Custom Field Creation Using Apex SOAP Call Without Configuring Remote Site Settings

Question

If we Configure Remote site settings the below code adds custom fields perfectly. When we remove Remote site settings it throws an exception "EXCEPTION: System.CalloutException: Unauthorized endpoint, please check Setup->Security->Remote site settings. endpoint = https://na11.salesforce.com/services/Soap/m/28.0/00DG0000000jGynMAE"

My Question is why should we configure remote settings because code gets executed in this org only.

Is there any way that we can get this without using Remote site settings.

 HTTP h = new HTTP();
HTTPRequest req = new HTTPRequest();
req.setMethod('POST');
req.setHeader('Content-Type', 'text/XML');
req.setHeader('SOAPAction', 'create');

String b = '<?xml version="1.0" encoding="UTF-8"?>';
b += '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">';
b += '<soapenv:Header>';
b += '<ns1:SessionHeader soapenv:mustUnderstand="0" xmlns:ns1="http://soap.sforce.com/2006/04/metadata">';
b += '<ns1:sessionId>' + UserInfo.getSessionId() + '</ns1:sessionId>';
b += '</ns1:SessionHeader>';
b += '</soapenv:Header>';
b += '<soapenv:Body>';
b += '<create xmlns="http://soap.sforce.com/2006/04/metadata">';
b += '<metadata xsi:type="ns2:CustomField" xmlns:ns2="http://soap.sforce.com/2006/04/metadata">';
b += '<fullName>sample__c.Amit__c</fullName>';
b += '<description>created by the DATA</description>';
b += '<type>Number</type>';
b += '<label>Test Data</label>';
b += '<scale>2</scale>';
b += '<precision>10</precision>';
b += '</metadata>';
b += '</create>';
b += '</soapenv:Body>';
b += '</soapenv:Envelope>';



req.setBody(b);
req.setCompressed(false);
req.setEndpoint('https://na11.salesforce.com/services/Soap/m/28.0/'+USERINFO.getOrganizationId()+'');
HTTPResponse resp = h.send(req);
System.debug(resp.getBody());

Answer 1

You're making a callout regardless, and Salesforce sees it as such. This means, you will need a remote site setting, even if you're calling back into your own Salesforce Instance.

Since you're looking to create a custom field programmatically, you'll likely need to stick with the metadata api, and hence, cannot get by without the callout nor remote site setting. If you're deploying this to other instances, you'll also need to create remote site settings there, provided your endpoint is changing.

Furthermore, I recommend taking a look at Andrew Fawcett's meta data api for Apex here: https://github.com/financialforcedev/apex-mdapi, especially if you want to get away from constructing your own XML.