Get all field level permission from SOQL for an permission set

As stated in the SOAP API Documentation

FieldPermissions : Represents the enabled field permissions for the parent PermissionSet. This object is available in API version 24.0 and later.

So when querying the FieldPermissions object you'll only get the enabled permissions

Possible solution

1- You should query the list of all fields of an SObject with another mean, example using Apex

2- Query the FieldPermissions for a given permission set, then all the fields that are not listed in the result, are by default hidden in the FLS


As mentioned by @benahm, SOQL on FieldPermissions retrieves only enabled field permissions for the permission set.

Furthermore, as per chapter "Special Properties for Field Permissions" in documentation here, fields that are always readable and/or writable, don’t return a FieldPermissions record.

Note that getDescribe methods can also be accessed via REST API, refer to this guide

For example you can do a GET call to this endpoint to retrieve list of fields for Asset object: /services/data/v47.0/sobjects/Asset/describe/

From the response, fields list provides several attributes on each field, more info here

Note: The name of the attributes are different when getDescribe is called from API compared to via APEX, for e.g isNillable() becomes nillable for API result

So compare fields list attributes from getDescribe response with SOQL result on FieldPermissions.

If a field has nillable = false and permissionable = false but does not appear in SOQL on FieldPermissions, it means that field cannot be empty but we cannot assign FLS to it, then the field is always readable (e.g Id field wont appear on FieldPermissions result but PermissionRead is true)

If a field has nillable = true and permissionable = true but does not appear in SOQL on FieldPermissions, then we can deduce that PermissionRead and PermissionEdit is false

If a field has nillable = true and permissionable = true and appears in SOQL on FieldPermissions, then retrieve PermissionRead and PermissionEdit from FieldPermissions SOQL

If a field has nillable = true and permissionable = false and does not appear in SOQL on FieldPermission, then consider PermissionRead is true because it can be another type of field which is always readable e.g. CurrencyISOCode which can always have default currency field

For missing field from SOQL on FieldPermissions, also check the field attribute updateable from getDescribe response, to determine if field can have true or false for PermissionEdit .