AI in the Work

Module 6 of 8 in the chapter Salesforce as an API Consumer, chapter 9 of the Integration Architect course. Each module stands on its own. Previous: Where a Callout Can Run · Next: Callbacks and Outbound Messages

The question this module answers: If an AI can write the Apex classes and the callout from a sample, what does the architect still have to check?

In chapter 3, an AI drafted the contract from a sample payload, and you checked it. Now it writes the code that calls it. The same two rules come first: never paste a secret or a token, and never paste real customer data. A made-up sample is all it needs.

Three Prompts

In class, I show this live. I hit the service in my API tool, copy the sample answer, and ask for the code in three steps. We ran it fresh for this module, with an AI that had nothing but these three prompts and a made-up shipment from Redrock:

“I am calling a REST web service at https://api.redrock.example/v1/shipments/8472914 (opens in a new tab) with a GET, and getting the following JSON. From the sample JSON, can you create the Salesforce Apex classes to receive the data?”
“Can you create a shipment service Apex class that calls out to the web service and uses the Apex classes above?”
“Can you update the code to use a named credential called Redrock_Status?”

It answered in seconds. The full answers are kept unedited with the course sources. Here’s what matters in them.

What Came Back

The classes. A RedrockShipment class with fields named exactly like the JSON, an inner class for the recipient and one for the items, and a parse method that calls JSON.deserialize in one line. That’s the matching class from module 3, written for you. Good work, and a lot of typing saved.

The callout, the first time. A service class that makes the six lines from module 2, and starts like this (AI-generated, 2026-10-31):

private static final String BASE_URL = 'https://api.redrock.example/v1/shipments/';

with a note that “the org needs a Remote Site Setting”. A hard-coded address and the old way out. That’s exactly what I see in class, and it’s why the third prompt exists.

The callout, after asking. Asked to use the named credential, it fixed it properly (AI-generated, 2026-10-31):

private static final String ENDPOINT_PREFIX = 'callout:Redrock_Status/v1/shipments/';
...
// Do not set an Authorization header here. The Named Credential adds it.

and it added a sensible note: the authentication belongs in the External Credential, “not in Apex”.

It knew the right answer. It just didn’t use it until a person asked. It can be smarter than you, and it can be far dumber than you. It still needs the human in the loop.

What a Person Has to Check

Read the code against what this chapter has taught. Every check below points back to a module:

The way out. Is every endpoint callout: and a named credential? Here, not until asked (module 1).
The status codes. It treats only 200 as success and throws everything else as one error. A 204, a 404 and a 503 mean different things and need different handling (module 3).
What ends up in the logs. Its error message includes the whole response body. If Redrock’s error answers carry a recipient’s name or address, that goes into every log the exception reaches (module 3).
The timeout. It set 30 seconds. Why 30? Nothing in the prompt said how fast Redrock is. Set it from the real number (module 4).
Where it runs. It warned, correctly, that a trigger can’t call it directly. Where it does run, and who owns the gap, is still your design (module 5).
The clever parts. It kept the arrival time as text and wrote its own conversion to a date and time, with a warning that the conversion breaks on fractional seconds. Before you keep hand-made code like that, test whether a plain Datetime field takes the value directly. Less code is less to break.
The tests. It reminded you that tests need a mock callout. That’s module 8.

None of that is a reason not to use it. You need to know where you’re going, and you need to recognize good code and bad code. If you do, it saves you a lot of typing. If you don’t, it hands you a hard-coded address, a vague error and a log full of someone’s address, all in tidy, confident code.

What an Architect Decides Here

What may go into the prompt: made-up samples only; no secrets, no real data; and which AI tools your company allows.
The checklist every generated callout passes before review: the named credential, the status codes, the logs, the timeout, where it runs, the tests.
Who reviews it, and that they know this chapter well enough to spot what the AI skipped.

Explore

AI in the Work: chapter 3, the two rules, drafting the OpenAPI file, and more ways AI helps
The Six Lines of a Callout and Dealing With the Answer: the code this module checks against