Hi,

I have created a custom api -
url mapping -> urlMapping='/api/customObjectName/*'

I can call this API and get result when i call it from POSTMAN as a SEPARATE request , however when i am calling this API as a "Subrequest" of Composite API from postman , i am getting below error :
services/apexrest/api/myCustomObject/a1E180000015rw5XXX' is not a valid url.

my composite API request is as below :
URL : https://xyz.salesforce.com/services/data/v44.0/composite
HTTP Method : POST
Body : 
{
  "allOrNone": true,
  "compositeRequest": [
    {
      "method": "GET",
      "url": "/services/data/v44.0/sobjects/Order/80118000000LUCmXXX",
      "referenceId": "OrderRef"
    }, 
    
  
    {
      "method": "GET",
      "url": "services/apexrest/api/myCustomObject/a1E180000015rw5XXX",
      "referenceId": "customObjRef"
        
    }
   
  ]
}


Response :
{
            "body": [
                {
                    "errorCode": "PROCESSING_HALTED",
                    "message": "'services/apexrest/api/myCustomObject/a1E180000015rw5XXX' is not a valid url"
                }
            ],
            "httpHeaders": {},
            "httpStatusCode": 400,
            "referenceId": "customObjRef"
        }
 

I have created one global class ( custom REST API ) and have applied "With Sharing" on that global class. However , with sharing is not getting applied to that class .
if i call that Custom API with user ( having access on Custom API/class )  from postman , i can see all data regardless of CRUD Permissions , FLS , record level access.
How to overcome this ? Am i missing anything here.

I would like to allow access to data only that user have , and not anything else.

Should i call approval process from process builder or call approval process from apex using approval class ? I have tried it and done this both way . I need to what is difference , which is preferred and why