Part 4 of 4: Security, Monitoring & Best Practices

In Parts 1-3, we built powerful APIs that transformed Mehta Gifts’ operations. Products sync automatically. Loyalty points work everywhere. Orders flow seamlessly from website to warehouse.

But Rohan knew the job wasn’t done. These APIs were exposing valuable business data to the internet. Without proper security and monitoring, the entire system could become a liability instead of an asset.

The Wake-Up Call

One Monday morning, Rajesh received a call from his bank. Someone had attempted to access his Business Central system using stolen credentials. Fortunately, the attempt failed, but it was a stark reminder: security cannot be an afterthought.

Opening APIs means exposing business data to potential threats:

• Competitors could steal product pricing
• Malicious actors could create fake orders
• Customer data could be compromised
• Inventory could be manipulated

It was time to implement enterprise-grade security.

Understanding OAuth 2.0: The Security Foundation

Business Central APIs use OAuth 2.0 for authentication – the same technology used by Google, Facebook, and Microsoft for secure access.

How OAuth 2.0 Works (Simplified)

Think of OAuth 2.0 like a hotel key card system:

1. You check in at the front desk (Azure AD) with your ID
2. You receive a key card (Access Token) valid for your stay
3. The key card opens specific doors (API endpoints) based on your permissions
4. The key card expires after checkout (Token expires)
5. Lost cards can be deactivated without changing all locks

The Client Credentials Flow

For server-to-server communication (like websites calling APIs), we use the Client Credentials flow:

• Application → Azure AD: “Here are my credentials”
• Azure AD → Application: “Here’s your access token”
• Application → BC API: “Here’s my access token”
• BC API → Application: “Token valid. Here’s your data”

Setting Up OAuth 2.0 Authentication

Step 1: Azure AD App Registration

First, register your application in Azure Active Directory:

In Azure Portal:

1. Navigate to Azure Active Directory → App Registrations
2. Click “New Registration”
3. Fill in:
   • Name: “Mehta Gifts Website”
   • Redirect URI: https://mehtagifts.com/auth/callback
4. Click “Register”

Note down these values:

• Application (client) ID: abc123def-456g-789h-012i-345jkl678mno
• Directory (tenant) ID: xyz789uvw-012x-345y-678z-901abc234def

Step 2: Create Client Secret

In your App Registration:

1. Go to “Certificates & secrets”
2. Click “New client secret”
3. Description: “Website API Access”
4. Expires: 24 months
5. Click “Add”
6. Copy the secret value immediately: ThisIsASecretKeepItSafe~!@#

Critical: The secret value is only shown once. Store it securely in Azure Key Vault or similar.

Step 3: Grant API Permissions

In your App Registration:

1. Go to “API permissions”
2. Click “Add a permission”
3. Select “APIs my organization uses”
4. Search for “Dynamics 365 Business Central”
5. Select “Delegated permissions”
6. Check “user_impersonation”
7. Click “Grant admin consent”

Step 4: Configure Business Central

In Business Central:

1. Search for “Azure Active Directory Applications”
2. Click “New”
3. Fill in:
   • Client ID: [paste from step 1]
   • Description: “Mehta Gifts Website”
   • State: Enabled
   • User: Select appropriate service account
4. Click “OK”

Implementing Authentication in Code

C# Implementation

csharp
using System;
using System.Net.Http;
using System.Text.Json;
using System.Threading.Tasks;
public class BusinessCentralAuthService
{
    private readonly string _tenantId;
    private readonly string _clientId;
    private readonly string _clientSecret;
    private readonly HttpClient _httpClient;
    public BusinessCentralAuthService(string tenantId, string clientId, string clientSecret)
    {
        _tenantId = tenantId;
        _clientId = clientId;
        _clientSecret = clientSecret;
        _httpClient = new HttpClient();
    }
    public async Task<string> GetAccessTokenAsync()
    {
        var tokenEndpoint = $"https://login.microsoftonline.com/{_tenantId}/oauth2/v2.0/token";
        var content = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("grant_type", "client_credentials"),
            new KeyValuePair<string, string>("client_id", _clientId),
            new KeyValuePair<string, string>("client_secret", _clientSecret),
            new KeyValuePair<string, string>("scope", "https://api.businesscentral.dynamics.com/.default")
        });
        var response = await _httpClient.PostAsync(tokenEndpoint, content);
        response.EnsureSuccessStatusCode();
        var responseContent = await response.Content.ReadAsStringAsync();
        var tokenResponse = JsonSerializer.Deserialize<TokenResponse>(responseContent);
        return tokenResponse.AccessToken;
    }
    private class TokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; }
        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }
        [JsonPropertyName("token_type")]
        public string TokenType { get; set; }
    }
}
// Usage
var authService = new BusinessCentralAuthService(
    tenantId: "xyz789uvw-012x-345y-678z-901abc234def",
    clientId: "abc123def-456g-789h-012i-345jkl678mno",
    clientSecret: "ThisIsASecretKeepItSafe~!@#"
);
string accessToken = await authService.GetAccessTokenAsync();

