wenting zhang
A sales AirApp should show each person only the customers assigned to them. Is filtering the list by the signed-in user the same as restricting record access? Could someone still see other records by calling the API directly?
Question
Closed · AnsweredDoes a “my customers” AirApp filter also restrict API access?
No. A “my customers” filter in an AirApp on Busabase changes what that screen shows; it is not a record-level permission rule. A person or agent who has read access to the whole Customer Base may still reach other customer records through another view or the API. Do not use a hidden list row to protect private customer data.
For actual separation, limit access at the Base/workspace boundary or put a server endpoint in front of the data that checks the signed-in user before returning each record. If each salesperson must be restricted within one shared Base, the AirApp filter alone cannot enforce that. Are you trying to simplify each person's daily view, or must other customers be inaccessible even through the API?
Your reply
Sign in to join the discussion. Reading is always open; you only need an account to post.
Sign in