Creating Custom API endpoint to consume by other applications (outside MS platform)

[Sidhant_02]

Hi everyone,
I have a Canvas application named Skill Application to track a team members skill set, project details (completed/on-going) and some personal information. For this application I have made use of SharePoint as the data-source to store the details in the respective sharepoint lists (like Education has its own list: Qualification, etc).
Now what I wanted to do is expose the data source (in this case Sharepoint) as an API endpoint along with some authorization (to avoid access by anyone), so with this API url the designated person or it can be some other application (that is not developed in Power Platform) should be able to CRUD operations (retrieve the details, make updates, add new records, etc)

Employee_Projects is one of the SharePoint list ( there are around 7-8 SP list) which I want to be exposed as an API endpoint with some validation (to avoid unauthorized access) and how to add some logic (like if there is no record that is present in the given list then create a new one ; if the other app is trying to update an existing record  like particular attribute/column value) how to do that.

I have come across few methods which are registering the SharePoint application (that generate the Client secret and client id) and the other one is in Azure AD
Reference:
How to Call SharePoint REST API from Postman using OAuth2 Authorization Flow 
Accessing SharePoint Data using Postman (SharePoint REST API) 
[the above 2 links require to have appropriate permissions to proceed // id and secret key creation]

So alternatively I did found one documentation: To create custom API
Custom API doc 

But currently I am not sure this satisfies the requirement, so if anyone has an idea about this topic do let me know.

Regards,
Sidhant.

[Pavan_Mani_Deep]

Hi @Sidhant_02 ,

Here is the approach you can follow..

1. Authentication and Authorization:

   • You can use Azure Active Directory (Azure AD) to handle authentication and authorization for your API. This involves registering an application in Azure AD and configuring permissions for accessing SharePoint data.
   • You can use OAuth 2.0 authorization flow to obtain access tokens that are required to make requests to your API endpoints.

2. Custom API Endpoint:

   • Create a custom API endpoint using Azure Functions, Azure API Management, or any other suitable platform that supports custom API development.
   • This API endpoint will serve as a proxy to interact with SharePoint data. It will handle incoming requests, validate access tokens, and perform CRUD operations on SharePoint lists accordingly.

3. CRUD Operations:

   • Implement logic in your custom API endpoint to handle CRUD operations. This logic will include:
     • Retrieving data from SharePoint lists.
     • Creating new records if they don't exist.
     • Updating existing records based on certain conditions.
     • Deleting records as required.

4. Secure Access:

   • Ensure that your API endpoint is accessible only to authorized users or applications. Validate access tokens provided in the request headers to authenticate users or applications.
   • Use role-based access control (RBAC) or other authorization mechanisms to restrict access to specific operations or resources based on user roles or permissions.

Thank you.

If I have answered your question, please mark your post as Solved.

If you like my response or got a direction forward to proceed, please give it a Thumbs Up. Appreciate your Kudos. You can accept more than one post as a solution.

Cheers,

PMDY

[Sidhant_02]

Hi @Pavan_Mani_Deep ,
Thanks for the response if possible could you recreate the scenario from your side in one of a sample application (like a dummy SP list and a simple app). As I pretty new to this stuff so your help will be appreciated.

Regards,
Sidhant.