Dataverse APIs: Web API & Organisation Service

Two languages for Dataverse

Same data, different access patterns — choose based on your platform

Feature	Web API (REST/OData)	Organisation Service (.NET SDK)
Protocol	HTTP (REST)	.NET classes (IOrganizationService)
Available from	Any language (JS, Python, C#, etc.)	C# / .NET only
Query syntax	OData ($select, $filter, $expand)	QueryExpression or FetchXML
Batch operations	$batch endpoint (OData batch)	ExecuteMultipleRequest
Used in	Client scripts, external apps, PCF, Azure Functions	Plug-ins, custom workflow activities, .NET apps
Authentication	OAuth 2.0 bearer token	SDK handles auth (or OAuth for external)
Typed objects	No — JSON objects	Yes — Entity, EntityReference, ColumnSet

Web API operations

// Retrieve a record (GET)
GET /api/data/v9.2/accounts(00000000-0000-0000-0000-000000000001)
    ?$select=name,revenue
    &$expand=primarycontactid($select=fullname,emailaddress1)

// Create a record (POST)
POST /api/data/v9.2/accounts
Content-Type: application/json
{ "name": "LogiFlow", "revenue": 5000000 }

// Update a record (PATCH)
PATCH /api/data/v9.2/accounts(00000000-0000-0000-0000-000000000001)
Content-Type: application/json
{ "revenue": 6000000 }

// Delete a record (DELETE)
DELETE /api/data/v9.2/accounts(00000000-0000-0000-0000-000000000001)

// Query with filter (GET)
GET /api/data/v9.2/contacts?$filter=lastname eq 'Nakamura'&$select=fullname,emailaddress1

API limits and retry policies

Dataverse enforces rate limits to protect platform performance:

Limit	Threshold	What Happens
API requests	6,000 per 5-minute window per web server	HTTP 429 (Too Many Requests)
Concurrent requests	52 per user	HTTP 429
ExecuteMultiple	1,000 requests per batch	Error if exceeded
Payload size	128 MB per request	HTTP 413

Handling 429 responses

// Retry-After header tells you how long to wait
HttpResponseMessage response = await client.SendAsync(request);

if (response.StatusCode == (HttpStatusCode)429)
{
    int retryAfterSeconds = int.Parse(
        response.Headers.GetValues("Retry-After").First());
    
    await Task.Delay(TimeSpan.FromSeconds(retryAfterSeconds));
    response = await client.SendAsync(request); // Retry
}

Best practices for retry:

• Always respect the Retry-After header
• Implement exponential backoff (1s, 2s, 4s, 8s…)
• Set a maximum retry count (e.g., 5 attempts)
• Log retries for monitoring

Bulk operations

Method	API	Max Per Batch	Use Case
$batch	Web API	1,000 operations	Batch HTTP requests in one call
ExecuteMultiple	Org Service	1,000 requests	Batch SDK operations in one call
BulkDelete	Both	Millions of records	Background deletion of large datasets
Elastic tables	Web API	Massive volumes	IoT/telemetry data ingestion

💡 Exam tip: OAuth authentication pattern

External applications authenticate to Dataverse using OAuth 2.0:

1. Register an app in Microsoft Entra ID
2. Grant it Dataverse API permissions (user_impersonation or app-level)
3. Get a token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
4. Include the token in requests: Authorization: Bearer {token}
5. Tokens expire — implement refresh logic

For service-to-service (no user), use client credentials flow (application permissions). For user-delegated access, use authorization code flow.

Question

What happens when you exceed Dataverse API rate limits?

Click or press Enter to reveal answer

Answer

You receive an HTTP 429 (Too Many Requests) response with a Retry-After header indicating how many seconds to wait. Your code should respect this header, wait the specified time, and retry. Implement exponential backoff with a maximum retry count.

Click to flip back

Question

What is the difference between $batch and ExecuteMultiple?

Click or press Enter to reveal answer

Answer

$batch is the Web API's batching mechanism (bundles multiple HTTP requests into one). ExecuteMultiple is the Organisation Service's equivalent (bundles multiple SDK requests). Both reduce round-trips and improve performance. Maximum 1,000 operations per batch for both.

Click to flip back

Question

Which OAuth flow should you use for a background service calling Dataverse?

Click or press Enter to reveal answer

Answer

Client credentials flow (application permissions). The service authenticates with its own identity (app ID + client secret or certificate) without any user interaction. Register the app in Entra ID, grant Dataverse application permissions, and create an application user in Dataverse with appropriate security roles.

Click to flip back

Knowledge Check

An external application needs to synchronise 5,000 contact records to Dataverse nightly. Currently it sends 5,000 individual POST requests and frequently hits HTTP 429 errors. What is the best fix?

AIncrease the API rate limit in the Power Platform admin centreBUse $batch requests to send 1,000 records per batch, reducing round-trips from 5,000 to 5CSwitch from Web API to Organisation Service to bypass rate limitsDAdd a 1-second delay between each request

Check Answer

Next up: Azure Functions for Power Platform — processing heavy workloads, triggers, and managed identity authentication.