Exposing endpoints

In the previous section, we saw how our new custom API was exposed at the endpoint /services/apexrest/hospital. The starting portion of this URL will be the instance for our Salesforce org, for example, https://um1.salesforce.com. Our endpoints are therefore accessible through the standard API authentication mechanisms—that is, using OAuth 2.0 or by passing sessionId into the request.

Accessing Salesforce APIs in this manner is covered in detail in the REST API Developers Guide and details how we can access APIs using the standard mechanisms. What about the instances where we want to expose an API to the public for use?

Note

In general, we will want our APIs to be authenticated to allow us to ensure that we are controlling the flow of information and keeping data private. There are some instances, however, where we will want to expose data to the public for it to be used. As an example, one organization I worked with maintained a public database of...