Making Authenticated API Calls

csharp
public class BusinessCentralApiClient
{
    private readonly BusinessCentralAuthService _authService;
    private readonly HttpClient _httpClient;
    private readonly string _baseUrl;
    private string _cachedToken;
    private DateTime _tokenExpiry;
    public BusinessCentralApiClient(
        BusinessCentralAuthService authService,
        string environment,
        string companyId)
    {
        _authService = authService;
        _httpClient = new HttpClient();
        _baseUrl = $"https://api.businesscentral.dynamics.com/v2.0/{environment}/api/mehtagifts/shop/v1.0/companies({companyId})";
    }
    private async Task<string> GetValidTokenAsync()
    {
        if (string.IsNullOrEmpty(_cachedToken) || DateTime.UtcNow >= _tokenExpiry)
        {
            _cachedToken = await _authService.GetAccessTokenAsync();
            _tokenExpiry = DateTime.UtcNow.AddMinutes(55); // Token expires in 60 mins, refresh at 55
        }
        return _cachedToken;
    }
    public async Task<List<Product>> GetProductsAsync(string filter = null)
    {
        var token = await GetValidTokenAsync();
        var url = $"{_baseUrl}/products";
        if (!string.IsNullOrEmpty(filter))
            url += $"?$filter={filter}";
        var request = new HttpRequestMessage(HttpMethod.Get, url);
        request.Headers.Add("Authorization", $"Bearer {token}");
        request.Headers.Add("Accept", "application/json");
        var response = await _httpClient.SendAsync(request);
        response.EnsureSuccessStatusCode();
        var content = await response.Content.ReadAsStringAsync();
        var result = JsonSerializer.Deserialize<ODataResponse<Product>>(content);
        return result.Value;
    }
    public async Task<Product> CreateProductAsync(Product product)
    {
        var token = await GetValidTokenAsync();
        var url = $"{_baseUrl}/products";
        var json = JsonSerializer.Serialize(product);
        var content = new StringContent(json, Encoding.UTF8, "application/json");
        var request = new HttpRequestMessage(HttpMethod.Post, url);
        request.Headers.Add("Authorization", $"Bearer {token}");
        request.Content = content;
        var response = await _httpClient.SendAsync(request);
        response.EnsureSuccessStatusCode();
        var responseContent = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<Product>(responseContent);
    }
    public async Task<Product> UpdateProductAsync(Guid productId, Product updates, string etag = "*")
    {
        var token = await GetValidTokenAsync();
        var url = $"{_baseUrl}/products({productId})";
        var json = JsonSerializer.Serialize(updates);
        var content = new StringContent(json, Encoding.UTF8, "application/json");
        var request = new HttpRequestMessage(HttpMethod.Patch, url);
        request.Headers.Add("Authorization", $"Bearer {token}");
        request.Headers.Add("If-Match", etag);
        request.Content = content;
        var response = await _httpClient.SendAsync(request);
        response.EnsureSuccessStatusCode();
        var responseContent = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<Product>(responseContent);
    }
}

Role-Based Access Control

Not all applications should have the same permissions. Implement the principle of least privilege.

