I have some Apex code that tries to create a dummy class in the org. When I call the "create Apex class" method, the request's response is:

{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}

I run the following snippet in Apex anonymous:

SalesforceAPI api = new SalesforceAPI();

Here is the class:

public with sharing class SalesforceAPI
    final String endpoint = 'https://ap2.salesforce.com/services/data/v28.0/tooling/sobjects';

    // SomeValues to be store
    public String oid ;
    public String cid ;
    public String apmid ;
    public String carid ;

    public SalesforceAPI(){

    // used receive response by sending a http request
    private String getResponse(HttpRequest req)
            httpreq = new Http();
            res = httpreq.send(req);
            String reqresponse = res.getBody();
        catch (Exception e){return
        'Error:' +e.getMessage();}

    // create a http request with required endpoint and request method
    private HttpRequest createHttpRequest(String endpoint, String method)
        HttpRequest req = new
        endpoint += '';
        req.setHeader('Authorization', 'OAuth ' + UserInfo.getSessionID());
        req.setHeader('Content-Type', 'application/json');
        System.debug('Request: ' + req.getHeader('Authorization'));
        return req;

    public void createApexClass(){
        // create a Http request with post method
        HttpRequest req = createHttpRequest(endpoint+'/ApexClass','POST');
        //req.setBody( '{"Name":"NewApexClass1","Body":"public class NewApexClass1 {}"}');
        // send request and receive response
        String response = getResponse(req);
        System.debug('RESPONSE: ' + response);
        // These two lines have no role in creating apex class. So they can be ignored for now.
        //Map<String,Object> rmp = (Map<String,Object>)JSON.deserializeuntyped(response);
        //oid = (String)rmp.get('id');

The UserInfo.getSessionId() method is returning an id (it is not blank or null).

I have also tried running the code with and without the following Session Settings enabled:

'Lock sessions to the IP address from which they originated'

'Lock sessions to the domain in which they were first used'

'Enforce login IP ranges on every request'

Any information on what might be causing this problem or how I can go about troubleshooting it would be helpful.

  • Logout from organization and again Login into your organization... Now use UserInfo.getSessionId()
    – KS Kumaar
    Jan 9, 2017 at 5:33

1 Answer 1


A couple of things to check:

  1. Verify that the session is valid on ap2. If not, modify the endpoint subdomain as required.

  2. Check the Login History page on the target org. It might show additional details about the invalid session id.

Try something like the following that does work from anonymous Apex in my dev org:

HttpRequest req = new HttpRequest();
string endpointUrl = System.URL.getSalesforceBaseURL().toExternalForm() + '/services/data/v37.0/tooling';
req.setHeader('Authorization', 'OAuth ' + UserInfo.getSessionID());
req.setHeader('Content-Type', 'application/json');

Http httpreq = new Http();
HttpResponse res = httpreq.send(req);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.