it has been 2 days i gone through more than 20 to 30 articles without a solution. this is my need,

Current Scenario:

i have a Drupal website, it has two interfaces, where the user can access authenticated content by logging in. All the authenticated content will be coming as JSON responses from a dozen REST services in salesforce which we are calling as authenticated service because it happens once the user has been authenticated by salesforce and the communication established through sessionid or access_token.


There are situations where some of the usecases, for example New User Registration on Drupal website which needs to access salesforce REST service. Now, my issue is how to write unauthenticated REST service which can be used by Drupal. That service should get the user details as input and creates a portal user in salesforce. Only we can get a sessionid if the user is authenticated and using sessionid we can access the REST services. But in this case, do we have a solution?

Somebody told to try with RESTful service. I dont know how it is going to work for my issue and how the unauthenticated REST service differs from authenticated REST service?

Can someone shed some lights on this?

  • 1
    I see you flagged user31's answer as 'not an answer'. Can you leave a comment explaining why it falls short? We may be able to modify it to answer your question.
    – metadaddy
    Jan 28 '13 at 20:01
  • Pat, my apologies at first place. it was a premature activity from me. There are few points which i want to highlight here before users willing to answer has to consider before answering challenging queries. 1. If someone leaves an unrelated answer for a query, it leaves other expert users after seeing our query and this unrelated answer may leave without answering with a thought that somebody has answered it. 2. most often people coming to this place only after they exhausted by searching articles either through google search and so on. And they dont want to see a unrelated replies here. Jan 29 '13 at 2:11
  • @user31 i understood. what will happen if i expose a class (will contain logic to create a customer portal user) to public force.com website and access the site endpoint? is that possible? Jan 29 '13 at 10:29

Edit: Apex REST Web Services can now be availed to Force.com Site Guest Users, see tutorial.

Can anybody tell the difference between REST and RESTful services?

The REST API is available out of the box for all Objects in all Orgs. You don't need to write any server-side code to use it. The endpoints look like:


Apex REST Web Services are methods exposed on @annotated custom Apex classes which you create yourself. The endpoints look like:


  • both variants are subject to your total API request limits
  • you can Enable Apex Class Access on a Force.com Site to expose an Apex REST Web Service

My issue is how to write unauthenticated REST service which can be used by Drupal?

What about collecting the new user data in Drupal, unauthenticated, then doing a callout from your webserver, and finally returning the data to the (now) portal user? (This spawns new users which cost money, and your webserver holds the keys to the kingdom...)

Here's an example REST Web Service you could expose:

go to Setup > Develop > Sites, and create a new Force.com Site, first)

global with sharing class NewUserService {
  static global Id createPortalUser() {
    Account account = [SELECT Name FROM Account LIMIT 1];
    User user = new User(
      Username          = 'herpderp@example.com',
      Email             = 'herpderp@example.com',
      CommunityNickname = 'Derp Herpinson'
    Id userId = Site.createPortalUser(user, account.Id, 'secret');
    return userId;

Here's an example PHP implementation of the code you might need in Drupal:

 * Call the Apex REST Web Service containing your logic.    
$curl = curl_init();    
curl_setopt_array($curl, array(    
  CURLOPT_URL            => $response->instance_url . '/services/apexrest/NewUserService',
  CURLOPT_POST           => TRUE,    
$response = curl_exec($curl);    

This code is mostly fabricated but hopefully it gets you started :^] also, if you are surfacing data "on behalf of" the new user, don't forget you'll need to make another login API call.

  • Thanks. i appreciate your reply with examples, but you are still supplying an username and password to authenticate which i dont want. it should be an unauthenticated salesforce service which should serve the need. Jan 29 '13 at 2:20
  • 2
    As @user31 says, an unauthenticated Salesforce service would "spawn new users which cost money". You would be leaving yourself open to all sorts of attacks. Are you sure you want to have an unauthenticated endpoint that can make changes in your Salesforce org?
    – metadaddy
    Jan 29 '13 at 3:56
  • 3
    The link above says REST API can now be enabled for Force.com Site Guest Users. This is a bit ambiguous. You can use Apex to develop a custom restful API that utilizes the guest user. You can't use the guest user to use the built in existing REST API.
    – Ryan Guest
    Mar 11 '13 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.