We have built a complex application and expose it using the high volume portal licenses. The users of this app have restricted access to our salesforce data, this is controlled by the application.

We would like to expose certain features of this portal app via an api. What is the best way to do this? (we dont want to give wide open salesforce access via normal salesforce api's).

We have a very custom access method setup, so using the builtin salesfoce access control wont work.


You can build your own API interfaces (e.g. via Visualforce pages exposed on the site) that can call your custom methods, thereby protecting the data. They can then be accessed through normal XMLHttpRequest calls.


Page: exportData

<apex:page controller="exportData" contentType="application/json">{!json}</apex:page>


public with sharing class exportData {
    // place your member variables here

    public exportData() {
        // Load page parameters and initialize the controller

    public class Results {
        // store the data you want to expose here
        public Boolean success; // indicates success or failure, if applicable.

    public String getJSON() {
        Results result = new Results();
        // Perform your primary logic here
        result.success = true;
        return JSON.serialize(result);

At this point, you can call the page like an API:

var xml = new XMLHttpRequest();
// set parameters, possibly including a session cookie, if applicable
xml.onreadystatechange = stateChangeHandler;

When stageChangeHandler has a readyState of 4, you can check the status (should be 200), and the payload, which you can use JSON.parse to convert to a literal value.

Custom Rest API

Alternatively, you can also just expose @RestResource annotated classes. Since sessions are authenticated, the users have to have the class enabled on their profile in order to access the function. Keep in mind that this method technically allows them to access any standard REST API too, though, since they would have to have "API Enabled" on their profile.

There's other methods, too, for exposing your data in a secure manner. This is just a couple of the more common access controls used by developers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.