Many external Services allow you to register publically reachable URLs that will be called with or without a Payload as an event mechanism between systems.

I want my Managed Package to exactly have (= contain in the 1GP Package with zero or minimal configuration on the subscriber side) such an Endpoint and I am not sure how to do it.

I know I can expose a global Apex class as a REST endpoint. But I am unsure if that is really reachable by arbitrary external systems. I cannot make use of Connected Apps and similar proper auth systems as the external system doesn't "speak" them.

I also don't want to force subscribers to set up an "Experience Cloud" site.

Is this still possible?

1 Answer 1


I don't belive there's a way to do this without creating a site and giving the Site Guest User Profile access to the Apex class that implements the webservice.

I use this pattern a lot, but keep the webhook itself simple by having it take the request body and shove it into a platform event that it then publishes. With this pattern the Site Guest User Profile needs access to both the Apex Class and Create for the platform event, but it's the lightest option I've found with regards to configuration in the client org and means that the site user does not have access to anything in the org.

The platform events are picked up and handled by the Automated Process user, meaning there's no faffing with perms etc. but of course you have to be careful around what you do with the contents of the request (no need to tell you about that I know :)).

In the exposed webservice method I put a try/catch around everything and just return 200 OK whatever happens:

global static String inboundMessage() {
    try {
        String stringBody = RestContext.request.requestBody.toString();
        EventBus.publish(new Webhook_Event__e(Body__c = stringBody, Type__c = SOME_CONST_STRING_FOR_EVENT_REUSE);
    } catch (Exception e) {

    return 'OK';
  • Do you think I could use Apex and MDAPI to deploy all the needed Site artifacts after the app install? Oct 18, 2022 at 12:13
  • 1
    I can't remember if you can create the site itself doing that, might well be possible!
    – Matt Lacey
    Oct 18, 2022 at 12:26
  • 1
    What about exploitation options? I.e., if the hook is known and public and uses Events, then I can flood the endpoint consuming subscriber limits. Would be interested in your thoughts. Oct 18, 2022 at 12:29
  • 2
    Creating the 'site' domain is likely the sticky point in being able to deploy the Site completely programmatically via a Deploy. There also may be licensing constraints to concern yourself with -- i.e. I don't know how many Site instances an org gets and if they already have multiple Sites deployed, you may not be able to create another
    – daveespo
    Oct 18, 2022 at 12:52
  • 2
    @ChristianSzandorKnapp You're completely right of course. I stripped down code for this but including a token in the header and checking for that is a smart idea
    – Matt Lacey
    Oct 18, 2022 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .