Invoking a custom Apex REST
Web service method always uses system context. Consequently, the current user's credentials are
not used, and any user who has access to these methods can use their full power, regardless of
permissions, field-level security, or sharing rules. Developers who expose methods using the Apex REST annotations should
therefore take care that they are not inadvertently exposing any sensitive data.
Apex class methods that are exposed through the Apex REST API don't enforce object
permissions and field-level security by default. We recommend that you make use of the
appropriate object or field describe result methods to check the current user’s access
level on the objects and fields that the Apex REST API method is accessing. See
DescribeSObjectResult Class and DescribeFieldResult Class.
Also, sharing rules (record-level access) are enforced only when declaring a class
with the with sharing keyword. This requirement applies
to all Apex classes, including to classes that are exposed through Apex REST API. To enforce sharing rules
for Apex REST API methods, declare
the class that contains these methods with the with
sharing keyword. See Using the with sharing or without
sharing Keywords.
j