Business Central Admin Center API

Question

I'm trying to call the Admin Center API of Business Central, but I keep getting 403 Forbidden error. I'm not sure what the problem is - it could be incorrect endpoint or another way to get the required token.

I'm authorizing the same way as I would if I were to communicate with a BC API through oauth2.

I have been trying with the following endpoints in Postman after successfully receiving an access token:

https://api.businesscentral.dynamics.com/admin/v2.11/applications/environments    
https://api.businesscentral.dynamics.com/admin/v2.11/applications/businesscentral/environments

But in both cases I get the 403 Forbidden error.

Calls to regular BC API's seems to be working as expected.

Does anyone have an idea as to what I'm doing wrong or missing here?

UPDATE 1

I have now changed the registered app to use delegated permissions and have permissions to any API within BC.

Retrieving a token goes fine, just like before, but the next call results in a "Forbidden" error, just like before as well.

REQUEST (from Fiddler)

GET https://api.businesscentral.dynamics.com/admin/v2.11/applications/environments HTTP/1.1
Host: api.businesscentral.dynamics.com
Authorization: Bearer <my token>
Accept: application/json

RESPONSE (from Fiddler)

HTTP/1.1 403 Forbidden
Content-Length: 0
ms-correlation-x: 8d8d7e1c-cc1e-4866-9c1f-9708533dabd0
Access-Control-Allow-Headers: Origin, X-Requested-With, Authorization
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: ms-correlation-x
x-content-type-options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Thu, 07 Apr 2022 10:31:35 GMT

If I examine the token with jwt.io, I can't seem to find the part that describes which API the token gives access to, which could be the or part of the problem?

UPDATE 2

I don't get it, regardless of what I try, the access_token I get, doesn't include any info about what it grants access to.

I register an app and create delegated API permission for Business Central (user_impersonation and Financials.ReadWrite.All). Then I create a secret.

I use the following C# code to get a token:

    var client_id = "<client_guid>";
    var client_secret = "<client_secret>";
    var tenant_id = "<tenant_guid>";

    var token_url = "https://login.microsoftonline.com/" + tenant_id + "/oauth2/v2.0/token";

    var client = new HttpClient();

    var content = new StringContent(
        "grant_type=client_credentials"+
        "&scope=https://api.businesscentral.dynamics.com/.default"+
        "&client_id="+ HttpUtility.UrlEncode(client_id) +
        "&client_secret="+ HttpUtility.UrlEncode(client_secret));

    content.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("application/x-www-form-urlencoded");

    var response = await client.PostAsync(token_url, content);

The value in the "access_token" attribute i get from the response, doesn't describe any of the permissions I created when explored with jwt.io. What am I doing wrong here?

My app permissions look like this:

Does this answer your question? [Dynamics 365 Business Central Token](https://stackoverflow.com/questions/72097223/dynamics-365-business-central-token) — kaspermoerch, May 03 '22 at 11:20
No it does not. That post is my own in attempt to focus on just the token part. I'm still not able to make it work. After my update 1 in that other post, I have received no further responses. Unfortunately. — Aidal, May 06 '22 at 06:41

kaspermoerch · Answer 1 · 2022-04-04T06:00:37.543

0

It could indicate that the permissions assigned in your access token are incorrect.

If you have the a copy of a token, you can check it on jwt.io.

I use the PowerShell module MSAL.PS to retrieve my access tokens with this scope:

https://api.businesscentral.dynamics.com/.default

Here is a link describing the required setup for Business Central Admin Center API

edited Apr 04 '22 at 06:00

answered Mar 29 '22 at 08:06

kaspermoerch

16,127
4
44
67

I am using the same scope and the token contains "API.ReadWrite.All" when examined with jwt.io. – Aidal Mar 29 '22 at 09:03
The scope in my tokens is "user_impersonation Financials.ReadWrite.All". – kaspermoerch Mar 30 '22 at 06:52
It is the same API we are talking about? I'm talking about the Admin Center API, not any random BC API. How can permissions to "Financials" give you access to the Admin Center API? – Aidal Apr 01 '22 at 10:20
Yes, my token is used for both Admin Center API and Automation API. Financials.ReadWrite.All is the delegated permission (meaning you run as a signed in user). If you want the application permissions I think you would need the Automation.ReadWrite.All, but that would require that the Azure App Registration is also created in the given Business Central environment. – kaspermoerch Apr 01 '22 at 12:14
So is it required to do impersonation in order to use the Admin Center API? Becasue I was of the impression that API.ReadWrite.All with grant from an admin was the highest/widest permissions to give an app. Which endpoints do you call i.e. to get available environments? The ones that I mention above? – Aidal Apr 02 '22 at 20:28
Delegated permissions (or impersonation) is required as described here: https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/administration-center-api – kaspermoerch Apr 04 '22 at 05:59
Your endpoints look fine. – kaspermoerch Apr 04 '22 at 05:59
Hmm where does it say that "you must use delegated permissions"? They mention some extra stuff you need to do if using delegated permissions, but I don't see them saying that you must use that - or am I missing something? – Aidal Apr 06 '22 at 14:27
Step 5 of Setting up Azure Active Directory (Azure AD) based authentication clearly states that delegated permissions must be selected. I guess I read that as a requirement, so I haven't bothered trying others. – kaspermoerch Apr 07 '22 at 06:38
Hmm seems you're right - I don't know why I missed that. I still find it odd though, that admin grant doesn't work for this API. – Aidal Apr 07 '22 at 10:07
I now tried again with a new app registration with delegated permissions to Business Central with permissions to everything selectable. Still get Forbidden. Updated original post. – Aidal Apr 07 '22 at 10:32
Still not able to make it work, updated my post "update 2". – Aidal Apr 25 '22 at 13:45

Business Central Admin Center API

1 Answers1