Salesforce users need to read data from an external system via an HTTP request.

Securing outbound integrations from Salesforce requires protection at both the authentication and transport layers. Named Credentials and Two-way SSL (Mutual Authentication) together provide a robust security posture for reading external data via HTTP.

Named Credentials serve as a secure management tool for callout endpoints. They abstract the endpoint URL and the necessary authentication parameters (such as Basic Auth or OAuth tokens) away from the Apex code. This separation ensures that sensitive credentials are not hardcoded and can be easily updated in one central location if the endpoint or credentials change.

Two-way SSL (Mutual TLS) provides transport-layer security by requiring both the client (Salesforce) and the external server to authenticate each other using digital certificates. While standard SSL verifies the server to the client, Two-way SSL ensures that the external system only accepts requests from a verified Salesforce org. This "Mutual TLS" setup is highly recommended for enterprise-level integrations where proof of the caller's identity is as critical as the encryption of the data in transit. By combining these two methods, the architect ensures that the integration is secured against both credential theft and unauthorized server access.