Webhooks

Webhooks bring provider delivery events back into Salesforce, where they become normalized records and Platform Events.

Endpoint

POST https://<site-domain>/services/apexrest/rme/v1/events/{provider}

Expose the endpoint through a Salesforce Site or Experience Cloud site with guest access limited to the webhook Apex class only. The guest user needs no object permissions — event processing runs without sharing inside the packaged service.

Signature verification

Every provider payload is verified before it is trusted. Unsigned or mismatched requests are rejected with 401 and logged.

@HttpPost
global static void handle() {
    RestRequest req = RestContext.request;
    String provider = RME_Router.providerFromPath(req.requestURI);
    if (!RME_ProviderRegistry.get(provider).verifySignature(req, RME_Secrets.webhookSecret(provider))) {
        RestContext.response.statusCode = 401;
        return;
    }
    RME_EventIngestion.enqueue(provider, req.requestBody.toString());
    RestContext.response.statusCode = 202;   // accept fast, process async
}

Secrets are stored in Protected Custom Settings within the managed package namespace and are never readable by subscriber code.

Processing model

Provider → HTTPS POST → signature check → 202 Accepted
                                   ↓
                        Queueable ingestion
                                   ↓
                normalize → Delivery_Status__c upsert
                                   ↓
                    publish RME_Delivery_Event__e

Accepting fast and processing asynchronously keeps providers from retrying due to Apex transaction time.

Idempotency

Events are upserted on Provider_Event_Id__c, so provider retries and duplicate deliveries never create duplicate records or duplicate Platform Events.

Replay and backfill

Providers retry failed deliveries for a limited window. If ingestion was down longer than that, backfill from the provider API:

RME_EventBackfill.run('SENDGRID',
    Datetime.newInstance(2026, 8, 1, 0, 0, 0),
    Datetime.newInstance(2026, 8, 2, 0, 0, 0));

Outbound webhooks

RME can also call your systems when something happens in Salesforce. Configure an Outbound_Webhook__c with a Named Credential, event filter, and HMAC secret; payloads use the same normalized event shape and are signed with X-RME-Signature.

Continue to API Reference.

Last updated 1 month ago