REST API

What is REST (Representational State Transfer) API?

• Force.com REST API lets you integrate with the force.com applications using simple HTTP methods.
• The beauty of RESTful service is that it's very lightweight and easy to use as compared to SOAP-based services.

What are the Characteristics of the REST API?

• Leverage HTTP- Users the existing feature of HTTP such as HTTP Caching and authentication, Native HTTP Method (GET, POST, PUT, Delete, PATCH)  therefore it makes integration with mobile devices and tablet simple
•  Stateless- Each request from client to the server must contain all the information necessary to understand the request, and not use any stored context on the server.
• Support XML and JSON format

What does an HTTP Request consist of?

HTTP Request consist:

1. Request header
2. Named URI
3. Request Entity
4. HTTP Method

How is Name URI (Uniform Resource Identifier) constructed?

The URI is composed of:

• The root URL specifying
• The instance of company org
• The desired API Version
• A resource path 

What different HTTP methods are available?

• GET        - Retrieve data
• POST     - Create record
• DELETE - Delete record
• PUT       - Upsert record

How can the data format be specified?

JSON is the default data exchange format

• To modify the format: 
• Use the HTTTP accept header to specify json or xml

• Append .json or .xml to the URI

                

How is HTTP used to make a REST-based API Call?

To know about other integration API at a glance, pls Click here

Security Model for Integration

Integration Security

Security is the main concern of any customer or client and it becomes more serious when there is any integration involved in different applications with Salesforce. However, no need to worry, salesforce is not let you down in terms of security. Salesforce provides a different kind of ways to ensure security. Either salesforce is being called from an external application or salesforce call to an external application, we can also ensure the security as below:

Force.com Security: Inbound- 

For all external services which are consuming salesforce API, we can provide security as per the below process:

1. User Authentication-determines who can log in. If any external service is calling to salesforce, a user must have user name and password to use Salesforce API. (Salesforce has passport expiration. Consider setting the “Password Never Expires” option for API user. 
• Integration user should have API Enabled permission to access the salesforce through api. You can also set this user as “API Only” so that he can not login to salesforce via browser.
• Limits on the number of attempts 
2. Network Security-determines when and where user can log in
• Login hours and IP ranges by Profile 
• Organization-wide trusted IP Address

3. Session Security- 
• Session Timeout can be enabled in salesforce.
• 
  
  
4. Data Security-
• API user profiles can ensure data security. 
• Always consider to have API user profile a custom profile and should have access to relevant fields and objects.
5. Transport layer Security 

• SSL (Secure sockets layer) provide secure transport for HTTP/HTTP

Force.com security: Outbound- 

Salesforce also ensures security when salesforce calling external services as below:

1. Two-way SSL
• Both client and server present a certificate to provide their identity to the other party
2. The site must be whitelisted by authenticating the external URL in a remote site setting.   
3. Outbound Ports restrictions
• Port 80: HTTP Only
• Port 443: HTTPS Only
• Port 1024-6652 inclusive- HTTP or HTPPs

To know about other integrations API at a glance, pls Click here

Salsforce API

API stands for Application Programming Interface. With the help of API, we can connect two or more applications altogether. 

To understand the concept of API, let's consider the example of a restaurant. If you go there, you will get a Menu list, and there will be a separate kitchen. You just select the item from the menu list and the waiter will take the order and send it to the chef in the kitchen and once the order is ready, he will deliver to you.  You know need to worry about how the order will come. You just order and you get it from the waiter. Here waiter is working as an API.

There are the following APIs in the Salesforce:

REST API

• Force.com REST API lets you integrate with the force.com applications using simple HTTP methods.
• The request/response would be in the form of xml or JSON.
• Useful in light weighted application like mobile application
• Click for more detail

SOAP API

• SOAP API works on SOAP (WSDL) protocol. 
• The request/response would be in the form of xml.
• We can use SOAP API to integrate Salesforce with your organization’s ERP and finance systems.
• Click for more detail
  

Tooling API

• As the name itself suggests, use tooling API to build custom development tools for Force.com applications.
• You can get the code coverage information with the help of Tooling API.
• Click for more detail

Streaming API

• Use Streaming API to receive notifications for changes to data that match a SOQL query that you define.
• Streaming API is useful when you want notifications to be pushed from the server to the client.
• Streaming API enables you to reduce the number of API calls and improve performance.
• Click for more detail

Chatter REST API

• Access Chatter feeds and social data such as users, groups, followers, and files using REST.
• Click for more detail

Bulk API

• Bulk API is based on REST principles and is optimized for loading or deleting large sets of data.
• You can use it to query, insert, update, upsert, or delete many records asynchronously by submitting batches. Salesforce processes batches in the background.
• SOAP API, in contrast, is optimized for real-time client applications that update a few records at a time. SOAP API can be used for processing many records, but when the data sets contain hundreds of thousands of records, SOAP API is less practical. Bulk API is designed to make it simple to process data from a few thousand to millions of records.
• The easiest way to use Bulk API is to enable it for processing records in Data Loader using CSV files. Using Data Loader avoids the need to write your own client application.
• Click for more details
  

Metadata API

• Use Metadata API to retrieve, deploy, create, update, or delete customization for your organization. 
• The most common use is to migrate changes from a sandbox or testing organization to your production environment. 
• Metadata API is intended for managing customization and for building tools that can manage the metadata model, not the data itself. Like The Force.com Migration Tool, Force.com IDE
• Click for more detail
  

Apex REST API

• Use Apex REST API when you want to expose your Apex classes and methods so that external applications can access your code through REST architecture.
• Apex REST API supports both OAuth 2.0 and Session ID for authorization.
• You can also read this article for the detailed information

Apex SOAP API

• Use Apex SOAP API when you want to expose Apex methods as SOAP Web service APIs so that external applications can access your code through SOAP.
• Click for more detail
  

To know more about the security aspect of integration, pls Click here