Permission Sets in Business Central

al
// Permission Set for Website (Read + Write Orders)
permissionset 50100 "Mehta Website Access"
{
    Assignable = true;
    Caption = 'Mehta Gifts Website Access';
    Permissions =
        tabledata Item = R,
        tabledata "Sales Header" = RIM,
        tabledata "Sales Line" = RIM,
        tabledata "Mehta Customer Loyalty" = RM,
        page "Mehta Product API" = X,
        page "Mehta Sales Order API" = X,
        page "Mehta Customer Loyalty API" = X;
}
// Permission Set for Mobile App (Read Only)
permissionset 50101 "Mehta Mobile App Access"
{
    Assignable = true;
    Caption = 'Mehta Gifts Mobile App Access';
    Permissions =
        tabledata Item = R,
        tabledata "Mehta Customer Loyalty" = R,
        page "Mehta Product API" = X,
        page "Mehta Customer Loyalty API" = X;
}
// Permission Set for Admin (Full Access)
permissionset 50102 "Mehta Admin Access"
{
    Assignable = true;
    Caption = 'Mehta Gifts Admin Full Access';
    Permissions =
        tabledata Item = RIMD,
        tabledata "Sales Header" = RIMD,
        tabledata "Sales Line" = RIMD,
        tabledata "Mehta Customer Loyalty" = RIMD,
        page "Mehta Product API" = X,
        page "Mehta Sales Order API" = X,
        page "Mehta Customer Loyalty API" = X;
}

Permission Legend:

• R: Read
• I: Insert
• M: Modify
• D: Delete
• X: Execute

Comprehensive Error Handling

Production APIs must handle errors gracefully and provide useful information.

Common API Errors

Error 401: Unauthorized

Cause: Access token is missing, expired, or invalid.

Solution:

csharp
public async Task<T> ExecuteWithRetryAsync<T>(Func<Task<T>> apiCall)
{
    try
    {
        return await apiCall();
    }
    catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.Unauthorized)
    {
        // Token expired, refresh and retry
        _cachedToken = null;
        await GetValidTokenAsync();
        return await apiCall();
    }
}

Error 404: Not Found

Cause: Incorrect URL, wrong company ID, or entity doesn’t exist.

Debugging checklist:

1. Verify company GUID is correct
2. Check API route structure matches page definition
3. Ensure entity exists in database
4. Confirm API page is published

Getting the correct company ID:

http
GET /api/v2.0/companies
Authorization: Bearer {token}

Error 412: Precondition Failed

Cause: ETag mismatch in PATCH request.

Solution:

csharp
public async Task<Product> UpdateProductWithRetryAsync(Guid productId, Product updates)
{
    // First, get the current entity with ETag
    var current = await GetProductAsync(productId);
    var etag = current.ETag;
    try
    {
        return await UpdateProductAsync(productId, updates, etag);
    }
    catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.PreconditionFailed)
    {
        // Entity was modified by someone else, get fresh ETag and retry
        current = await GetProductAsync(productId);
        return await UpdateProductAsync(productId, updates, current.ETag);
    }
}

Error 429: Too Many Requests

Cause: Rate limiting – too many API calls in short time.

Solution: Implement exponential backoff

csharp
public async Task<T> ExecuteWithBackoffAsync<T>(Func<Task<T>> apiCall, int maxRetries = 3)
{
    for (int i = 0; i < maxRetries; i++)
    {
        try
        {
            return await apiCall();
        }
        catch (HttpRequestException ex) when (ex.StatusCode == (HttpStatusCode)429)
        {
            if (i == maxRetries - 1) throw;
            var delay = TimeSpan.FromSeconds(Math.Pow(2, i)); // 1s, 2s, 4s
            await Task.Delay(delay);
        }
    }
    throw new Exception("Max retries exceeded");
}

Monitoring and Health Checks

You can’t fix what you can’t see. Implement comprehensive monitoring from day one.

