Use of deprecated instance URL
Why is this an issue?
Instance URLs (like na1.salesforce.com) are not stable because your org could be migrated from one instance to another. Hardcoded instance URLs will break when that happens and must be manually updated.
Instance migration: Salesforce may move your org to a different instance, breaking hardcoded URLs
My Domain requirement: Salesforce requires My Domain for many features and will eventually retire instance-based URLs
Security concerns: Instance URLs don't benefit from My Domain's enhanced security features
Examples
Example of incorrect code:
String endpoint = 'https://na1.salesforce.com/services/data/v58.0/sobjects';
<url>https://na1.salesforce.com</url>
Example of correct code:
String endpoint = URL.getOrgDomainUrl().toExternalForm() + '/services/data/v58.0/sobjects';
<url>https://mycompany.my.salesforce.com</url>
How can I fix violations?
Replace hardcoded instance URLs in Apex with
URL.getOrgDomainUrl()to resolve the URL dynamically.Replace hardcoded instance URLs in metadata with your org's My Domain URL.
Use Named Credentials for external callouts
Store base URLs in Custom Settings or Custom Metadata if they must be configurable
When should I disable this rule?
You can disable this rule if your org is on a Government Cloud instance with fixed URLs
Resources