Dynamics Business 365 Central API and Postman

Question

I do appreciate the fact that quite a lot of people have asked about this kind of issue before me (maybe there is a reason for that Microsoft?), but I haven't been able to figure out the solution to my problem from reading those.

I'm trying to call Dynamics 365 BC API (v.2.0) from Postman (AAD auth) and I have tried to follow the descriptions as best as I can, though they seem to be out of sync in a few places. https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/developer/devenv-develop-connect-apps

The part where I'm to to authorize and receive a token works fine, though it took some time to get it right and I had to use Fiddler to actually see the error messages. But I got it to work so Postman can now retrieve a token and store it for later use.

The part that doesn't work is the actual calls to the Dynamics BC API. I keep getting the 401 "Unauthorized", "The credentials provided are incorrect", error when I try to call Dynamics BC API using the token I retrieved.

I don't know why this happens. Maybe the app is configured wrong or maybe the URL is incorrect, I really don't get it.

I'm trying to call "https://api.businesscentral.dynamics.com/v2.0/production/api/v2.0" which I believe should give me a list of APIs available to me, but as stated above, 401.

What could be the reason for this, when I have already successfully retrieved a token from Azure?

Update 1

I was exploring the jwt token and got curious about this part, as it could be wrong, unless I'm misunderstanding the description. It says that the "iss" part of the token, should end with "/v2.0" if the token was issued by the v2.0 endpoint, and that doesn't seem to be the case here (see image).

Postman Auth URL I use is: https://login.microsoftonline.com/98...73/oauth2/v2.0/authorize

Postman Access Token URL: https://login.microsoftonline.com/98...73/oauth2/v2.0/token

So maybe there is an issue here?

Update 2

OK, so I changed the scope in Postman to the same as you, and now I get the prompt to grant access to the app by the name I created, so that is good. As far as I recall, this about the scope is not mentioned in the guide article, while Postman demands a scope so I created one and used that - obviously that is not correct which ought to be updated in that guide article (Microsoft).

However, I'm still getting an odd response, when I try to retrieve the available APIs.

{
    "error": {
        "code": "Internal_CompanyNotFound",
        "message": "The specified company ID, 98...73, does not exist.  CorrelationId:  434d...235d."
    }
}

Update 3

Strike that error message, that was for trying to retrieve companies and maybe something is wrong with that request.

The request for available APIs works now - it seems that en whole problem was about the required scope which wasn't covered by the guide article.

Thanks for the help Carl! :)

Update 4

Something is still odd though. If I try the request mentioned in the guide article to get companies "endpoint/companies", I get a response with the CRONUS company as expected, but if I then try to call "endpoint/companies(cronus-company-id)/customers" to get the customers for CRONUS, then I get 401 "Unauthorized", "The credentials provided are incorrect". The same happens if I try to get details for CRONUS. I don't get why though, since the token was just proven to work...

Answer 1

Obviously, your token is wrong and your scope is set incorrectly. You can configure your postman according to my configuration. The scope should be set to: https://api.businesscentral.dynamics.com/.default.

Parse the token：