Hi Santhi,
Both the approach which you have mentioned works well. Which one to follow depends on
1. Overall architecture
If you have a proper layered architecture, then it depends on which layer is defined for these API calls.
2. Security
Secondly, I would decide mainly depending on the abstract level I would like to maintain to the browser. If the APIs are open GET API with the generic data, then I would probably call directly from the browser which would be
a) better performance
b) less calls back to publish instance
However, If the data is sensitive and I would like to protect the endpoint exposure to the browser or if there is any authentication required to call the protected API, then I would redirect them via servlet.
a) In this approach, you may have to do more performance tests on your publish instance to make sure your architecture can withstand that traffic.
Hope this gives you some thought process to your question
Thanks!