Survey built using an existing hosted feature service returns all records on survey123.arcgis.com Data page

[Joshua-Young]

I created a new survey based on an existing hosted feature service view. The view filters the related records to only show related records for a specific department. The view works correctly in ArcGIS Enterprise 11.4 and ArcGIS Pro 3.4. However, on the survey123.arcgis.com website when I look on the data page all related records are displayed.

Does that mean anyone can get to all the records through the Survey123 products and bypass the filters in the hosted feature service view?

[abureaux]

Are you sure you aren't looking at the parent layer in the Surveys Site? If you are, then seeing everything would make sense. I don't recall ever being able to see view layers in that environment.

[Joshua-Young]

The item ID in the submission URL column in Survey123 Connect is for the hosted feature view and not the parent layer. I checked the web traffic on the Survey123 website, and the website is using the parent URL in all of its queries. So, the survey form is using the view, but the website is using the parent layer.

[abureaux]

As long as users don't have permission to view the parent data, it should be okay. Give it a test with a fake account, if you can. Obviously if permission levels are being ignored, bring it up with Esri Support so they can investigate and patch. 

Are you expecting your users to interact with data through the Surveys Site? Honestly, I don't have much experience with that as I personally would make something in Experience Builder for end users to interact with the data.

NOTE: I will reiterate that you should use a different account for testing this. If you are using an admin account, they ignore all permissions and give you access to everything (even in situations that they theoretically shouldn't).