Apex Developer Guide

Apex Developer Guide
Release Notes
Getting Started with Apex
Writing Apex
Data Types and Variables
Control Flow Statements
Classes, Objects, and Interfaces
Classes
Interfaces
Keywords
Annotations
AuraEnabled Annotation
BeforeClass Annotation (Developer Preview)
Deprecated Annotation
Future Annotation
IntegrationTest Annotation (Developer Preview)
InvocableMethod Annotation
InvocableVariable Annotation
IsTest Annotation
JsonAccess Annotation
NamespaceAccessible Annotation
ReadOnly Annotation
RemoteAction Annotation
SuppressWarnings Annotation
TestSetup Annotation
TearDown Annotation (Developer Preview)
TestVisible Annotation
Apex REST Annotations
Classes and Casting
Differences Between Apex Classes and Java Classes
Class Definition Creation
Namespace Prefix
Apex Code Versions
Lists of Custom Types and Sorting
Using Custom Types in Map Keys and Sets
Working with Data in Apex
Document Your Apex Code
Running Apex
Debugging, Testing, and Deploying Apex
Apex Reference
Appendices
PDF

Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

JsonAccess Annotation

The @JsonAccess annotation defined at Apex class level controls whether instances of the class can be serialized or deserialized. If the annotation restricts the JSON or XML serialization and deserialization, a runtime JSONException exception is thrown.
The serializable and deserializable parameters of the @JsonAccess annotation enforce the contexts in which Apex allows serialization and deserialization. You can specify one or both parameters, but you can’t specify the annotation with no parameters. The valid values for the parameters to indicate whether serialization and deserialization are allowed:
  • never: never allowed
  • sameNamespace: allowed only for Apex code in the same namespace
  • samePackage: allowed only for Apex code in the same package (impacts only second-generation packages)
  • always: always allowed for any Apex code

This example code shows an Apex class marked with the @JsonAccess annotation.

1// SomeSerializableClass is serializable in the same package and deserializable in the wider namespace
2
3@JsonAccess(serializable='samePackage' deserializable='sameNamespace')
4public class SomeSerializableClass { }
5
6
7// AlwaysDeserializable class is always deserializable and serializable only in the same namespace (default value from version 49.0 and later)
8
9@JsonAccess(deserializable='always')
10public class AlwaysDeserializable { }

JsonAccess Considerations

  • If an Apex class annotated with JsonAccess is extended, the extended class doesn’t inherit this property.
  • If the toString method is applied on objects that mustn't be serialized, private data can be exposed. You must override the toString method on objects whose data must be protected. For example, serializing an object stored as a key in a Map invokes the toString method. The generated map includes key (string) and value entries, thus exposing all the fields of the object.

Versioned Behavior Changes

In versions 48.0 and earlier, the default access for deserialization is always and the default access for serialization is sameNamespace to preserve the existing behavior. From version 49.0 onwards, the default access for both serialization and deserialization is sameNamespace.