I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global classes other packages can invoke to make requests to the SOAP web services provided by the package.
I got back an email from Security Review team saying the following: "We would need sample http request or good data for the below methods of web service to test individual methods."
Anyone know what that looks like in practice? Should I provide sample code that they could run in the Dev Console that will invoke my global methods that will in turn trigger the callouts? Or are they looking for sample XML they could paste into something like SOAP UI and see what is going on? Anyone navigated something similar through the review process?