We are planning to develop a REST webservice for creating a lead in our org.

This webservice should be accessible to all of our partners.

We are planning the following

  1. Create a web service class with HTTP POST (for creating a lead) and HTTP GET (for them to query a lead info with Id) methods.

  2. We already have a dedicated integration user login which we plan to give as the credentials which our partners will be using to connect to our org (simple username/password form of OAuth flow)

Is there any flaw in this design ? Or are we missing any pitfalls ?

  • I don't think you are missing anything. I think you are good to start.
    – Ratan Paul
    Commented Feb 15, 2016 at 5:38

2 Answers 2


I think, you may not require to develop the web services on your own for creating a lead and retrieving data of already created lead unless you want anything custom.

You can do this using the standard REST API by salesforce which has all the services for working with sobjects and sobject records.

Please check the following link for more information about it: Force.com REST API Working with records


Don't build an API. Use the standard one for basic CRUD.

All following comments relate to trust/security:

An integration account is best practice for internal integrations, but a bad idea to share outside your company.

Resetting a password shared by all those partners is kinda painful.

If they're all using the same credentials, it'll be hard to tell which partner created the lead.

You can't do any record privacy (i.e., a partner can only see leads they created). Without record ownership you can't keep them from seeing each other's leads. Even if you restrict them to API only access, they can still query via the standard API.

Salesforce IDs are sequential, so it'd be fairly easy to guess the IDs that you didn't create (that other partners did) just by the gaps.

You could create a custom web service to do all this, capture which partner they're coming from, and restrict the query that way, but you probably would be better off getting partner licenses for them and avoiding the work. Every call would need to have some kind of authentication information included so you could determine who's calling.

Your partners likely have the expectation that you don't share leads they bring you with other partners.

Finally, consider that these leads are people, who may have shared their contact info with a single partner, but weren't planning on their data being made available to all the partners without their consent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .