When I do a GET request through the Chatter API at

/services/data/v30.0/connect/communities/<community id>/chatter/users/me/messages

I get the following error back from Salesforce:

403 Forbidden [{"errorCode":"ORIGIN_NOT_WHITELISTED","message":"Request received from non-whitelisted origin."}]

We use community users with API enabled to do this GET request.

I searched far and wide and nowhere can I find something about ORIGIN_NOT_WHITELISTED, neither in the Salesforce documentation as other sources.

Have any of you ever encountered this errror? What does this mean and how do can I solve this.

2 Answers 2


The error message you're seeing is from the cross-origin resource sharing (CORS) support for the Chatter REST API: https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/extend_code_cors.htm

If CORS support is already enabled in your org, then you simply need to whitelist the origin that you're making the request from. If CORS is not enabled, then it's likely your usage was unintentionally affected by a recent fix for CORS support. The team is working on solving that issue, but the fastest workaround is to enable CORS support and whitelist the origin.

  • This is something that was added in Winter 15 right? Then that could be indeed the problem, since this started only recently and it worked for months. I'll request CORS and will keep you posted about my progress.
    – Folkert
    Commented Nov 7, 2014 at 8:55
  • Yes, CORS support was added in Winter '15.
    – Beck
    Commented Nov 7, 2014 at 19:16
  • Activating CORS and whitelisting the origin was indeed the solution, thank you. Concerning the last 2 sentences of your answer: Do you mean that it would have still worked with CORS disabled, if that recent fix wouldn't have affected the CORS support?
    – Folkert
    Commented Nov 10, 2014 at 11:55

It could be about Profiles IP Login Restrictions. The error could come by the fact that a "trusted" IP range is set for the Profile of the User getting the error, and the User is on an IP which is outside that range.

Have a look here: http://help.salesforce.com/HTViewHelpDoc?id=security_networkaccess.htm&language=en_US

In order to fix it, edit the User's Profile enabled IP ranges so to include the User IP.

I hope that is the problem and I helped you solve it.

  • (Most probably the Profile of that User is Community User?)
    – MLucci
    Commented Nov 6, 2014 at 15:25
  • The profile has no Login IP Range, so they should be able to login from every IP.
    – Folkert
    Commented Nov 6, 2014 at 15:36
  • I tried... sorry if I got a bad advice through to you ;-)
    – MLucci
    Commented Nov 6, 2014 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .