@Override
  public Object createObjectInputFilterProxy(String pattern, Collection<String> sanctionedClasses)
      throws InvocationTargetException, IllegalAccessException {
    Object objectInputFilter =
        ObjectInputFilter_Config_createFilter.invoke(ObjectInputFilter_Config, pattern);

    /*
     * Members first connect to each other with sockets that are restricted to the Geode sanctioned
     * serializables which sets the Filter on that stream (an ObjectInputStream can only set a
     * Filter once in its lifetime). Geode then loads up its ConfigurationProperties and needs
     * to widen the Filter to include the User's sanctioned serializables if they provided any
     * (serializable-object-filter).
     *
     * Wrap the Filter in a dynamic Proxy to provide an InvocationHandler in order to decorate
     * before-calls to checkInput (checks the class against the filter). This allows us to
     * effectively override the call to widen the filter to include the User's addition to the set
     * of sanctioned serializables.
     */
    InvocationHandler invocationHandler = new ObjectInputFilterInvocationHandler(
        ObjectInputFilter_checkInput,
        ObjectInputFilter_FilterInfo_serialClass,
        ObjectInputFilter_Status_ALLOWED,
        ObjectInputFilter_Status_REJECTED,
        objectInputFilter,
        sanctionedClasses);

    // wrap the filter within a proxy to inject the above invocation handler
    return Proxy.newProxyInstance(
        ObjectInputFilter.getClassLoader(),
        new Class<?>[] {ObjectInputFilter},
        invocationHandler);
  }
Use reflection to look up the classes and methods for the API.
geode-serialization/src/main/java/org/apache/geode/internal/serialization/filter/ReflectiveObjectInputFilterApi.java