Bypassing Header Based Authentication

Question

I am configuring a REST Hook between Salesforce and this marketing tool AutopilotHQ.

Rather than having Salesforce continuously poll to find out when there is new information to trigger from, Autopilot allows you to register a URL which they will call when events occur, called a "REST Hook". Whenever an event I have registered for occurs, for example a new contact being added to Autopilot - Autopilot will send a HTTP POST to your URL with information about that event for your system to act upon.

The issue I am having is that Autopilot does not support header-based authentication.

I keep receiving 401 Unauthorized Errors

Is it possible to design an end point to validate session id based on a URL parameter?

Example of the URL: https://CompanyName--userName.my.salesforce.com/services/apexrest/v1/AutoPilotService?session_id=xxxxstaticsessionidxxxxx

Answer 1

No there is not. There are two ways you can achieve what you are looking for. You can either create an intermediate layer (I.e. Heroku web app listener) that will perform the correct authentication and forward your request along to Salesforce. OR, you can expose your custom Apex REST endpoint via a Force.com Public Site