I am completely new to this Integration concepts. I did the trailheads around the Apex Integration Services and Lightning Platform API basics. These trails are pretty straight forward with source URLs, remote site settings and setting up requests. Right now, all I see from my org. is SOAP callouts to external services. They are well structured and working as intended. But, I am not at all familiar with creating the encryption/decryption, JSON body, sending the request, receiving response and parsing the data.

The solution from here makes sense to me, still I not completely sure if this a best practice, if we have a larger JSON string to post.

Requirement: How to create REST callouts to the external services (for consuming their REST services) that include Encryption/decryption, authentication process, send request, receive response, create records on Salesforce as well as on the external service?

Please note that, I am not asking for some code or solution, but looking for any available resources where I can read/understand and follow my way through my development work.

  • Are you trying to implement a callout from Salesforce to an external REST service or a call from an external service to Salesforce's or your own REST API?
    – identigral
    Jul 18, 2019 at 17:12
  • @identigral I am trying to make a callout from the Salesforce to an external REST service. Jul 18, 2019 at 17:18

1 Answer 1


Overall advice: keep it simple. Every time you make the solution more complex “unnecessarily”, you are also likely to leave a hole. This is especially true when it comes to security, there are lots of nuances.

  1. Encryption/Decryption

What you do here depends on the REST service you're calling. The lowest common denominator and a best practice is to always use HTTPS. This presumes that the REST service you're calling is available over HTTPS.

There are advanced use cases that may require encryption/decryption of the payload (request body). The need to do so depends on the external REST service. There's a Crypto class in Apex available to handle the low-level crypto operations.

  1. Authentication process

Again, this depends on the service you're calling. Best practice is to use an out of the box support for various authentication schemes available via Named Credentials.

  1. Sending request / receiving response.

A popular 3rd party (OSS) library that can be used in lieu of HTTP client classes shipped by Salesforce is ffhttp-core. See this answer and/or example applications referenced on ffhttp-core github page for more details.

One best practice that Trailhead for Apex REST doesn't show is typed conversion to/from JSON. You want to build classes in Apex that represent your requests/responses and then serialize/deserialize them to/from JSON. ffhtp-core helps you with serialization and JSON2Apex helps you with constructing Apex classes from JSON. ffhttp-core example apps are a good source of material for this step.

  1. Create records in Salesforce

Check the "Manipulate records with DML" Trailhead

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .