INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY" salesforce error

TL;DR

The record you are writing references another record (owner, account lookup, parent) that the running user cannot see. Identify which reference field carries the inaccessible id, verify the target record is visible to that user, then fix the owner, the lookup value, or the sharing setup.

Error

[ {
  "message" : "insufficient access rights on cross-reference id",
  "errorCode" : "INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY",
  "fields" : [ "OwnerId" ]
} ]

Steps

1. Read the fields array in the error. It usually names the culprit (OwnerId is the most common). Expected: you know which reference to investigate.
2. Query the referenced record as the integration user: SELECT Id FROM User WHERE Id = '[the owner id]'. Expected: zero rows means the user cannot see that record.
3. Check whether the referenced user is active and whether the integration user has "Transfer Record" style access or a sharing rule covering it. Expected: you find the access gap, often an inactive owner or a private-sharing model.
4. Fix the data URIs assign an active, visible owner or point the lookup at a record the user can see. Expected: the same write succeeds with no code change.
5. If the write must run as a privileged context, move it into an Apex path marked without sharing, scoped to exactly this operation. Expected: the operation succeeds without widening the user's everyday access.

When to use

• Insert or update fails with this exact error code.
• An agent's write-back job fails on OwnerId, AccountId, or a custom lookup while reads work fine.
• The failure started after a user deactivation, a territory change, or a sharing-model tightening.

When not to use

• INVALIDFIELDFORINSERTUPDATE (wrong field name, different fix).
• FIELDCUSTOMVALIDATION_EXCEPTION (a validation rule fired).
• Login or session errors (the call never authenticated at all).

Tool compatibility

• Salesforce REST, SOAP, and Bulk APIs; any object with lookups or owner fields.
• Sharing model settings in Setup; user deactivation workflows.

Variant phrasings

insufficient access rights on cross-reference id

The message text form of the same error; the fields array names the reference.

cross-reference entity errors on AccountId or custom lookups

Same cause on any lookup: the target record is outside the user's visibility.

Why it happens

Salesforce checks access to every referenced record at write time, not just the record being written. A valid id that the user cannot see fails the whole operation, which is why reads can work while writes fail.

Edge cases

• OwnerId pointing at a queue the user is not a member of fails the same way; queues are not visible to everyone by default.
• Merges and ownership transfers on records with manual shares can fail when the share rows reference deleted groups.
• Running the write in a flow with "system context" avoids it, but that bypasses sharing for everything the flow touches, so scope it tightly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nTNLBbxjMN8PHrk4Q8rgOA