Ok, something is going on and I have no idea what.

I have this code to collect URL and session ID:

<apex:inputHidden id="hidServerUrl" value="{!apiServerUrl}" /> <apex:inputHidden id="hidSessionId" value="{!apiSessionId}" /> <script> document.getElementById('{!$Component.hidServerUrl}').value = '{!$Api.Enterprise_Server_URL_160}'; document.getElementById('{!$Component.hidSessionId}').value = '{!$Api.Session_ID}'; </script>

Then in extension code I generate external URL:

public ApexPages.PageReference createDocument() { insert newDoc; ApexPages.PageReference forkUrl = new ApexPages.PageReference('https://my.server.somewhere/Fork.aspx'); forkUrl.getParameters().put('did', newDoc.id); forkUrl.getParameters().put('api', apiServerUrl); forkUrl.getParameters().put('session', apiSessionId); return forkUrl; }

and this generates a proper URL:

https://my.server.somewhere/Fork.aspx?did=a0X70000000GIvl&api=https%3A%2F%2Fc.na5.visual.force.com%2Fservices%2FSoap%2Fc%2F16.0%2F00D700000008lOu&session=00D700000008lOu%21AQoAQMRwIIDxH3WUdRafQ06pLQFSrfNHfMS7ON53nte0XUfnJ4apPmNphgETMlsMgOh7lQX.kbhvyVd5qdxbbrE9z6sFqy.I

However when I hook up to session using this c# code:

using (SforceService api = new SforceService { Url = ApiUrl, SessionHeaderValue = new SessionHeader { sessionId = SfSession } }) { QueryResult qr = api.query(..... }

I get the invalid session ID on query:

INVALID_SESSION_ID: Invalid Session ID found in SessionHeader: Illegal Session

Now, here's a twist, if I launch the same page from a salesforce URL button (this button is not in apex, its a regular salesforce button defined on the custom object screen) defined as:

https://my.server.somewhere/Fork.aspx?did={!DMSDocument__c.Id}&api={!$Api.Enterprise_Server_URL_160}&session={!$Api.Session_ID}

I get this URL which works (it hooks up to session and the query works):

https://my.server.somewhere/Fork.aspx?did=a0X70000000GJ0M&api=https%3A%2F%2Fna5.salesforce.com%2Fservices%2FSoap%2Fc%2F16.0%2F00D700000008lOu&session=00D700000008lOu%21AQoAQMRwIIDxH3WUdRafQ06pLQFSrfNHfMS7ON53nte0XUfnJ4apPmNphgETMlsMgOh7lQX.kbhvyVd5qdxbbrE9z6sFqy.I

The api server name now does not have c. in the dns name (na5... instead of c.na5...) and session ID looks slightly different. HOwever the c# code works so the problem is not in my external code.

So, what is going on? Is Apex/VF broken and emits invalid ajax URL's and session ID's with {!$Api.xxx}? How do I resolve this as I must launch the URL from apex code (its a finale of a series of operations in a wizard)