Annotate an Apex class with @RestResource(urlMapping='/your-path/*') and mark individual methods with @HttpGet and @HttpPost
Use RestContext.request to access URL parameters, request body, and headers inside each method
Return typed Apex objects or serialize to JSON explicitly; REST methods with a return type auto-serialize to JSON
Deploy the class to a Salesforce org and confirm the endpoint is accessible at /services/apexrest/your-path/
Grant access to the endpoint by assigning the exposed Apex class to the relevant connected app or profile via the Apex Class Access setting
Test with a valid OAuth token in the Authorization header; verify that unauthenticated requests receive a 401 response
Known gotchas
Apex REST methods are subject to standard Apex governor limits per request; complex logic consuming many SOQL queries can hit limits even on a single REST call
The urlMapping wildcard (*) captures the remainder of the path but does not perform sub-routing automatically; parse RestContext.request.requestURI manually for path segments
Apex REST endpoints are not covered by Salesforce Shield Platform Encryption by default; sensitive fields in request/response bodies require additional controls
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp