Why Scripted REST
Out-of-box Table API covers CRUD on tables. Scripted REST is for custom endpoints: business logic, multi-record operations, downstream integrations. Build them when Table API isn’t shaped right.
Versioning Up Front
Include a version in the URL (e.g. /api/acme/v1/myendpoint). Once consumers integrate, breaking changes hurt everyone. Version from day one.
Auth Options
OAuth 2.0 for third-party integrations. Basic auth for internal-only. Mutual TLS for high-security. Whichever you pick, document it and stick with it.
Error Contract
Return consistent error shapes. 4xx for client errors (with an error code + message), 5xx for server errors. Clients that can’t parse your errors will retry — and hammer you.
Testing
Each endpoint gets an ATF test. Call it, check status, check body. For integrations, set up a Postman collection that the integration team can import. Contract-first, integration-second.