I have an Outbound Message that is received by a php webserver. The session Id is extracted and as per https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_om_outboundmessaging_setting_up.htm the session id is used to call back into the originating Salesforce with a REST apex call. https://XXX.my.salesforce.com/services/apexrest/VI/Contact/003O00000XXXXXXIAH.

        $sf_url .= '/services/apexrest/VI/Contact/'.$sfObject;
          $this->_log('/onAfterRoute.txt', 'sfURL: '.$sf_url, FILE_APPEND);
          $this->_log('/onAfterRoute.txt', 'sessionId: '.$sessionId, FILE_APPEND);
        $curl = curl_init();
        curl_setopt_array($curl, array(
          CURLOPT_URL => $sf_url,
          CURLOPT_SSL_VERIFYPEER, false,
          CURLOPT_SSL_VERIFYHOST, false,
          CURLOPT_HTTPHEADER => array(
            "authorization: Bearer ".$sessionId,
            "cache-control: no-cache",
        $response = curl_exec($curl);
        $err = curl_error($curl);

The user configured on the Outbound Message has API and REST permissions but the REST apex call fails with "This session is not valid for use with the REST API". The help I've been able to find references 'Use Any Api Client' but that dates from 2019 and I can't find that permission in my profile. I think it is also a fairly broad permission and pretty open to abuse. The originating/destination salesforce site has MFA enabled if that is an issue. Does anyone know what permission I need to create a session id that can call an apex REST endpoint? Thanks, Greg.

I've also cross-posted this on developer.salesforce.com/forums without luck. Trying here for a different result.

1 Answer 1


Turns out the user account I was using for Outbound Message (and hence the session id) was a High Assurance account. It had all the permissions for REST API access but was High-Assurance. I switched to a non-High Assurance account and I'm off and racing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .