We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to handle a specific situation. Currently, our consumers make a post to our service with NPI/SPI data, we take that data, gather more data and persist it to a DB. At a later point in time, users will want to retrieve that information we have gathered. Another web service will call ours (so the endpoint should never be exposed to an actual user) however we still want to hide our query parameters. It seems there are two possible ways of doing this.
- Encrypt our query strings (this options seems to have additional overhead on both our logic and our consumers but adhere to rest principles)
- Have our consumers do another POST to get the data (however this options seems to violate rest principles, but a simpler implementation)
Thus we are trying to decide the best approach. Any input?