As we all know, creating a JSON callout body for an API integration in apex is a real pain. It's equally a pain to parse the data that is returned from the callout from within apex.

Something I've started doing is only using apex to make the callout and getting back the response, like so:

public class MyIntegrationUtility {
    public static String callOut(String body) {
        HttpResponse rsp = null;
            HttpRequest req = new HttpRequest();

            // Make call
            Http client = new Http();
            rsp = client.send(req);
            return rsp.getBody();
        } catch (Exception e) {
            String message = 'Error: ' + e.getMessage();
            AuraHandledException auraError = new AuraHandledException(message);
            throw auraError; 

I create the body in my lightning component, send it to my apex controller, my apex controller makes the callout, then sends the response back to my lightning component, then all I have to do is use:

var parsed = JSON.parse(response.getReturnValue());

Now I have an object that I can easily use from within my lightning component. No need to use Roundtrip Serialization and Deserialization, a JSON Generator, or JSON Parsing. In addition, far less apex code to test.

Is this bad practice? Are there any serious consequence for doing this, like security? I have not come across this technique in the documentation for lightning components. So far it's really sped up an API integration I'm doing for a lightning component I'm working on.

The only downside I've thought of so far is if there is something in the response that I parsed from within the client, and I need to save it on the server. That would require another trip back to my apex controller.

  • Is there any risk that a sufficiently advanced user could execute your helper method with an arbitrary JSON request body and do something bad through the API? Or that some of the response parameters represent privileged information that should never be allowed to reach the browser in the first place?
    – Charles T
    Commented May 1, 2018 at 21:13

1 Answer 1


There's no security concern here. JSON.parse can't execute code, so using Apex Code simply as the middleman for calling the API and getting the response seems appropriate here. In fact, this is how I'd probably do callouts myself if I were in a position where I was using a new API that I don't already use in Apex Code. It's also worth noting that JavaScript is far faster than Apex Code, so minimizing the amount of time you're in Apex Code is a bonus.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .