Feature: Support Named Credentials for REST log saves

README.md

@@ -226,7 +226,7 @@ Apex developers can use additional `Logger` methods to dynamically control how l
 - Enum `Logger.SaveMethod` - this enum can be used for both `Logger.setSaveMethod(saveMethod)` and `Logger.saveLog(saveMethod)`
   - `Logger.SaveMethod.EVENT_BUS` - The default save method, this uses the `EventBus` class to publish `LogEntryEvent__e` records. The default save method can also be controlled declaratively by updating the field `LoggerSettings__c.DefaultSaveMethod__c`
   - `Logger.SaveMethod.QUEUEABLE` - This save method will trigger `Logger` to save any pending records asynchronously using a queueable job. This is useful when you need to defer some CPU usage and other limits consumed by Logger.
-  - `Logger.SaveMethod.REST` - This save method will use the current user’s session ID to make a synchronous callout to the org’s REST API. This is useful when you have other callouts being made and you need to avoid mixed DML operations.
+  - `Logger.SaveMethod.REST` - This save method makes a synchronous callout to the org’s REST API. By default it uses the current user’s session ID; configure the `LoggerParameter.RestApiNamedCredential` custom metadata record with a Named Credential API name to use a Named Credential instead. The Named Credential must have its endpoint and External Credential principal permissions configured in the org; those credentials are intentionally not packaged by Nebula Logger. For JWT, SAML, API-only, and other machine-to-machine contexts, also set `LoggerParameter.RestApiRequireNamedCredential` to `true` so the logger fails with a catchable configuration error instead of attempting to access an unavailable session ID (the upstream #995 behavior for issue #761). REST saves automatically chunk records at 200 and at a conservative 5 MB request-body limit, respect the transaction’s remaining callout budget, and validate every record-level result returned by Salesforce. Confirmed successful chunks are removed from the buffer; a failed or ambiguous chunk remains buffered and may be delivered again on retry.
   - `Logger.SaveMethod.SYNCHRONOUS_DML` - This save method will skip publishing the `LogEntryEvent__e` platform events, and instead immediately creates `Log__c` and `LogEntry__c` records. This is useful when you are logging from within the context of another platform event and/or you do not anticipate any exceptions to occur in the current transaction. **Note**: when using this save method, any exceptions will prevent your log entries from being saved - Salesforce will rollback any DML statements, including your log entries! Use this save method cautiously.
 
 ### Track Related Logs in Batchable and Queuable Jobs

docs/apex/Configuration/LoggerParameter.md

@@ -62,6 +62,18 @@ Indicates if Nebula Logger will store tags in the custom objects `LoggerTag__c`
 
 The name of the Platform Cache partition to use for caching (when platform cache is enabled). Controlled by the custom metadata record `LoggerParameter.PlatformCachePartitionName`, or `LoggerCache` as the default
 
+#### `REST_API_NAMED_CREDENTIAL` → `String`
+
+The API name of the Named Credential used when saving logs via the REST API. Values may be entered as either `MyNamedCredential` or `callout:MyNamedCredential`; both are normalized to the same endpoint. Configure the Named Credential and its External Credential principal permissions in the subscriber org; no credential metadata or secret is included in the package. When this parameter is blank, Nebula Logger uses the current user's session ID and the org domain URL instead. Controlled by the custom metadata record `LoggerParameter.RestApiNamedCredential`, or the session ID fallback when blank.
+
+For JWT, SAML, API-only, and other machine-to-machine contexts, set `LoggerParameter.RestApiRequireNamedCredential` to `true`. This prevents the uncatchable platform exception that can occur when `System.UserInfo.getSessionId()` is unavailable and returns a catchable configuration error instead.
+
+REST saves are split into requests of no more than 200 records and are also capped at a conservative 5 MB serialized request body. The implementation checks the remaining transaction callout budget before sending any request. Every 2xx response must contain one successful result with a record ID for each submitted record; HTTP 200 responses with item-level errors are treated as failures and the logger buffer is retained for retry. Because `allOrNone` is enabled, a failed response retains the complete chunk, including any mixed-success response, so retries are at-least-once and callers should design downstream handling accordingly.
+
+#### `REST_API_REQUIRE_NAMED_CREDENTIAL` → `Boolean`
+
+Requires `Logger.SaveMethod.REST` to use a Named Credential. Set this to `true` for JWT, SAML, API-only, and other machine-to-machine contexts where a session ID is unavailable; a missing `RestApiNamedCredential` then produces a catchable configuration error before any callout. Controlled by the custom metadata record `LoggerParameter.RestApiRequireNamedCredential`, or `false` as the default for backwards compatibility.
+
 #### `QUERY_APEX_CLASS_DATA` → `Boolean`
 
