Power Platform Dataverse Web API
Apps and flows cover most needs. Some projects need an outside program, such as a website backend or a nightly script, to read and write Dataverse data. The Dataverse Web API opens that door through standard web requests.
What the Web API Is
The Web API follows the OData version 4 standard. Any language that sends HTTP requests can use it, including JavaScript, Python, C#, and PowerShell. Each request reads, creates, changes, or deletes rows.
+------------------+ HTTPS + token +----------------------+
| External program | -----------------> | Dataverse Web API |
| (script, website)| | /api/data/v9.2/ |
| | <----------------- | |
+------------------+ JSON response +----------------------+
|
+------+------+
| Table rows |
+-------------+
The Service Address
Each environment has its own address. The pattern looks like this.
https://yourorg.api.crm.dynamics.com/api/data/v9.2/
Find the exact address in the maker portal under Settings, then Session details, or in the admin center under environment details. The regional part of the address changes by geography.
Authentication
Every request carries an access token from Microsoft Entra ID. Register an app in Entra ID, grant it permission to Dataverse, and request a token through the OAuth 2.0 flow. Production services usually run under an application user that has a security role in the environment, so the integration receives only the access it needs.
Table Names in the API
The API uses plural entity set names. The Account table becomes accounts, and the Contact table becomes contacts. Custom tables use the publisher prefix, such as cr123_products.
Basic Operations
| Goal | HTTP method | Example path |
|---|---|---|
| Read rows | GET | accounts |
| Read one row | GET | accounts(GUID) |
| Create a row | POST | accounts |
| Update a row | PATCH | accounts(GUID) |
| Delete a row | DELETE | accounts(GUID) |
Query Options
GET accounts?$select=name,telephone1 GET accounts?$filter=address1_city eq 'Pune' GET accounts?$orderby=name asc&$top=10 GET accounts?$select=name&$expand=primarycontactid($select=fullname)
- $select returns only the listed columns and speeds up the response.
- $filter limits rows with conditions.
- $orderby sorts the result.
- $top limits the row count.
- $expand pulls related rows in one request.
Creating a Row
POST https://yourorg.api.crm.dynamics.com/api/data/v9.2/accounts
Content-Type: application/json
{
"name": "Green Supplies",
"telephone1": "555-0100"
}
A successful call returns status 204 and the new row address in the OData-EntityId header.
Response Codes
| Code | Meaning |
|---|---|
| 200 | Request succeeded with data |
| 204 | Request succeeded with no content |
| 400 | Request format is wrong |
| 401 | Token missing or expired |
| 403 | Security role blocks the action |
| 404 | Row or table not found |
| 429 | Too many requests; slow down and retry |
Service Protection Limits
Dataverse limits how fast a client can send requests. A 429 response includes a Retry-After header with the wait time in seconds. Well-built clients pause for that time and try again. Batch requests and the use of $select reduce load and keep integrations healthy.
Layman Example: A Restaurant Takeaway Window
Customers outside the building cannot walk into the kitchen. They go to a window, show an order slip, and receive food in a standard box. The Web API acts as that window. The slip format is fixed, the staff checks identification, and the kitchen stays protected while outside customers get what they need.
Good Practices
- Request only needed columns with $select.
- Store secrets in a secure vault, never in source code.
- Use a dedicated application user with a minimal security role.
- Handle 429 responses with retry logic.
- Log request identifiers to simplify troubleshooting.
Practicing Safely
Test every request in a development environment with sample data. Tools such as Postman or the Visual Studio Code REST Client let you send calls and read responses without writing a full program. Start with GET requests, move to creating a single row, and only then try updates and deletes. Never run delete tests against production tables.
Key Takeaways
The Web API lets external code talk to Dataverse through standard HTTP calls. Secure tokens, narrow roles, and careful queries keep that connection reliable.