Power Pages Web API cheat sheet: setup, site settings, the wildcard change and error codes

The Power Pages Web API lets your page scripts create, read, update and delete Dataverse rows through /_api/…, without a form. It's a subset of the Dataverse Web API, so the setup and limits differ. Here's all of it on one page.

Turn it on for a table

Site settings, using the table's logical name, such as contact:

Columns: replacing the wildcard

List every column your code touches, and only those:

• System view option: only columns displayed in the view count, from the primary table only. Columns used only for filtering or sorting in the view don't count. Changes take up to five minutes.
• Lookups: use the OData property name _<column>_value, for example _primarycontactid_value.
• Help is available: since 2 September 2026, the Security Agent (Security workspace → Data Security prompt) and the Power Pages plugin's /migrate-webapi-selectall skill suggest the columns for you. Review the suggestions, then test.

Call it: the CSRF token

The user's session handles sign-in, but every request needs a CSRF token in the __RequestVerificationToken header. A shortened version of Microsoft's sample wrapper (the full sample also checks that the sign-in session is still valid):

(function (webapi, $) {
  function safeAjax(ajaxOptions) {
    var deferredAjax = $.Deferred();
    shell.getTokenDeferred().done(function (token) {
      ajaxOptions.headers = ajaxOptions.headers || {};
      ajaxOptions.headers["__RequestVerificationToken"] = token;
      $.ajax(ajaxOptions).done(deferredAjax.resolve).fail(deferredAjax.reject);
    }).fail(function () { deferredAjax.rejectWith(this, arguments); });
    return deferredAjax.promise();
  }
  webapi.safeAjax = safeAjax;
})(window.webapi = window.webapi || {}, jQuery);

webapi.safeAjax({
  type: "POST",
  url: "/_api/contacts",
  contentType: "application/json",
  data: JSON.stringify({ fullname: "Sample" }),
  success: function (res, status, xhr) { console.log(xhr.getResponseHeader("entityid")); }
});

• In URLs, use the entity set name (/_api/contacts). In site settings, use the logical name (contact). Mixing them up is the most common mistake.
• Operation names and URLs are case-sensitive.

Security

• Every call follows table permissions through the user's web roles, and optionally column permissions. An anonymous caller needs an Anonymous Users role with the right table permission.
• Prefer the narrowest scope: Contact or Account scope, not Global.

What it can't do

• Configuration tables (adx_…: web pages, site settings, web roles, table permissions, and so on) aren't available.
• Dataverse actions and functions can't be called.
• No optimistic concurrency. The Dataverse Web API's If-Match/ETag check (412 Precondition Failed) isn't in the Power Pages list of responses, so don't rely on it.
• It's meant for your site's own pages, not for integrating other apps or other Power Pages sites.
• Licensing: anonymous callers count toward anonymous capacity; signed-in callers need authenticated capacity.

Status codes

Error codes in the response body

Known issue: a GET on a table whose table permissions chain several one-to-many or many-to-many levels, with Parental, Contact or Account scopes, can return a Dataverse error. Microsoft's workaround is a FetchXML query.

Sources

• Microsoft Learn: Power Pages Web API overview
• Microsoft Learn: Web API requests fail after the wildcard is deprecated
• Microsoft Learn: Compose HTTP requests and handle errors
• Microsoft Learn: Write, update and delete operations using the Web API
• Microsoft Learn: Dataverse Web API status codes, for comparison