I'm looking at building some additional integration between salesforce and a third party server as part of an ISV project, working across all editions including group and professional.
Currently the third party server calls salesforce using OAuth with the scope of "id" and "chatter_api" (via a connected app). The additional integration requirements cannot be done with just the chatter api so I'm looking at building some APEX REST APIs and get them whitelisted via the appexchange/isv program.
If I get them whitelisted how will this effect the scope of existing OAuth/Connected Apps?
- no effect at all (id + chatter_api is still ok)
- need to change scope to ( id + api ) as now accessing more than chatter api
I'm keen to avoid changing the scope to id + api as this may be seen as less secure as the third party server can now access a lot more objects within salesforce, which some salesforce customers might get nervous about.