API Monitoring Service

csharp
public class ApiMonitoringService
{
    private readonly ILogger _logger;
    private readonly BusinessCentralApiClient _apiClient;
    public async Task<HealthCheckResult> PerformHealthCheckAsync()
    {
        var result = new HealthCheckResult
        {
            Timestamp = DateTime.UtcNow,
            Checks = new List<ServiceCheck>()
        };
        // Test Products API
        result.Checks.Add(await TestEndpointAsync("Products API", async () =>
        {
            var products = await _apiClient.GetProductsAsync("$top=1");
            return products.Count > 0;
        }));
        // Test Sales Orders API
        result.Checks.Add(await TestEndpointAsync("Sales Orders API", async () =>
        {
            var orders = await _apiClient.GetSalesOrdersAsync("$top=1");
            return true; // Success if no exception
        }));
        // Test Loyalty API
        result.Checks.Add(await TestEndpointAsync("Loyalty API", async () =>
        {
            var loyalties = await _apiClient.GetCustomerLoyaltiesAsync("$top=1");
            return true;
        }));
        // Test Authentication
        result.Checks.Add(await TestEndpointAsync("Authentication", async () =>
        {
            var token = await _apiClient.GetValidTokenAsync();
            return !string.IsNullOrEmpty(token);
        }));
        result.OverallStatus = result.Checks.All(c => c.IsHealthy) ? "Healthy" : "Unhealthy";
        // Log results
        _logger.LogInformation($"Health Check: {result.OverallStatus} - {result.Checks.Count(c => c.IsHealthy)}/{result.Checks.Count} passed");
        // Send alert if unhealthy
        if (result.OverallStatus == "Unhealthy")
        {
            await SendAlertAsync(result);
        }
        return result;
    }
    private async Task<ServiceCheck> TestEndpointAsync(string name, Func<Task<bool>> test)
    {
        var check = new ServiceCheck { Name = name };
        var stopwatch = System.Diagnostics.Stopwatch.StartNew();
        try
        {
            check.IsHealthy = await test();
            check.ResponseTime = stopwatch.ElapsedMilliseconds;
            check.Message = "OK";
        }
        catch (Exception ex)
        {
            check.IsHealthy = false;
            check.ResponseTime = stopwatch.ElapsedMilliseconds;
            check.Message = ex.Message;
            _logger.LogError(ex, $"Health check failed for {name}");
        }
        return check;
    }
    private async Task SendAlertAsync(HealthCheckResult result)
    {
        var failedChecks = result.Checks.Where(c => !c.IsHealthy).ToList();
        var emailBody = $@"
            <h2>API Health Check Failed</h2>
            <p>Time: {result.Timestamp}</p>
            <p>Failed Services: {failedChecks.Count}</p>
            <ul>
                {string.Join("", failedChecks.Select(c => $"<li>{c.Name}: {c.Message}</li>"))}
            </ul>
        ";
        await _emailService.SendAsync(
            to: "[email protected]",
            subject: "ALERT: API Health Check Failed",
            body: emailBody
        );
    }
}
public class HealthCheckResult
{
    public DateTime Timestamp { get; set; }
    public string OverallStatus { get; set; }
    public List<ServiceCheck> Checks { get; set; }
}
public class ServiceCheck
{
    public string Name { get; set; }
    public bool IsHealthy { get; set; }
    public long ResponseTime { get; set; }
    public string Message { get; set; }
}

Automated Daily Health Checks

PowerShell script that runs daily:

