I am running into the exception

IO Exception: Unauthorized endpoint, please check Setup->Security->Remote site settings. endpoint = https://eu25.salesforce.com/services/Soap/m/42.0

when calling the Metadata API from an @future Apex method

private static void updateValueSet(Set<String> newTopics, String fieldName) {
    MetadataService.MetadataPort mdapi = new MetadataService.MetadataPort();
    mdapi.SessionHeader = new MetadataService.SessionHeader_element();
    mdapi.SessionHeader.sessionId = UserInfo.getSessionId();


    mdapi.updateMetadata(new List<MetadataService.Metadata>{ fieldMdApi });

even if this should work now as I have:

  1. MetadataService class uses v.46 and URL.getOrgDomainUrl().toExternalForm() + '/services/Soap/m/42.0'
  2. Org is on Winter '19 so UserInfo.getSessionId() even in @future should not return null.

I think with having 1. and 2. in place there is no need for a Remote Site Setting anymore. Is this a bug?

  • 2
    I have a hunch, it only works if you have my domain enabed, as https://eu25.salesforce.com/services/Soap/m/42.0 can be for any org in EU25 pod Sep 9, 2019 at 9:26
  • Very good hint. What do you think will only work with MyDomain enabled? URL.getOrgDomainUrl().toExternalForm() or UserInfo.getSessionId()? Is there a way for you to find out if this is documented anywhere? Sep 9, 2019 at 9:34
  • 2
    To bypass remote site settings, My Domain must be enabled in your org , here's docs: releasenotes.docs.salesforce.com/en-us/winter19/release-notes/… Sep 9, 2019 at 9:36
  • 1
    Can you add that as an answer and I can accept it? Thanks for you help. Sep 9, 2019 at 10:18

1 Answer 1


From SF Docs

To bypass remote site settings, My Domain must be enabled in your org

The reason being, without MyDomain and using instance name we can't guarantee that we would be just calling our org because multiple orgs can be on same pod.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .