Salesforce does not ship a feature called webhooks. It ships four things that do the job. Apex REST receives inbound calls, Apex callouts send outbound ones, Platform Events fan a single change out to many listeners, and Change Data Capture streams record changes without you writing trigger code. Which one you use depends on direction and volume, not preference.
Salesforce does not use the word "webhook" in the same way many modern platforms do. However, Salesforce fully supports webhook-style integrations using standard APIs, Apex, and event-based tools.
If you are searching for Salesforce webhook integrations, what you really want is a way to send or receive real-time HTTP callbacks between Salesforce and external systems.
This guide explains exactly how that works, when to use each approach, and how to implement Salesforce webhook integrations with clean, reliable code.
What Is a Webhook in Salesforce?
A webhook is an HTTP callback that sends data automatically when an event happens.
In Salesforce, webhook behavior is implemented using:
- Apex REST endpoints
- Outbound Messages
- Platform Events
- Change Data Capture
- Flows with HTTP callouts
Salesforce does not label these as webhooks, but functionally they behave the same way.
Common Salesforce Webhook Integration Use Cases
Salesforce webhook integrations are commonly used for:
Sending lead or opportunity updates to external apps Receiving real-time data from payment, messaging, or CRM tools Syncing data instantly instead of using batch jobs Triggering workflows in external systems when Salesforce data changes
Salesforce Webhook Patterns (What Actually Works)
| What you want | What to use | Watch out for |
|---|---|---|
| Salesforce tells an external system something changed | Apex callout from a trigger, queued asynchronously | Callouts are not allowed in the same transaction as a DML operation, so queue it |
| An external system tells Salesforce something changed | Apex REST endpoint with an @RestResource annotation | Authenticate every request, and never leave the endpoint anonymous |
| Several systems need the same change | Platform Events | Delivery is against your event allocation, not your REST API limit |
| You want record changes with no trigger code | Change Data Capture | You subscribe to a stream, so the consumer has to stay connected and replay on reconnect |
| Low volume, no Apex | Flow with an HTTP callout action | Fine for hundreds a day, not for thousands |
| What you want | What to use | Watch out for |
|---|---|---|
| Salesforce tells an external system something changed | Apex callout from a trigger, queued asynchronously | Callouts are not allowed in the same transaction as a DML operation, so queue it |
| An external system tells Salesforce something changed | Apex REST endpoint with an @RestResource annotation | Authenticate every request, and never leave the endpoint anonymous |
| Several systems need the same change | Platform Events | Delivery is against your event allocation, not your REST API limit |
| You want record changes with no trigger code | Change Data Capture | You subscribe to a stream, so the consumer has to stay connected and replay on reconnect |
| Low volume, no Apex | Flow with an HTTP callout action | Fine for hundreds a day, not for thousands |
Pattern 1: Salesforce Sending Webhooks (Outbound)
This is used when Salesforce needs to notify an external system.
Best options:
- Apex callouts
- Outbound Messages
- Platform Events with subscribers
Pattern 2: Salesforce Receiving Webhooks (Inbound)
This is used when an external system sends events to Salesforce.
Best option:
- Apex REST endpoints
Creating a Salesforce Webhook Using Apex REST (Inbound)
Apex REST is the most common and flexible way to receive webhooks in Salesforce.
Example: Simple Apex REST Webhook
@RestResource(urlMapping='/webhook/order') global with sharing class OrderWebhook { @HttpPost global static void receiveOrder() { RestRequest req = RestContext.request; String payload = req.requestBody.toString(); System.debug('Webhook payload: ' + payload); // Parse JSON and process data } }
This endpoint can receive POST requests from external systems like Stripe, Zapier, or custom apps.
Webhook URL format:
https://yourDomain.my.salesforce.com/services/apexrest/webhook/order
Sending Webhooks from Salesforce Using Apex Callouts
Salesforce can also act as the webhook sender.
