<p>I've been given the task of laying the groundwork of a SOA for my client. The goal is to open up various processes in an end-client independent way and also to make data available offline e.g. for reps visiting customers.</p>

<p>I do have extensive experience with J2EE (Websphere) and web services but I would appreciate advice on how to build up such an SOA. </p>

<p>Where are the pitfalls? What about security? How finely granulated should services be? etc.</p>

<p>Links to tutorials and book recommendations would also be useful.</p>

<p>Thanks!</p>

Pitfalls
Versioning/backwards compatibility: it gets really hard to change a contract once you have loads of clients. I have seen many sites version the APIs by introducing the version in the URL
Granularity
Each service should be reasonly self-contained (don't expect people to do 3 calls before they get what they need)
Platform Independence
Try to give more than one way of accessing your APIs (WS, JSON, REST...)