Ava API Client

Guide

How to connect to the Business Central API with OAuth 2.0

Updated 2 November 2026

Business Central Online signs API callers in through Microsoft Entra ID. For an integration that runs with nobody at the keyboard, you use the OAuth 2.0 client credentials flow, which Microsoft calls service-to-service authentication. It takes two pieces of setup: one in Entra, and one in Business Central itself. Most failed connections are missing the second.

1. Register an app in Microsoft Entra

  1. Sign in to the Microsoft Entra admin center and register a new application.
  2. From its Overview page, copy the Application (client) ID and the Directory (tenant) ID.

2. Create a client secret

Under Certificates & secrets, choose New client secret. Copy its Value straight away, because it is not shown again. The Secret ID next to it looks similar but will not sign you in.

3. Grant the API permission

  1. Under API permissions, choose Add a permission, then Microsoft APIs, then Dynamics 365 Business Central.
  2. Choose Application permissions and select API.ReadWrite.All. Add Automation.ReadWrite.All as well if you will use the automation APIs.
  3. Choose Grant admin consent for your tenant.

4. Enable the app in Business Central

This step is the one most often missed. Without it, signing in works but Business Central refuses the token.

  1. In Business Central, search for Microsoft Entra applications and choose New.
  2. Enter the client ID and a description, and set State to Enabled.
  3. Assign the permission sets the integration needs. Apps can't be given SUPER. Microsoft notes that D365 AUTOMATION and EXTEN. MGT. - ADMIN cover most objects used with automation, and advises giving an app only what it needs.

5. Request a token

POST https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=<client-id>
&client_secret=<client-secret>
&scope=https://api.businesscentral.dynamics.com/.default

The access_token in the response goes in the Authorization header of each call. It expires, so request a new one when it does.

6. Make your first call

List the companies. Almost everything else in the API sits under one of them.

GET https://api.businesscentral.dynamics.com/v2.0/<tenant-id>/<environment>/api/v2.0/companies
Authorization: Bearer <access-token>
{
  "value": [
    {
      "id": "a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1",
      "systemVersion": "18453",
      "name": "CRONUS USA, Inc.",
      "displayName": "CRONUS USA, Inc.",
      "businessProfileId": ""
    }
  ]
}

Then use the company's id to reach its data:

GET .../api/v2.0/companies(a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1)/customers

The same thing in Ava

Once the app is registered, choose Connect Business Central in Ava and enter the tenant ID, environment, client ID and secret. Ava tests the sign-in, lists your companies and adds ready-made requests for customers, items, vendors, sales orders and invoices. It handles the token for you.

If it fails

Microsoft's error codes say which step went wrong. See Business Central API errors explained.

Sources