Power Pages Web API: Replace Deprecated Wildcard?

Yes, the Power Pages Web API has replaced the deprecated wildcard setting for site metadata. Instead of using the wildcard (*) in the Site Marker or Site Setting values to match any page, you now configure the Web API explicitly per site marker or use the newer EnableWebApi site setting with specific entity permissions. This change removes the blanket “allow allâ€� behavior and forces a more secure, granular configuration.

Background: What the Wildcard Setting Did

In earlier versions of Power Pages (formerly Power Apps Portals), the Web API could be enabled for all lists and forms by setting a site setting like Webapi//enabled to *. This wildcard meant “apply to every entity,â€� which was convenient but risky—it exposed all entities that had list or form metadata, even those you might not have intended to expose. The wildcard also made it harder to audit which tables were actually accessible via the API.

Microsoft deprecated this wildcard behavior in 2022 and removed it in later releases. The current model requires you to explicitly enable the Web API for each entity you want to expose, using a site setting that names the entity (e.g., Webapi/account/enabled) or by configuring table permissions directly. This aligns with the security principle of least privilege.

How the Replacement Works

The replacement uses two main mechanisms:

• Site Settings for Web API: You create a site setting named Webapi//enabled and set it to true. For example, Webapi/account/enabled = true enables the Web API for the Account table. There is no wildcard option anymore.
• Table Permissions: In the Power Pages admin center, you define table permissions that specify which roles can read, create, update, or delete records via the Web API. These permissions are tied to a specific table and scope (global, contact, account, etc.).

For the Web API to work on a page, you must also have the appropriate site marker that points to a page where the API is used. The site marker itself doesn’t control the API—it just identifies the page. The actual enablement is via the site setting and table permissions.

Step-by-Step: Migrating from Wildcard

If you have an existing portal that used the wildcard, here’s how to migrate:

1. Go to the Power Pages admin center and select your site.
2. Under Set up, open Web API (or go to Site settings in the portal management app).
3. List all entities that your portal’s Web API calls actually use. You can find these by searching your code for WebAPI calls or checking network requests in the browser.
4. For each entity, create a site setting: Webapi//enabled = true.
5. Remove any old wildcard settings like Webapi/*/enabled or Webapi/enabled.
6. Create table permissions for each entity, assigning the appropriate web roles and scopes.
7. Test each API call in a browser or with a tool like Postman to confirm it works.

If you miss an entity, the API call will return a 404 or 403 error, which is a clear signal you need to add the setting.

Common Problems and How to Fix Them

When moving away from the wildcard, you might encounter these issues:

• 404 Not Found: The entity is not enabled. Check that the site setting name is exactly Webapi//enabled and the value is true (lowercase).
• 403 Forbidden: Table permissions are missing or the user’s role doesn’t have access. Create table permissions with the correct scope and assign the web role.
• “Cannot find entityâ€� errors: The logical name might be wrong. Use the exact name from the Dataverse table definition, e.g., account, contact, incident.
• API works in studio but not on the live site: The site settings might not have been published. Click Sync in the portal management app to push changes.

Also, remember that the Web API only works on pages that have a site marker (the page’s URL). If you removed a wildcard, you might have also removed a site marker that was used for routing—keep the marker, just change the settings.

Security Implications and Best Practices

The wildcard removal is a security improvement. With the old wildcard, any entity with a list or form could be accessed via the API, even if you didn’t intend it. Now you must explicitly allow each entity, which reduces the attack surface.

Best practices for the new model:

• Enable only the entities you need, not all of them.
• Use table permissions with the narrowest scope possible. For example, if users only need to read their own records, use Contact scope with a relationship to the contact.
• Regularly audit your site settings and table permissions to remove anything unused.
• Use the Webapi//enabled setting per entity instead of a global setting.

This approach also makes it easier to see exactly what is exposed when you review your portal’s configuration.

Alternatives to the Web API

If you’re using the Web API for client-side scripting, you might consider alternatives that don’t require per-entity configuration:

• Liquid Templates: For simple data display, you can use Liquid tags like {% fetchxml %} to query data server-side without exposing the Web API.
• Power Automate Flows: For actions like create or update, you can call a Flow from your page using the POST method to a custom endpoint, avoiding the Web API entirely.
• Custom Server-Side Code: If you have a custom web template, you can use server-side code in a Liquid template to handle data operations, though this is more complex.

These alternatives might be simpler if you only need a few operations and don’t want to manage per-entity settings.

Frequently Asked Questions

Can I still use a wildcard in any site setting?

No. The wildcard is deprecated and no longer works for Web API enablement. You must specify each entity explicitly. Other site settings (like those for search or authentication) may still accept wildcards, but not for the Web API.

What is the exact site setting name for enabling the Web API?

For an entity with logical name account, the setting is Webapi/account/enabled with value true. You can also set Webapi/account/enabled to false to disable it. There is no setting for all entities at once.

Do I need table permissions if I enable the Web API via site settings?

Yes. Site settings only enable the API endpoint for that entity. Table permissions determine which users (by web role) can actually perform operations. Without table permissions, all API calls will return 403.

Why does my Web API call return 404 after I removed the wildcard?

A 404 usually means the entity is not enabled. Check that the site setting exists and is set to true. Also verify the entity logical name is correct and that you have synced the portal.

Can I use the Web API on a page that doesn’t have a site marker?

No. The Web API is only available on pages that have a site marker (i.e., a page that is part of the portal’s URL structure). If you removed a site marker, the API won’t work on that page.

Is there a way to enable the Web API for all entities in a single setting?

No. The deprecated wildcard was the only way, and it’s gone. You must create a site setting for each entity you want to expose. This is intentional for security.

Related

• Google Tensor G5 Spec Leak: Pixel 10 Details
• Nikon D850 Infrared: Filter or Conversion?
• Best Smart Locks for Rental Properties