Restrict User at Record Level using REST API

Summary

Can we restrict user accessing particular record (incident/organization) using REST API

Content

Hi

I have unique business requirement. Is there any way to restrict user accessing particular organization/incident records via REST API?

For example - If some one try to access particular organization/incident record from outside using REST API. Can we restrict user at Records level using API?

Org/Incident ID        Staff Account

1                                TEST

2                                TEST

3                               TEST2

 

We need to restrict user (TEST2) to access Org/Incident ID 1 & 2 but they can only access ID 3.

I know at agent desktop level, we can restrict using Profile permission (As shown in screenshot) but we need to give them API permission except accessing particular records.