Flow -> Apex -> Salesforce REST API: why "Unauthorized endpoint"?

Question

I have an Apex class that calls into Salesforce using a new HttpRequest().

When I call that Apex from Anon Apex, it works fine.

But when I call it from a Flow I am testing in FlowBuilder, it complains that I must deploy a RemoteSiteSetting for URLs on my own org. Like this:

Error Occurred: An Apex error occurred: System.CalloutException: Unauthorized endpoint, please check Setup->Security->Remote site settings. endpoint = https://ability-agility-9151-dev-ed--c.vf.force.com/services/data/v54.0/composite/graph

Somehow in the pure-Apex context it realizes it is calling back into "itself" and doesn't need additional authorization, but in the Flow context, it thinks it needs the Org's REST URLs to be authorized.

Is there a way to fix this?

Answer 1

Screen flows run from a slightly different domain than the org's canonical domain, and so you have to be careful about how you get the URL for the org.

Make sure you are getting the URL for the org using the URL class's getOrgDomainUrl() to get the current canonical domain:

Http h = new Http();
HttpRequest req = new HttpRequest();  
req.setEndpoint(Url.getOrgDomainUrl().toExternalForm()
   + '/services/data/v44.0/limits');

Common sample code uses getSalesforceBaseUrl() which returns the URL of the current connection to the Salesforce org. While in many contexts that will result in the canonical URL, not all -- screen flows being one of them.

Personally for consistency I think you should include callout=true Invokable method annotation, but as you have pointed out elsewhere that's not sufficient to resolve this issue.

@InvocableMethod(label='My Method with a local callout' 
                 description='Does really important things over the REST API' 
                 callout=true)