Universal containers (uc) has a requirement to expose a web service to their business partners. the web service will be used to allow each business partner to query uc's salesforce instance to retrieve the status of orders. the business partner should only be allowed access to orders for which the business partner is the fulfillment vendor. the architect does not want the business partners to utilize the standard apis and would prefer a custom api be developed. which three design elements should the architect consider in order to ensure the data security of the solution?