# Building Apex REST and SOAP services and clients

*Integration Architect Study Guide · Build Solution · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/build-solution/building-apex-rest-and-soap-services-and-clients*

What to consider when Salesforce provides a custom API (system context and how to enforce sharing and field security, API allocation, package namespaces, unsupported content types, heap-safe responses, WSDL from webservice methods) and when it consumes one (SOAP 1.1 only, no WS-Security in generated classes, idempotency keys, response size limits and paginated APIs).

- Certification: Salesforce Integration Architect
- Exam section: Build Solution
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a use case that includes technical requirements, constraints, or drivers, identify the considerations when designing and implementing an API(s), both Salesforce as an API provider and Salesforce as an API consumer.

## What the exam expects

- Decide between the standard REST or SOAP API, a custom Apex REST service and an Apex SOAP web service when Salesforce is the provider.
- Secure a custom Apex service: know it runs in system context and how sharing, object and field security are enforced in code.
- Predict how custom services hit limits: API allocation, governor limits, content types, serialization.
- Decide how Apex consumes an external SOAP or REST API: WSDL2Apex versus HTTP classes, supported SOAP standards, WS-Security, idempotency, response size and pagination.

Key terms: **Apex REST** (an `@RestResource` class served under `/services/apexrest/`); **Apex web service** (a global class with `webservice static` methods and its own WSDL); **system context** (code runs without the caller's permissions); **WSDL2Apex** (Setup's Generate from WSDL, which builds stub classes for callouts); **idempotency key** (a unique ID the caller sends so the receiver can detect repeats).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Apex REST security | Always system context; sharing with `with sharing` or user-mode operations; set object and field access explicitly (database operations default to user mode only at API 67.0+) | [Exposing Data with Apex REST](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_exposing_data.htm), [Release note](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&language=en_US&release=262&type=5) |
| Apex REST metering | Counts against API limits; all Apex governor limits apply | [Introduction to Apex REST](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_intro.htm) |
| Unsupported request type | `multipart/form-data` | [Apex REST Methods](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_methods.htm) |
| Packaged service URL | `/services/apexrest/<namespace>/<mapping>` | [Apex REST Methods](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_methods.htm) |
| Apex SOAP callout standards | WSDL 1.1, SOAP 1.1, WSI-Basic Profile 1.1; no WS-Security in generated proxies | [Integration Patterns](https://architect.salesforce.com/docs/architect/fundamentals/guide/integration-patterns.html) |
| Callout timeout | Default 10 s; maximum 120,000 ms per callout; 120 s cumulative | [Callout Limits and Limitations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_timeouts.htm) |
| Callout size | 6 MB synchronous, 12 MB asynchronous; counts toward heap | [Execution Governors and Limits](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_gov_limits.htm) |
| Continuation response | 1 MB maximum | [Asynchronous Callout Limits](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_continuation_limits.htm) |
| Queueable callouts | Need `Database.AllowsCallouts`; one child job per running job | [Queueable Apex](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_queueing_jobs.htm) |

## Check yourself

- Why must a custom Apex REST service enforce field-level security in code?
- When is a custom Apex web service justified over the standard SOAP API?
- Which SOAP standards can Apex callouts consume?
- When should a large or paginated callout move into a Queueable job?

## Sources

- [Exposing Data with Apex REST Web Service Methods](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_exposing_data.htm)
- [Apex REST Methods](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_methods.htm)
- [Introduction to Apex REST](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_rest_intro.htm)
- [Apex Web Services (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/apex_integration_services/apex_integration_webservices)
- [Webservice Methods](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_web_services_methods.htm)
- [Integration Patterns](https://architect.salesforce.com/docs/architect/fundamentals/guide/integration-patterns.html)
- [SOAP Services: Defining a Class from a WSDL Document](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_wsdl2apex.htm)
- [Invoking HTTP Callouts](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_http.htm)
- [Invoking Callouts Using Apex](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts.htm)
- [Callout Limits and Limitations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_timeouts.htm)
- [Execution Governors and Limits](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_gov_limits.htm)
- [Asynchronous Callout Limits](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_continuation_limits.htm)
- [Queueable Apex](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_queueing_jobs.htm)
- [API Request Limits and Allocations](https://developer.salesforce.com/docs/platform/salesforce-app-limits-cheatsheet/guide/salesforce-app-limits-platform-api.html)
- [Database Operations Run in User Mode by Default (Summer '26 release update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&language=en_US&release=262&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams