This confirms it for me it's the best solution.Exposing data is not an issue. Like Jaymer said you are only exposing it to yourself (URL_CONTENTS call can always use localhost).
LIMITATION:
Exposing parent BOs with child references, the child references are generated in JSON within each instance of parent BOs.
But if you expose child BOs that have a parent BO, only the first child BO has a JSON reference to the Parent BO, the rest of the child instances do not have this JSON ref.
In the JSON example below there are 4 child refs, 2 per parent BO called Job.
{
"response": [
CHILD BOs for the first parent Job
{
"Status": "PENDING",
"Name": "Item 1",
"Job": {
"Status": "BOOKED",
"JobReference": "5921409"
},
"JobReference": "5921409",
"ItemId": "5921410"
},
(Second child reference missing Job JSON ref)
{
"Status": "PENDING",
"Name": "Item 2",
"JobReference": "5921409",
"ItemId": "5921411"
},
CHILD BOs for the second parent Job
{
"Status": "PENDING",
"Name": "Item 3",
"Job": {
"Status": "BOOKED",
"JobReference": "5922318"
},
"JobReference": "5922318",
"ItemId": "5922319"
},
(Again, the second child reference missing Job JSON ref)
{
"Status": "PENDING",
"Name": "item 4",
"JobReference": "5922318",
"ItemId": "5922320"
}
]
}
Support, is this normal behaviour that only the first child instance BO has the JSON ref to the parent BO?