To align with modern security best practices, you can no longer send session IDs in outbound messages starting February 23, 2026. Instead, use OAuth to authenticate. When this change goes into effect, the new outbound message form won't include the option to send a session ID, the IncludeSessionId flag in the API will be ignored and set to FALSE, and the <sessionID></sessionID> element of an outbound message payload won't include a session ID.
Where: This change applies to Developer, Enterprise, Performance, and Unlimited editions.
When: The week of February 23, 2026.
How: Follow the guidance in Authorize Apps with OAuth instead of using a session ID.