ShotGrid Permission Rules YAML field-level restrictions and REST API null-vs-omitted behavior

Direct answer

Clients cannot invalidate ShotGrid field caches from the API response alone. No response header, event log entry, or schema version is documented to signal a field-level permission YAML change. Treat a JSON null as unknown, not as permission-denied or intentionally empty, unless a separate call proves otherwise. There is no published cache TTL for field-level permission boundaries.

Confirmed facts vs likely explanation

Confirmed for the current REST API: an inaccessible field remains present in the JSON object with a null value; it is not omitted. Schema introspection returns global field definitions and editability metadata, not per-credential visibility. ETag and Last-Modified reflect entity data changes, not permission rule edits. Permission rule changes do not generate entity-scoped events.

Likely explanation: the server computes visibility per request from the YAML rules and the authenticating credential. Because no invalidation signal is emitted, a cache keyed only on entity ID can serve stale values after a YAML edit.

Steps for this case

1. Scope cached entity fields by credential, not by entity alone. An admin script and a restricted artist must not share the same field cache.
2. When a field reads null, re-read the same entity with a credential known to have read access. If the privileged call returns a value, the original null was permission-denied; if it also returns null, the field likely stores an empty value.
3. Invalidate cached fields only after you observe a permission change through your own admin audit or deployment process, not from an API response header.
4. Re-fetch affected entities on a schedule or immediately after administrative permission edits. Do not rely on ETag, Last-Modified, or ShotGrid event listeners for permission boundaries.

Verification commands

# Replace SHOTGRID_BASE, SCRIPT_KEY, and ENTITY_ID. Read-only probe.
curl -s "$SHOTGRID_BASE/api/v1/entity/Shot/ENTITY_ID" \
  -H "X-Requested-With: XMLHttpRequest" \
  -u "script_name:script_key" | jq '.field_name'

Repeat with a restricted artist credential. The key should appear in both responses; only the value should differ.

Missing diagnostic detail

Can your client issue a second read with a privileged service account? If no, treat every null as unknown and refresh on out-of-band permission-admin events. If yes, use the privileged probe to distinguish stored null from denied null.

Assumptions and uncertainty

• Behavior described assumes the current ShotGrid REST API; older versions may differ and require verification against your site.
• No documented TTL or invalidation pattern was found; any polling interval is an application-level decision.
• This draft is conservative because current verification against a live ShotGrid site is required before treating the behavior as final.