What Outbound Messages do well
Outbound Messages are the veteran of Salesforce eventing: a declarative action (from Workflow Rules, and now Flow) that POSTs a SOAP XML message to a URL when a record meets your criteria. No code in your org, no external infrastructure, and for a low-volume notification into an internal system they can be enough. If that's your situation, keep them - this page is for the cases where their edges start to cut.
Where the edges are
Four properties matter once an Outbound Message feeds anything you'd call production:
| Outbound Messages | SFHooks | |
|---|---|---|
| Payload | SOAP XML envelope, and your endpoint must return a SOAP acknowledgement | Plain JSON POST - respond with any 2xx |
| Retry window | Per Salesforce's documentation: retries with increasing intervals for up to 24 hours, then the message is dropped | Jittered exponential backoff, up to 31 attempts over roughly 2½ days - then a 14-day dead-letter queue with one-click replay |
| Authenticity | No message signature - verifying the sender means validating the Salesforce client certificate or allow-listing IP ranges | Every delivery HMAC-SHA256 signed (X-SFHooks-Signature) with a timestamp and zero-downtime secret rotation |
| Observability | A monitoring queue in Setup while messages are pending, and no per-message delivery history once they clear | Per-event delivery log - payload, every attempt, response code, latency - plus live success rate and p95 per webhook |
| What triggers it | Workflow Rule / Flow criteria per object, configured field list | Change Data Capture: create/update/delete/undelete per object, with the changed-field list in the payload |
| Failure behavior | Endpoint down for a day → messages age out of the queue silently | Endpoint health states (healthy → degraded → failing → paused) with email alerts. Nothing ages out silently |
Comparison against Salesforce's documented Outbound Message behavior at the time of writing - check current Salesforce docs for your org's edition. Both systems deliver at-least-once and neither guarantees ordering.
The 24-hour problem, concretely
The scenario that hurts: your receiving service goes down Friday evening and comes back Monday morning. An Outbound Message queue retries through Saturday, gives up, and drops the remaining messages - the records changed, but you'll never hear about it, and nothing tells you what was lost. The same weekend with SFHooks: retries continue through the outage window, anything still undeliverable lands in the dead-letter queue with its full payload, and Monday morning is one "replay all" click. Your endpoint being down stops being a data-loss event.
Migrating an Outbound Message to a webhook
- Inventory what you have. Setup → Outbound Messages: note each message's object, trigger criteria, endpoint URL, and selected fields.
- Connect your org to SFHooks. OAuth - no package, no Apex. Enable Change Data Capture for the objects involved (Setup → Change Data Capture).
- Create one webhook per object, pointing at a new route on the same service. Filters can narrow fields, and criteria that lived in the Workflow Rule move into your handler (or a payload filter).
- Swap SOAP parsing for JSON and add the four-line HMAC verification - try it against a live payload first.
- Run both in parallel for a week, diffing what arrives. Then deactivate the Outbound Message.
Frequently asked
Do Salesforce Outbound Messages retry failed deliveries?
Yes, but only for 24 hours: Salesforce retries with increasing intervals and drops the message once the window closes. SFHooks retries with jittered exponential backoff for up to 31 attempts over roughly two and a half days, and anything still undeliverable is held in a dead-letter queue for 14 days with one-click replay.
Are Outbound Messages signed?
No - an Outbound Message carries no message signature, so verifying the sender means validating Salesforce's client certificate or IP allow-listing. Every SFHooks delivery is HMAC-SHA256 signed with a timestamp header, and signing secrets rotate with a zero-downtime overlap.
Can I keep using Workflow Rules with Outbound Messages?
Salesforce has scheduled Workflow Rules for retirement, while Outbound Messages remain available as a Flow action. If you're rebuilding the automation anyway, it's a natural moment to move the outbound leg to JSON webhooks with delivery guarantees.