Outbound Message

Question 1

Considerations for “Outbound message” integration

Answer 1

1. Supports a single object.
2. The record Id field is mandatory in the message.
3. The session ID can also be included for the callback.
4. Messages are queued for 24 hours(if not delivered) and discarded after that.
5. If a message cannot be delivered, the interval between retries increases exponentially, up to a maximum of two hours between retries.
6. Messages are retried independent of their order in the queue. This may result in messages being delivered out of order.
7. You cannot build an audit trail using outbound messaging. While each message should be delivered at least once, it may be delivered more than once. Also, it may not be delivered at all if delivery cannot be done within 24 hours. Finally, as noted above, the source object may change after a notification is queued but before it is sent, so the endpoint will only receive the latest data, not any intermediate changes.
8. Because a message may be delivered more than once, your listener client should check the notification IDs delivered in the notification before processing.

Question 2

What are the different ways to trigger an outbound message?

Answer 2

• Workflow rules
• Approval processes
• Entitilement processes

Question 3

Security considerations for Outbound messages?

Answer 3

• The SessionId included in the outbound message is scoped only for API requests and doesn’t apply to UI requests.
• Lock down the client application’s listener to accept requests only from Salesforce IP ranges. While this action guarantees that the message came from Salesforce, it does not guarantee that another customer is not pointing to your endpoint and sending messages.
• The organization Id is included in each message. For more information about the Id field type, see ID Field Type. Your client application should validate that messages contain your organization Id.
• Use SSL/TLS. Using SSL/TLS provides confidentiality while data is transported across the internet. Without it, a malicious third party can eavesdrop on your data. This issue is especially important if you pass data with privacy requirements and you pass a SessionId with the message. Also, we authenticate the certificate presented on connection, ensure that it is from a valid Certificate Authority, and check that the domain in the certificate matches the one Salesforce is trying to connect. This prevents us from communicating with the wrong endpoint.
• When you select Send Session ID, only HTTPS is supported for the endpoint URL to ensure secure transmission of the session ID.

Question 4

What is the message timeout period in Outbound Messaging approach?

Answer 4

The default timeout period is 24 hours which can be extended to 7 days with request to Salesforce.

All failed messages after 24 hours are placed in a queue and administrators must monitor this queue for any messages exceeding the 24-hour delivery period and retry manually, if necessary.