I'm trying to use the Salesforce Rest API with the session ID I received via a SAML Response from the same Salesforce Instance (as IDP) but I get the message:

[{"message":"This session is not valid for use with the REST API","errorCode":"INVALID_SESSION_ID"}]

Is there a restriction on Session IDs received via SAML Response? I was following this intro: https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_curl.htm but i'm not able to call a custom webservice.

  • Is this even possible with a Session ID received via SAML Response?
  • Is there any other way of using Rest API with Session ID from SAML?
  • When you say SAML Response, are you talking about the actual SAML response from your IdP? Nov 20, 2019 at 19:27
  • Exactly. We use SF as the identity Provider and include the Session id as custom Attribute in the response. We would now want to use this session id to call the rest API of the same Salesforce org.
    – Chris.Walz
    Nov 20, 2019 at 19:42
  • Ah OK, so just to recap, Salesforce is you IdP and you are sending the Session Id / Access token, to your SP Application as a custom attribute correct? Nov 20, 2019 at 19:44
  • Yes that's correct.
    – Chris.Walz
    Nov 20, 2019 at 19:47
  • And I am guessing you are implementing Auth.ConnectedAppPlugin and adding a the attribute UserInfo.getSessionId() in the global override Map<String,String> customAttributes method Nov 20, 2019 at 19:53

1 Answer 1


So I just tried exactly what you said and it worked. I added the custom attribute $Api.Session_ID and then I performed this callout in POSTMAN:

GET /services/data HTTP/1.1
Host: {myidp}-dev-ed.my.salesforce.com
Authorization: Bearer 00Df{redacted}GdahsD37VNi2Pg6wNIb7SeCUzyrmD.
User-Agent: PostmanRuntime/7.19.0
Accept: */*
Cache-Control: no-cache
Host: {myIdP}-dev-ed.my.salesforce.com
Accept-Encoding: gzip, deflate
Connection: keep-alive
cache-control: no-cache

Would you be able to share a semi-redacted version of your sessionId so we can see if it is close to the expected format

  • Hm but that shows it's working... Must be some misconfiguration on my end. Now I only have to figure out what it is :) thanks a lot for your support.
    – Chris.Walz
    Nov 20, 2019 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .