What is the best way to do that ?
1- I need security so he only calls this one. (I have already set security in saso and key in arsc)
2-I wan't to hide some things in the api response.
This is another great use case for the API Flow. You can create a custom API Request and Response, based on their needs. I did a similar project for a customer where they wanted to expose specific pricing, and they also did not want to give the customer the CSD customer id. They would pass in a unique GUID, that maps to particular customer, and then the response was only the specific fields that they wanted to show.
Brandon, so I have to create an api flow. How does the customer connects to it and runs it ? (sorry, a lot of questions)
Yes, you would create the API Flow, then it would be available in the Infor API Flows Suite as an available endpoint. Then the customer could call that endpoint, using the Authorized App keys you send them.
ok so what I did here was ok ? I did create it as a non infor suite. (I use sxapioepricingexternal)