Rest API for custom scoped application

[MalakaSilva]

When building a custom application, suppose we have a set of records where some operations involve more than simply updating fields.

For example, an operation may require server-side calculations, validation of conflicts, generating a resolution plan, or potentially creating/updating related records as part of the same operation.

In such a scenario, would you consider it a good practice to expose the functionality through a custom Scripted REST API and have clients go through that API, rather than allowing them to perform the corresponding operations directly through the Table API?

The reasoning would be that the Scripted REST API becomes the controlled business-logic layer, where the necessary calculations, validations, related-record processing, and access checks are handled centrally.

I'd also appreciate your advice on whether there are any ServiceNow APIs or platform capabilities that are specifically restricted to certain editions or licensing tiers and therefore should be avoided when designing a generally distributable application.

[martinvirag]

I would never allow to do an operation via table api, because you don't have much control over it and in a case of a potential data leak you basically allow bad actors to directly call the table.

Scripted REST API is perfect as you have mentioned as it only communicates as much data as you want. 

If you would like to do creating or updating I would also consider an alternatie approach the import set api.

you can create an import set, build up the transform maps or RTEs and then insert.

The benefits here are: decouple the actual transform, hence you have better performance. the Imports are already logged, no need to do custom logging there, plus in a case of a data leak, the bad actor  can directly acces only the import set table and have no knowledge of the underlying tables at all