powershell
# Daily health check and reporting
$reportPath = "C:\Logs\API-Health-$(Get-Date -Format 'yyyy-MM-dd').html"
$healthCheckResults = @()
# Test each API endpoint
$endpoints = @(
    @{ Name = "Products API"; Url = "$apiUrl/products?`$top=1" },
    @{ Name = "Sales Orders API"; Url = "$apiUrl/salesOrders?`$top=1" },
    @{ Name = "Loyalty API"; Url = "$apiUrl/customerLoyalties?`$top=1" }
)
foreach ($endpoint in $endpoints) {
    $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
    try {
        $response = Invoke-RestMethod -Uri $endpoint.Url -Headers $headers -ErrorAction Stop
        $stopwatch.Stop()
        $healthCheckResults += [PSCustomObject]@{
            Endpoint = $endpoint.Name
            Status = "✓ Healthy"
            ResponseTime = "$($stopwatch.ElapsedMilliseconds)ms"
            Message = "OK"
            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        }
    }
    catch {
        $stopwatch.Stop()
        $healthCheckResults += [PSCustomObject]@{
            Endpoint = $endpoint.Name
            Status = "✗ Failed"
            ResponseTime = "$($stopwatch.ElapsedMilliseconds)ms"
            Message = $_.Exception.Message
            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        }
    }
}
# Generate HTML report
$htmlReport = @"
<!DOCTYPE html>
<html>
<head>
    <style>
        body { font-family: Arial; margin: 20px; }
        h1 { color: #333; }
        table { border-collapse: collapse; width: 100%; }
        th { background-color: #4CAF50; color: white; padding: 12px; text-align: left; }
        td { padding: 8px; border-bottom: 1px solid #ddd; }
        .healthy { color: green; }
        .failed { color: red; }
    </style>
</head>
<body>
    <h1>Mehta Gifts API Health Check Report</h1>
    <p>Generated: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")</p>
    <table>
        <tr>
            <th>Endpoint</th>
            <th>Status</th>
            <th>Response Time</th>
            <th>Message</th>
            <th>Timestamp</th>
        </tr>
        $(
            foreach ($result in $healthCheckResults) {
                $statusClass = if ($result.Status -like "*Healthy*") { "healthy" } else { "failed" }
                "<tr>
                    <td>$($result.Endpoint)</td>
                    <td class='$statusClass'>$($result.Status)</td>
                    <td>$($result.ResponseTime)</td>
                    <td>$($result.Message)</td>
                    <td>$($result.Timestamp)</td>
                </tr>"
            }
        )
    </table>
</body>
</html>
"@
$htmlReport | Out-File -FilePath $reportPath
# Email the report
$emailParams = @{
    To = "[email protected]"
    From = "[email protected]"
    Subject = "Daily API Health Check - $(Get-Date -Format 'yyyy-MM-dd')"
    Body = $htmlReport
    BodyAsHtml = $tru
    SmtpServer = "smtp.gmail.com"
    Port = 587
    UseSsl = $true
    Credential = $emailCredential
}
Send-MailMessage @emailParams
Write-Host "Health check complete. Report saved to $reportPath"

Security Best Practices

1. Never Hardcode Secrets

Bad:

csharp

string clientSecret = “ThisIsASecretKeepItSafe~!@#”;

Good:

csharp
string clientSecret = Environment.GetEnvironmentVariable("BC_CLIENT_SECRET");
// Or use Azure Key Vault
string clientSecret = await keyVaultClient.GetSecretAsync("bc-client-secret");

2. Use HTTPS Always

All API communications must use HTTPS. Never use HTTP in production.

3. Implement Rate Limiting

Protect against abuse by limiting requests per hour/minute:

csharp
public class RateLimitMiddleware
{
    private static Dictionary<string, RateLimitInfo> _requestCounts = new();
    private const int MaxRequestsPerHour = 1000;
    public async Task InvokeAsync(HttpContext context)
    {
        var clientId = context.User.FindFirst("client_id")?.Value;
        if (!string.IsNullOrEmpty(clientId))
        {
            if (!_requestCounts.ContainsKey(clientId))
            {
                _requestCounts[clientId] = new RateLimitInfo();
            }
            var info = _requestCounts[clientId];
            // Reset counter if hour has passed
            if (DateTime.UtcNow - info.WindowStart > TimeSpan.FromHours(1))
            {
                info.Count = 0;
                info.WindowStart = DateTime.UtcNow;
            }
            info.Count++;
            if (info.Count > MaxRequestsPerHour)
            {
                context.Response.StatusCode = 429; // Too Many Requests
                await context.Response.WriteAsync("Rate limit exceeded");
                return;
            }
        }
        await _next(context);
    }
}

4. Log Everything (But Not Secrets)

csharp
_logger.LogInformation($"API Call: {method} {url} - Response: {statusCode} - Duration: {duration}ms");
// ❌ Never log sensitive data
_logger.LogInformation($"Access Token: {token}"); // DON'T DO THIS!

5. Validate All Inputs

csharp
public async Task<IActionResult> CreateProduct([FromBody] ProductRequest request)
{
    // Validate
    if (string.IsNullOrWhiteSpace(request.ItemNo))
        return BadRequest("Item Number is required");
    if (request.UnitPrice <= 0)
        return BadRequest("Unit Price must be greater than zero");
    if (request.ItemNo.Length > 20)
        return BadRequest("Item Number cannot exceed 20 characters");
    // Sanitize
    request.Description = SanitizeInput(request.Description);
    // Process
    var product = await _apiClient.CreateProductAsync(request);
    return Ok(product);
}

The Final Transformation

Six months after implementing enterprise-grade security and monitoring:

Security Achievements:

• Zero security breaches
• 100% encrypted communications
• Multi-factor authentication for admin access
• Regular security audits passed
• Automated vulnerability scanning

Reliability Metrics:

• 99.8% uptime across all APIs
• Average response time: 180ms
• 15,000+ API calls processed daily
• <0.1% error rate

Business Impact:

• Customer trust: Increased significantly
• Compliance: Met industry standards
• Scalability: Ready for 10x growth
• Peace of mind: Rajesh sleeps better at night

Key Lessons Learned

For Business Owners:

1. Security is an Investment, Not a Cost
The time and money spent on proper security prevented potential disasters worth far more.

