Guide
Business Central API errors explained
Updated 2 November 2026
A failed Business Central call fails in one of two places. An AADSTS code comes from Microsoft Entra while getting a token, before Business Central is involved. A code like Internal_RecordNotFound comes from Business Central after it has received your request. Knowing which one you have tells you where to look.
Sign-in errors (AADSTS)
| Code | What it means | What to do |
|---|---|---|
AADSTS90002 | The tenant wasn't found. | Check the tenant ID or domain in the token URL. |
AADSTS700016 | The application wasn't found in that tenant. | Check the client ID, and that the app is registered in this tenant or consented to in it. |
AADSTS7000215 | The client secret is invalid. | Use the secret's Value, not its Secret ID. Create a new one if the value is lost. |
AADSTS7000222 | The client secret has expired. | Create a new secret in the app registration. |
AADSTS70011 | The scope isn't valid. | Use exactly https://api.businesscentral.dynamics.com/.default. |
AADSTS500011 | The resource wasn't found in the tenant. | An administrator of the tenant needs to install or consent to it. |
AADSTS650057 | The app asked for a resource not listed in its permissions. | Add the Dynamics 365 Business Central permission to the app. |
AADSTS65001 | Nobody has consented to the app. | Grant admin consent in the app registration. |
Business Central error codes
The first word of the code gives the category. BadRequest is a problem with the request, Authentication and Authorization are about who is calling, Internal is the server or its data, and Application is business logic, often raised by AL code.
| Code | Typical message | What to do |
|---|---|---|
Authentication_InvalidCredentials | The server has rejected the client credentials | Sign-in worked but Business Central refused it. Check the app is on the Microsoft Entra applications page and Enabled. |
BadRequest_ResourceNotFound | Resource not found for the segment… | The entity name in the URL is wrong. Names are case-sensitive. |
Internal_RecordNotFound | The … does not exist. | The id or number in the URL or body doesn't match a record in this company. |
Internal_CompanyNotFound | The default company can't be found | Put the company in the URL. |
BadRequest_InvalidToken | Could not validate the client concurrency token… | An update needs an If-Match header. See fixing If-Match errors. |
Request_EntityChanged | Another user has already changed the record. | Read the record again to get its current ETag, then retry. |
BadRequest_InvalidOperation | Control '…' is read-only | Remove that field from the body. |
BadRequest_RequiredParamNotProvided | Field '…' must not be blank or empty. | Give that field a value. |
BadRequest_MethodNotAllowed | 'POST' requests for '…' are not allowed | This entity doesn't support that method. |
Application_DialogException | A customerNumber or a customerID must be provided. | Raised by business logic. The message says what to change. |
Application_StringExceededLength | The length of the string is 57, but it must be less than or equal to 50… | Shorten the value. $metadata gives each field's limit. |
Internal_EntityWithSameKeyExists | The … already exists. | A record with that key is already there. Update it instead. |
How Ava helps
Ava reads the error envelope for you. It shows Business Central's own message first, the fields it names, and what to try next, rather than a wall of JSON. Microsoft's sign-in errors appear as they are, so you can match them against the table above.