I'd like to make a rest api call from within my org.

From the docs "You can use a session ID instead of an OAuth 2.0 access token if you aren’t handling someone else’s password:"

in my VF page I use

    var restUrl = "https://" + window.location.hostname + "/services/data/v38.0/sobjects/Account/ -H " + "'Authorization: Bearer " + "{!$Api.Session_Id}'";

Shouldn't the value from restUrl be valid in doing a curl request or using an app like Postman to do HTTP requests?


I believe when you use $Api.Session_Id in Visualforce you get a different session than if you used UserInfo.getSessionId() from Apex.

See $API

$Api.Session_ID and GETSESSIONID() return the same value, an identifier for the current session in the current context. This context varies depending on where the global variable or function is evaluated. For example, if you use either in a custom formula field, and that field is displayed on a standard page layout in Salesforce Classic, the referenced session will be a basic Salesforce session. That same field (or the underlying variable or formula result), when used in a Visualforce page, references a Visualforce session instead.

See Different Session Ids in Different contexts

From your example code, the likely problem is using window.location.hostname for the domain. If this is coming from a Visualforce page it will be wrong for the REST API.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.