A useful feature in IBM webMethods Integration (SaaS), part of the IBM webMethods Hybrid Integration (IWHI) platform, is the ability to toggle a Flow Service between public and private invocation. This capability first appeared in the earlier webMethods.io iPaaS (Gen1) release and continues in the June 2025 IWHI (Gen2) release.

When you open a Flow Service in your tenant and navigate to Overview → Configuration, you’ll find a setting called Private Invocation. This toggle controls which URLs are exposed and who can invoke the service.

Public Invocation

When Private Invocation is disabled, the Flow Service exposes endpoints that can be invoked from outside the IWHI environment (authentication still applies).

URLs shown in Public Invocation mode

• Public URL (HTTPS)
• A publicly accessible endpoint for the Flow Service.
• It can be invoked from tools like Postman or curl, partner systems, mobile/web apps, and any internet-based client.
• It routes through the platform’s public ingress.
• It’s ideal for development, prototyping, or quick external access.
• Internal URL (HTTP)
• A runtime endpoint inside the IWHI environment.
• This URL is intended for service-to-service calls (Flow Services invoking other Flow Services, Workflows, MFT tasks, etc.).
• It is not exposed to the public internet.

Typical uses

• Direct testing or debugging with Postman
• Quick prototyping of a Flow Service
• Temporary external access before wrapping the service in an API

Here is a Flow Service that allows public access:

While convenient, using public invocation for production is not recommended, clients can bypass your API management layer (security, analytics, rate limiting) when calling the Flow Service directly.

Private Invocation

When Private Invocation is enabled, the public URL is removed, and the Flow Service restricts access to internal, tenant-scoped endpoints only.

URLs shown in Private Invocation mode

• Private URL (HTTPS)
• An internally scoped HTTPS endpoint.
• Intended for use by trusted components of your integration architecture (for example, management layers such as API Gateway or API Connect).
• It routes through the platform’s private ingress.
• Internal URL (HTTP)
• A service-mesh endpoint inside the IWHI runtime.
• Used for internal integration traffic (Flow Service → Flow Service, Workflows, MFT, etc.).
• Depending on your architecture, API management layers may also call this endpoint.
• It is not reachable from outside the tenant.

Typical uses

• Exposing a Flow Service only through an API layer (API Connect or webMethods API Gateway)
• Having an internal backend service where direct public access is not allowed
• Building services exclusively for internal integration logic

Here is a Flow Service that only allows private invocation:

Benefits of Private Invocation

• External access must go through an API layer that enforces security, rate limits, monitoring, and analytics
• Reduces attack surface because the Flow Service is not publicly reachable
• Aligns with enterprise integration and governance patterns

When to Leave a Flow Service Public

Public invocation remains useful for early-stage development:

• You can call the Flow Service directly from Postman or other test clients without first creating an API
• It accelerates prototyping and debugging

However, once the Flow Service is part of a larger integration architecture or production API, switching to Private Invocation is generally better practice.

Summary

The toggle between public and private invocation is an important feature of webMethods Integration (SaaS).

• Public Invocation: Exposes a Flow Service for direct external access—great for development and testing.
• Private Invocation: Removes direct public access, forcing all access through controlled API or internal endpoints -à ideal for production and secure integration scenarios.

You can change this setting at any time from the Flow Service’s Overview page, adapting the deployment to your use case.

References

Private Service Access Documentation
https://www.ibm.com/docs/en/wm-integration-ipaas?topic=services-private-service-access
This page explains how to enable private service access for Flow Services, what the setting does, and how it restricts invocation to components inside your tenant.

Flow Service Overview & Configuration
https://www.ibm.com/docs/en/wm-integration-ipaas?topic=managing-working-flow-services
This page covers general Flow Service management, including where to find the Overview settings, how to configure invocation, and how to test Flow Services.