I've faced a strange issue during my development related to the API. My goal was to create a web service that will receive POST requests from different sources.

First service: It passes all the necessary data as the URL parameters. It has Content-Type : application/json and the empty body. There were no problems with it.

Second service: Here starts an interesting part. This service passes all the necessary parameters in the request body and has the Content-Type : application/x-www-form-urlencoded. This request always returned 401 error - Unauthorized. I've managed to figure out what exactly makes this request to crush.

The body of the request looks like: originalsenderid=%2B614XXX11XX1&body=This%20is%20a%20test%20message&message=This%20is%20a%20test%20G3C7FWKNOD.

If the body parameter has spaces (%20 or +) I'm getting a 401 error - Unauthorized.

If the body parameter has no spaces, like body=Thisisatestmessage everything works fine. Spaces in other parameters also accepted as expected.

What is important here that this issue is reproducible only with Content-Type : application/x-www-form-urlencoded. If I change it to Content-Type : application/json it also works fine. But I have no access to the request creation, so I can't customize the request.

Also, I am using the Public RESTful Web Service as described here. I tested it with the simple web service like this:

global class ReceiveData
        global static void doPost()
            RestRequest req = RestContext.request;

One more note - when I'm getting the issue with 401 error my endpoint is not even launched.

I'm not sure what additional info I should provide. I'm developing via scratch orgs so the link to my endpoint will be not valid soon.


endpoint that also reproduces an issue:


Debug log looks like this:

enter image description here


During the investigation I've noticed that this issue also reproducible only when you public domain has the additional pass specified. For example:

  • this one will return error:


  • this one works fine:


Maybe someone faced similar issues or can point me where my mistake is?

  • I just tried with Content-Type : application/x-www-form-urlencoded and passing the contents in the body as in your post, and everything seems to work fine. Does the request make to your doPost() method? – Jayant Das Apr 12 at 15:01
  • @JayantDas no it doesn't. I've reproduced the same issue on my dev org. I updated the post with the endpoint – Andrey Shkolnikov Apr 12 at 15:10
  • 401 would mean unauthorized access, i.e., not valid client credentials. But if you are able to get the response by just changing the content-type, then I wouldn't imagine that to be the case. As mentioned at least I was not able to reproduce this and it works perfectly fine with what you have described here. – Jayant Das Apr 12 at 15:33
  • @JayantDas I'm not using authorization at all. It is a public web service. I tried to reproduce this on several dev and scratch orgs and the behavior is always the same – Andrey Shkolnikov Apr 12 at 15:42
  • is it force.com site? – Pranay Jaiswal Apr 12 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.