---
title: "Comment by Neil Fernandez on \"SaaS REST for VPD Multi-Tenant APEX Apps\" | Hashnode"
description: "Hi Matt, Fantastic write up! Want to note that this example now requires the use of setting up an APEX session for an ORDS handler whereas before there was no A"
url: "https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8"
---

[Discussion](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac)

Comment [SaaS REST for VPD Multi-Tenant APEX Apps](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac)

[Neil Fernandez](https://hashnode.com/@neilfernandez)

[Mar 11, 2024](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8)

Hi Matt,

Fantastic write up!

Want to note that this example now requires the use of setting up an APEX session for an ORDS handler whereas before there was no APEX session. So, this adds a **small** amount of overhead to each REST call which VPD requires set up regardless. One **_may_** want to consider using their own custom Context that they manage the set up of it **_if_** that becomes an issue. It should not be an issue for most. The write up above is ideal for the majority! Just wanted to add that in.

Also, for point 14 you mentioned QuickSQL breaks without that grant? Mind sharing that part? I did not see mention of QuickSQL until that part so wondering if that is a typo or if not would like to investigate what is occurring.

Best, Neil

[Matt Mulvaney](https://hashnode.com/@lufcmattylad)

[Mar 11, 2024](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8#reply-65ef1586f5659afb71f4ae12)

Hey Neil. Thanks for your nice comments. Using apex\_session.set\_tenant\_id **is the standard, built-in, method of setting a tenant in APEX**, is it not? Unfortunately this procedure does require an APEX session first (See my evidence below - and I also point out that this requirement isn't stated in the documentation). Therefore yes, using this standard approach adds an overhead to REST because of the requirement to establish a session first (i.e REST must set the context in the same consistent way as APEX does - i.e using apex\_session.set\_tenant\_id). A custom context would be quicker for sure. I'll update the blog with a note, however I didn't want this blog to deviate from something is effectively the standard approach for VPD/SaaS for APEX. Is there possibility to remove this requirement (i.e to establish a session first) from apex\_session.set\_tenant\_id a future release of APEX?

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1710166596237/879aea1a-6e89-43de-a028-e87a5e5d708a.png)

[Matt Mulvaney](https://hashnode.com/@lufcmattylad)

[Mar 11, 2024](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8#reply-65ef191cd4ddbfb93477da0f)

Regarding QuickSQL, I haven't been able to reliably reproduce. I'll keep the grant, but lose the reference to QuickSQL

[Neil Fernandez](https://hashnode.com/@neilfernandez)

[Mar 11, 2024](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8#reply-65ef1a1559f2b11653c16ccd)

[Matt Mulvaney](https://hashnode.com/@lufcmattylad)

You are correct! I just wanted to denote that there **_may_** be a need to deviate, but I believe creating a session, setting tenant\_id, by the APEX API's is definitely preferred/only approach when using the provided tenant system from APEX. So, the write up is perfect.

I will raise an ER to see if there can be a version (specific for ORDS) that does not require creating an APEX session :)

[Neil Fernandez](https://hashnode.com/@neilfernandez)

[Mar 11, 2024](https://hashnode.com/posts/saas-rest-for-vpd-multi-tenant-apex-apps/65eeca720ac778cd331d47ac/comment/65ef08d9aa085cca840b9bd8#reply-65ef1e78ce5823b87dd07181)

[Matt Mulvaney](https://hashnode.com/@lufcmattylad)

Ah so if you create a prehook, and don't execute the grant, it sometimes breaks QuickSQL?