We are building a product that offers two routes to the back-end data:
- JSON calls to @RestResource Apex class APIs
- LWC calls to @AuraEnabled Apex classes
Is there a profile setup that keeps these routes open but stops all other APIs from working e.g. the normal REST API mechanism?
The reason to ask is that the security model we require is quite simple to implement via the Apex classes but would be much more challenging to impose via sharing rules.
(This for a Community.)