 Controls if Nebula Logger queries `Schema.ApexClass` data. When set to `false`, any `Schema.ApexClass` fields on `LogEntryEvent__e` and `Log__c` will not be populated Controlled by the custom metadata record `LoggerParameter.QueryApexClassData`, or `true` as the default

nebula-logger/core/main/configuration/classes/LoggerParameter.cls

@@ -215,6 +215,41 @@ public class LoggerParameter {
     private set;
   }
 
+  /**
+   * @description The API name of the Named Credential used when saving logs via the REST API. The optional
+   *              `callout:` prefix is accepted and normalized. When this parameter is blank, Nebula Logger
+   *              uses the current user's session ID and the org domain URL instead.
+   *              Controlled by the custom metadata record `LoggerParameter.RestApiNamedCredential`,
+   *              or the session ID fallback when blank
+   */
+  public static final String REST_API_NAMED_CREDENTIAL {
+    get {
+      if (REST_API_NAMED_CREDENTIAL == null) {
+        REST_API_NAMED_CREDENTIAL = getString('RestApiNamedCredential', null);
+      }
+      return REST_API_NAMED_CREDENTIAL;
+    }
+    private set;
+  }
+
+  /**
+   * @description Indicates if REST log saving must use a Named Credential rather than the current user's session ID.
+   *              Set this to `true` for JWT, SAML, API-only, and other machine-to-machine contexts where
+   *              `System.UserInfo.getSessionId()` is not available. When `false`, the session ID fallback is
+   *              retained for backwards compatibility with interactive transactions.
+   *              Controlled by the custom metadata record `LoggerParameter.RestApiRequireNamedCredential`,
+   *              or `false` as the default
+   */
+  public static final Boolean REST_API_REQUIRE_NAMED_CREDENTIAL {
+    get {
+      if (REST_API_REQUIRE_NAMED_CREDENTIAL == null) {
+        REST_API_REQUIRE_NAMED_CREDENTIAL = getBoolean('RestApiRequireNamedCredential', false);
+      }
+      return REST_API_REQUIRE_NAMED_CREDENTIAL;
+    }
+    private set;
+  }
+
   /**
    * @description Controls if Nebula Logger queries `Schema.ApexClass` data.
    *              When set to `false`, any `Schema.ApexClass` fields on `LogEntryEvent__e` and `Log__c` will not be populated

nebula-logger/core/main/configuration/customMetadata/LoggerParameter.RestApiNamedCredential.md-meta.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomMetadata xmlns="http://soap.sforce.com/2006/04/metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+    <label>REST API Named Credential</label>
+    <protected>false</protected>
+    <values>
+        <field>Comments__c</field>
+        <value xsi:nil="true"/>
+    </values>
+    <values>
+        <field>Description__c</field>
+        <value xsi:type="xsd:string">The API name of the Named Credential used when saving logs via the REST API. Use a Named Credential with an org-domain or external endpoint and configure its External Credential principal permissions separately. The optional callout: prefix is accepted. When blank, REST saving uses the current user's session ID for backwards compatibility.</value>
+    </values>
+    <values>
+        <field>Value__c</field>
+        <value xsi:nil="true"/>
+    </values>
+</CustomMetadata>

nebula-logger/core/main/configuration/customMetadata/LoggerParameter.RestApiRequireNamedCredential.md-meta.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomMetadata xmlns="http://soap.sforce.com/2006/04/metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+    <label>Require REST API Named Credential</label>
+    <protected>false</protected>
+    <values>
+        <field>Comments__c</field>
+        <value xsi:nil="true"/>
+    </values>
+    <values>
+        <field>Description__c</field>
+        <value xsi:type="xsd:string">When set to true, REST log saving fails before a callout unless RestApiNamedCredential is configured. Enable this for JWT, SAML, API-only, and other machine-to-machine contexts where System.UserInfo.getSessionId() is unavailable. The default is false for backwards compatibility.</value>
+    </values>
+    <values>
+        <field>Value__c</field>
+        <value xsi:type="xsd:string">false</value>
+    </values>
+</CustomMetadata>