Salesforce Docs Portal

Add Apex Class Permissions Checkers

Enable specific access to the classes used by remote action APIs for each user profile, permission set, or permission set group. Configure Apex class permissions checkers to ensure that users require explicit access to the Apex class that administers the remote action called from an Omniscript, Flexcard, Integration Procedure, or REST API.

For example, after you create a Lightning Platform site, publicly available APIs are enabled for the Site User profile based on the profile's Apex class access to some Apex classes. When you add an Apex class permissions checker, you ensure that unauthorized users, such as a guest user, can't access classes through the ApexRemote call implementing the Callable interface.

Important
Important Enable the ApexClassCheck setting to ensure the principle of least privilege and that unintentional unauthorized access isn’t provided to guest users.
Note
Note Users who use Remote Actions in Integration Procedures must have access to the object and record they're invoking through the action. If they receive an access error, they must be granted object and record access at the profile, permission set, or permission set group level.
Enable the ApexClassCheck setting.
  1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, then select Omni Interaction Configuration.
  2. Click New.
  3. For Name and Label, enter ApexClassCheck.
  4. For Value, enter true.
  5. Save your changes.
Important
Important During the week of February 2, 2026, Salesforce enables the ApexClassCheck setting by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions. See Security Checks for Omnistudio.