Salesforce Webhooks (Outbound Messages)

Salesforce has no classic HMAC-signed webhook. The closest native push is the Outbound Message, configured on a Flow or Workflow Rule, which POSTs a SOAP/XML envelope to your HTTPS endpoint when a record changes.

There is no signature header. You authenticate the message by:

1. Validating <OrganizationId> in the SOAP body against your known 18-char Salesforce org id.
2. Enforcing HTTPS and restricting inbound traffic to Salesforce IP ranges.
3. Optionally mutual TLS (Salesforce can present a client certificate).

Your endpoint must return a SOAP <Ack>true</Ack> envelope with HTTP 200, or Salesforce retries the message for up to 24 hours.

When to Use This Skill