2. Monitor Everything
You can’t fix what you don’t know is broken. Daily health checks caught issues before customers noticed.

3. Plan for Growth
The API architecture scaled effortlessly when business doubled. Upfront planning paid dividends.

4. Automate Monitoring
Automated alerts meant issues were addressed immediately, not hours later.

For Developers:

1. Never Skip Authentication
OAuth 2.0 setup takes time, but it’s non-negotiable for production APIs.

2. Error Handling is Critical
APIs will fail. Network issues, timeouts, and unexpected responses happen. Plan for them.

3. Document Everything
Six months later, detailed documentation saved countless hours when adding new features.

4. Test Thoroughly
Unit tests, integration tests, load tests, and security penetration testing – all essential.

5. Version Your APIs
From day one, use versioned APIs (v1.0). When changes are needed, create v1.1 while keeping v1.0 operational.

6. Cache Wisely
Product catalog cached for 5 minutes, inventory checked in real-time. This balance reduced API load by 80% while maintaining accuracy.

The Complete Solution

Let’s review what we’ve built across all four parts:

Part 1: Foundation

• Product Catalog API
• GET requests and filtering
• Basic API structure

Part 2: Data Management

• POST requests for creating products
• PATCH requests for updates
• Bulk operations with PowerShell
• Automated price management

Part 3: Customer Experience

• Customer Loyalty API
• Sales Order API
• Real-time inventory synchronization
• Multi-channel integration

Part 4: Production Ready

• OAuth 2.0 authentication
• Role-based access control
• Comprehensive error handling
• Health monitoring and alerts
• Security best practices

The Future

With a solid, secure, scalable API foundation, Mehta Gifts is ready for:

• AI-Powered Recommendations: Using purchase history via APIs to implement machine learning
• Advanced Analytics: Dedicated analytics endpoints for business intelligence
• Voice Commerce: Integration with Alexa/Google Home using existing APIs
• B2B Portal: Corporate customers get custom pricing and bulk ordering
• Automated Reordering: When inventory drops below threshold, automatically create purchase orders
• IoT Integration: Smart shelves that automatically update inventory via APIs

Final Thoughts

From paper notebooks to a fully integrated digital ecosystem, Mehta Gifts’ journey demonstrates the transformative power of Business Central APIs.

What started as a solution to sync product data evolved into a comprehensive integration platform that:

• Eliminated manual data entry
• Created seamless customer experiences
• Enabled rapid business growth
• Maintained security and reliability
• Positioned the business for future innovation

The key takeaway: Start small, build solid, scale confidently.

Begin with one API. Get it right. Learn from it. Then build upon that success. With proper planning, solid execution, and ongoing monitoring, Business Central APIs can revolutionize how your business operates.

Whether you’re a business owner considering digital transformation or a developer building integrations, remember the Mehta Gifts story. Every business’s digital journey starts with a single integration.

The technology is ready. The tools are available. The only question is: Are you ready to transform your business?

Series Recap

Part 1: Built the Product Catalog API and learned GET operations
Part 2: Mastered POST and PATCH for creating and updating data
Part 3: Created Loyalty and Sales Order APIs with real-time sync
Part 4: Implemented enterprise security and monitoring

Thank you for following the Mehta Gifts journey. May your API implementations be secure, reliable, and transformative!

Additional Resources

• Microsoft Business Central API Documentation: https://docs.microsoft.com/dynamics365/business-central/dev-itpro/api-reference/
• OAuth 2.0 Specification: https://oauth.net/2/
• Azure AD App Registration Guide: https://docs.microsoft.com/azure/active-directory/develop/
• Business Central Development: https://docs.microsoft.com/dynamics365/business-central/dev-itpro/developer/

This concludes the 4-part Business Central API series. Happy coding!