If I have an application which needs to update data in a user's org through the REST API, and I need to be able to update data for any user within that org using my application, what is the most ideal way to do this?

Currently I have a custom permission set which grants modify all permissions to my app's objects, which users must be granted in order to use the application. Then I retrieve the user's access token through OAuth and use that user's OAuth token to update data through the REST API for every user. 

 

I feel like this is a security issue since every user now has the ability to see every other user's records (only for  my application's objects) and I'm wondering if there is a better way. Is there a way to edit an org's data thruogh the REST API without having an OAuth token from a user within the org? Is there some way I can do this with just my connected app?

I noticed that my Lightning Out App in classic SF is no longer working and the console shows a parsing error.

myVF:504 Uncaught SyntaxError: Unexpected token u in JSON at position 14660

I tried reverting to a version that worked from 3 weeks ago, but it seems to still not work..
Here is my VF code.
myVF.page

<apex:page sidebar="false">
<apex:includeLightning />
    <div id="myDivId">
    </div>
    
    <script>
        var myUserContext = "{!$User.UITheme}";
        $Lightning.use("c:LEXComp", function() {
        $Lightning.createComponent(
            "c:LEXContainer",
            {},
            "myDivId",
            function(cmp) {
                console.log('component created');
                console.log(cmp);
            });
        });
     </script>
</apex:page>

The lightning component works fine separately and within the LEX environment, this seems to only be an issue with Lightning Out.

Hi All, I'm using the rest API for create a lead and I want to assign as lead owner a specific user, but when I create the lead through the api always assign the lead to the user that make the request.

The api version is 36 ( services/data/v36.0/sobjects/Lead ) and the POST payload looks like this
{"OwnerId":"<15 chars ref id>","FirstName":"<name>","LastName":"<lastName>","Company":"<company>","Email":"<email>"

It's posible to assign the lead at creation time?

Thx!