How to set up a JSON webhook integration between Salesforce and Franchise Ninja

How to set up a JSON webhook integration between Salesforce and Franchise Ninja

How to Set Up a JSON Webhook Integration Between Salesforce and Franchise Ninja

Salesforce can accept direct JSON webhooks. A JSON webhook allows external systems to send JSON data to your Salesforce org without requiring OAuth authentication. Below, you will find detailed information on how to set up the JSON webhook.

Salesforce Sites with Apex REST Resources
The most common and effective approach is using Salesforce Sites with Apex REST resources. Here's how it works:

Key Components:
  1. Force.com Sites Configuration: Creates a public, unauthenticated endpoint accessible from the internet
  2. Apex REST Resource: Handles the incoming JSON POST requests
  3. Guest User Profile: Manages permissions for the webhook endpoint

Basic Implementation Structure:




Complete Setup Process

Step 1: Create a Salesforce Site
  1. Navigate to Setup → Sites
  2. Create a new site with a unique URL (e.g., your-org.my.salesforce-sites.com/webhooks)
  3. Configure the site as active
Step 2: Create Your Apex REST Resource
  1. Build an Apex class with @RestResource annotation
  2. Use @HttpPost method to handle JSON webhook data
  3. Include JSON deserialization and processing logic
Step 3: Configure Site Permissions
  1. Access the site's Public Access Settings
  2. Enable your Apex class in "Enabled Apex Classes"
  3. Grant necessary object and field permissions to the Guest User profile
Step 4: Construct Your Webhook URL
The final webhook URL format is:


JSON Processing Capabilities

Salesforce can handle complex JSON structures through:
  1. Native JSON Deserialization: Using JSON.deserialize() method
  2. Custom Apex Classes: Create wrapper classes matching your JSON structure
  3. Dynamic JSON Parsing: For variable or unknown JSON structures
Example JSON Processing:


Security Considerations
While Salesforce can accept direct JSON webhooks, implementing proper security is crucial:

HMAC Signature Verification:


Additional Security Measures:
  1. IP whitelisting at the org level
  2. Minimal Guest User permissions (only required object/field access)
  3. Request logging for monitoring and debugging
  4. Custom validation logic for payload verification
Alternative Approaches
  1. Declarative Webhooks: A third-party application that provides a no-code solution for webhook integrations, supporting JSON payloads and offering a user-friendly interface for mapping webhook data to Salesforce objects.
  2. Outbound Messages: Traditional Salesforce approach that sends XML-formatted data to external systems, though this is primarily for outbound communication rather than receiving JSON webhooks.