Field-Level Security enforcement in REST API, exports and reports

[newbie1]

Hello

We would like to confirm how Field-Level Security is enforced outside the EspoCRM user interface.

Assume a Role has read access disabled for a specific field. A regular user or API user assigned to this Role then requests the corresponding record through the REST API.

Could an EspoCRM team member confirm the following?

1. Is the restricted field omitted from the REST API response?
2. Is this restriction enforced server-side?
3. Does the same restriction apply to list endpoints and related-record endpoints?
4. Is the field also excluded from exports performed by that user?
5. Can reports created or executed by that user access or display the restricted field?
6. Can workflows, BPM processes or formulas expose the field to a user who does not have read access to it?

The objective is to ensure that confidential fields cannot be accessed indirectly through the API, exports, reports or automation features.

Thank you.

[yuri]

Hi,

Restrictions are enforced server side. For CRUD API endpoints and exports.

As for reports, a user cannot create a report to retrieve fields they cannot access to. But an admin user can optionally create a Grid Report that will include restricted records.

> Can workflows, BPM processes or formulas expose the field to a user who does not have read access to it?

Workflows, BPM, formula have access to any fields by design. Only admin users can manage these tools.

[newbie1]

Thank you, this is very helpful.

I would just like to clarify the exception concerning Grid Reports.

If an administrator creates a Grid Report that includes restricted records or fields and makes it available to a regular user, are the regular user's record-level and field-level permissions still applied when the report is viewed or executed?

In other words, could an administrator-created report expose data that the viewing user cannot access through the regular interface or CRUD API?

Thank you.

[yuri]

Yes. An administrator can create a Grid Report that will contain data aggregated by the field that other users do not have access to. It's by design. There's a checkbox enabling/disabling access control for a particular Grid Report, only admin can do it.

[yuri]

I suggest trying it out in a demo.

[newbie1]

Thank you, understood.

We will test this behaviour in the demo and ensure that access control remains enabled for reports available to restricted users. We will also treat the ability to disable access control for Grid Reports as an administrator-only security setting.

Thank you for the clarification.