup. Orgs on the standard data model have Omni Interaction Configuration. Orgs on the custom data model have the General Settings custom setting.

Add the Allowlist in Orgs Without an Omnistudio License or Orgs That Use the Custom Data Model

  1. From Setup, in the Quick Find box, enter Custom Settings, and then select Custom Settings.
  2. Click G and find General Settings.
  3. If EnforceCardDatasourceSecurity is listed, make sure its value is set to true. If the setting isn't listed, enforcement is on.

    Don't turn off EnforceCardDatasourceSecurity. Turning off enforcement makes setup objects accessible to external users.

  4. If EnforceCardDatasourceSecurity is not present in the General Settings page, click Manage and then click New.
  5. In the Name field, enter EnforceCardDatasourceSecurity.
  6. In the Value field, enter true.
  7. Save your changes.
  8. Click New.
  9. In the Name field, enter OmniStudioGuestAllowedObjects.
  10. In the Value field, enter the API names of the objects that your site components query, separated by commas. For example, enter Account,Contact,Case.
  11. Save your changes.
Tip
Tip If you aren't sure which data model your org uses, check which page exists in Setup. Orgs on the standard data model have Omni Interaction Configuration. Orgs on the custom data model have the General Settings custom setting.

Give External Users Access to the Allowed Objects and Fields

Allowed queries run in user mode, so update the guest user profile and your community user profiles or permission sets. To find the guest user profile, in Experience Builder, go to Settings > General.

  1. Grant Read access to each object on the allowlist.
  2. Grant field-level Read access to every field that the query selects or filters on. If the user can't see a field, the whole query can fail.
  3. Make sure that sharing settings, guest user sharing rules, or sharing sets give the user access to the records.

Test as an External User

  1. To test as a guest user, open the site in a private or incognito browser window.
  2. To test as an authenticated user, log in as a test community user.
  3. Confirm that each component shows the expected data.

External users can now query the allowed objects through the HandleData() and HandleDataCards() methods, within the limits of their object permissions, field-level security, and sharing access.

Note
Note If your custom components call HandleData() or HandleDataCards() directly, make sure they handle an empty response, a null response, or an error, and show a message instead of a broken page.

Troubleshooting

Problem Potential Cause Resolution
A component shows no records for external users but works for admins The object isn't on the allowlist, or the allowlist setting is missing Add every object that the query references to OmniStudioGuestAllowedObjects.
A component is still empty after you add the main object A related object, such as User through Owner, or an object in a child subquery isn't on the allowlist Check every relationship field and every inner SELECT, and add those objects.
An error about field or object access The query passed the allowlist check, but user mode blocked it Grant object Read access and field-level Read access to the guest or community profile.
Fewer records than expected Sharing rules now apply to the user Review guest user sharing rules or community sharing sets.
A search or lookup shows an error The SOSL search has no RETURNING clause, or a RETURNING object isn't on the allowlist Add a RETURNING clause, and add each RETURNING object to the allowlist.
Entries don't take effect An object label was used instead of the API name, or the namespace or __c is missing Use exact API names, for example, vlocity_ins__InsurancePolicy__c.