salesforce-webhooks

name	salesforce-webhooks
description	Receive and verify Salesforce Outbound Messages (the native "webhook" for Flow/Workflow). Use when setting up a Salesforce Outbound Message listener, parsing the SOAP/XML notification, validating the OrganizationId, returning the required Ack response, or handling Account, Contact, Lead, Opportunity, and Case record changes. Also covers Platform Events / Change Data Capture as the streaming alternative.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Salesforce Webhooks (Outbound Messages)

Salesforce has no classic HMAC-signed webhook. The closest native push is the Outbound Message, configured on a Flow or Workflow Rule, which POSTs a SOAP/XML envelope to your HTTPS endpoint when a record changes.

There is no signature header. You authenticate the message by:

1. Validating <OrganizationId> in the SOAP body against your known 18-char Salesforce org id.
2. Enforcing HTTPS and restricting inbound traffic to Salesforce IP ranges.
3. Optionally mutual TLS (Salesforce can present a client certificate).

Your endpoint must return a SOAP <Ack>true</Ack> envelope with HTTP 200, or Salesforce retries the message for up to .