Example: Apex Callout
HttpRequest req = new HttpRequest(); req.setEndpoint('https://example.com/webhook'); req.setMethod('POST'); req.setHeader('Content-Type', 'application/json'); req.setBody('{"event":"lead_created"}'); Http http = new Http(); HttpResponse res = http.send(req);
This sends real-time data to an external system when triggered by Apex logic.
Using Platform Events as Webhooks
Platform Events are Salesforce's event-driven webhook system.
When a Platform Event is published:
- Salesforce processes it internally
- External systems can subscribe
- Triggers, Flows, and Apex can react
Platform Events are best for:
- High-volume events
- Decoupled architecture
- Scalable integrations
Change Data Capture as a Webhook Alternative
Change Data Capture sends real-time notifications when Salesforce records change.
Best for:
- Data sync
- Analytics pipelines
- Replication systems
CDC works well when you need to know what changed rather than why it changed.
Salesforce Flow Webhooks (Low-Code Option)
Salesforce Flow can send HTTP callouts without Apex.
Best for:
- Simple webhook integrations
- Admin-managed workflows
- Rapid prototyping
Limitations:
- Less control
- Harder to scale
- Limited error handling
Authentication and Security for Salesforce Webhooks
Security is critical for webhook integrations.
Best practices:
- Use OAuth for outbound callouts
- Validate request signatures for inbound webhooks
- Use Named Credentials
- Never expose anonymous endpoints
- Log failures and retries
Common Mistakes in Salesforce Webhook Integrations
Not handling retries Blocking synchronous transactions Ignoring API limits Hardcoding endpoints Skipping authentication validation
Avoiding these mistakes significantly improves reliability.
Best Architecture for Salesforce Webhook Integrations
- Recommended architecture: External system sends webhook
- Apex REST
- Platform Event
- Async processing
This keeps:
- Transactions fast
- Logic scalable
- Errors isolated
When to Avoid Webhooks in Salesforce
Webhooks are not ideal when:
- Data can be synced in batches
- Strict ordering is required
- Payloads are very large
- Long-running processing is needed
In these cases, asynchronous APIs or middleware may be better.
Salesforce webhooks in short
Salesforce webhook integrations are implemented using Apex REST, Platform Events, Outbound Messages, and Change Data Capture. Salesforce can both send and receive webhooks. Apex REST is best for inbound webhooks, while Platform Events are ideal for scalable, event-driven integrations.
Frequently Asked Questions
Does Salesforce support webhooks?
Not under that name. Salesforce supports webhook-style integration through Apex REST for inbound calls, Apex callouts and Outbound Messages for outbound calls, and Platform Events or Change Data Capture for event streams. The behaviour is the same as a webhook; the vocabulary is different.
How do I create a webhook in Salesforce?
For an inbound webhook, create an Apex class annotated with @RestResource, expose a method with @HttpPost, and secure it with a Connected App or a Named Credential. For an outbound webhook, call the external URL from an Apex method marked @future or from a Queueable, triggered by a record change.
Why can I not make a callout directly from a trigger?
Salesforce blocks callouts in the same transaction as pending DML, because an open HTTP connection would hold a database lock for as long as the remote server takes to answer. Move the callout into an @future method or a Queueable and the trigger commits first.
Should I use Platform Events or a direct callout?
Use a direct callout when exactly one system needs to hear about the change and you want to know immediately whether it succeeded. Use Platform Events when more than one system cares, or when you want the publisher to stop caring who is listening. Events cost you delivery allocation rather than REST API calls.
Do webhooks count against the Salesforce API limit?
Inbound calls do, because every request to an Apex REST endpoint consumes one API call from the org's 24-hour allocation. Outbound Apex callouts do not consume the inbound API limit, but they are governed separately by the callout limits per transaction.
Final Thoughts
Salesforce supports webhook-style integrations in a powerful and flexible way. While Salesforce does not use the term "webhook" directly, Apex REST and event-based tools provide everything needed to build real-time integrations.
When implemented correctly, Salesforce webhook integrations are fast, secure, and production-ready.
