Business Central API integration: expose, consume and secure APIs
Custom API pages, OData and web services, outbound HTTP calls from AL, OAuth 2.0 authentication and webhook subscriptions, built for reliability and documented for the systems that use them.
The challenge
Business Central offers several ways to expose and consume data, and the wrong choice leads to brittle integrations. Business Central online also requires OAuth 2.0 through Microsoft Entra ID (basic authentication with web service access keys is no longer supported online), so authentication design is part of the work from day one.
Technology we use
How we approach it
The same four steps apply whether the project is a rollout, an integration or a fix. Only the depth changes.
Pick the interface
Standard API v2.0 where it covers the need, custom API pages where it doesn't, web services for existing consumers, and unbound actions for operations.
Design the contract
Field names, versions, keys, error responses and idempotency rules are agreed before code is written.
Secure it
Microsoft Entra app registration, client-credentials flow, least-privilege permission sets and secrets kept out of code.
Handle limits
Throttling, paging, retries and monitoring are designed in, and the API is documented with tested example requests.
What is included
- Custom API pages with publisher, group and version
- API queries and bound or unbound actions
- Webhook subscriptions and change tracking
- OAuth 2.0 setup with Microsoft Entra ID
- Outbound HttpClient calls and JSON handling in AL
- Throttling, paging and error-handling design
- Azure API Management in front of APIs where useful
- Postman collections and API documentation
What you get from it
- Stable contracts that external systems can depend on
- Secure authentication that meets Business Central online requirements
- Fewer support calls thanks to clear errors and documentation
- Integrations that cope with throttling and retries
Related pages
Related services
- Business Central integrationArchitecture and delivery for connecting Business Central to other systems.
- AL developmentAL extensions, APIs, reports, events, testing and deployment.
- API integrationREST, OData, OAuth 2.0 and webhooks across the Microsoft ecosystem.
- Microsoft AzureAzure Functions, Logic Apps, Service Bus and API Management around your ERP.
Read more
Business Central API vs Web Services: What Is the Difference?
API pages, OData web services and SOAP compared, with URLs, authentication, limits and a simple decision guide.
Calling REST APIs From AL: HttpClient and JSON in Business Central
A practical pattern for outbound REST calls from AL: requests, responses, JSON parsing, errors and secrets.
Frequently asked questions
What is Business Central API integration?
It is the building and consuming of APIs that let other applications read and write Business Central data, and let Business Central call external services. It includes API pages, OData, web services, authentication and error handling.
API pages or web services?
API pages are versioned, stable and the recommended route for new integrations. Web services published from pages or codeunits remain useful for existing consumers and some operations. Our API versus web services article compares them in detail.
How do you authenticate against Business Central online?
With OAuth 2.0 through Microsoft Entra ID, typically using an app registration and client credentials for service-to-service calls.
Can Business Central call external REST APIs?
Yes. AL provides HttpClient and JSON types for outbound calls. In Business Central online, outbound requests from an extension must be allowed for that extension.