Power Platform custom connector for internal APIs

1Step 1: Prepare the API's OpenAPI definition

A connector is a wrapper around a REST API. Describe that API in an OpenAPI 2.0 file (formerly Swagger). OpenAPI 3.0 isn't supported, and the file must be smaller than 1 MB.

Give each operation a stable operationId, a summary and a description: they become the action's name and label in flows and apps. The x-ms-summary extension provides a field's label.

Header names and values must contain ASCII characters only. If the API is only reachable on your network, plan for an on-premises data gateway.

Without an OpenAPI file, you can also start from a Postman collection or describe the API manually in the wizard.

{
  "swagger": "2.0",
  "info": { "title": "ApiInterne", "version": "1.0.0" },
  "host": "api.exemple.fr",
  "basePath": "/",
  "schemes": ["https"],
  "securityDefinitions": {
    "api_key": { "type": "apiKey", "in": "header", "name": "X-Api-Key" }
  },
  "security": [{ "api_key": [] }],
  "paths": {
    "/clients/{id}": {
      "get": {
        "operationId": "GetClient",
        "summary": "Get a customer",
        "parameters": [
          { "name": "id", "in": "path", "required": true, "type": "string", "x-ms-summary": "Customer ID" }
        ],
        "responses": { "200": { "description": "Customer found" } }
      }
    }
  }
}

Check: The file starts with "swagger": "2.0", is smaller than 1 MB, and every operation has an operationId.

2Step 2: Create the connector in a solution

The Data > Custom connectors entry is no longer in the left pane: connectors are now created in a solution. In Power Apps or Power Automate, open Solutions, then an unmanaged solution.

Select New > Automation > Custom connector. Choose Import an OpenAPI file to start from your file, or Create from blank to describe everything manually. Enter the connector name, then Continue.

On the General tab, check Scheme (HTTPS), Host and Base URL: the connector uses them to build every call. Add a PNG or JPG icon smaller than 1 MB and a description. Save with Create connector.

From the command line, pac connector create creates the connector from the definition and a properties file, and can add it straight to a solution. pac connector init generates a starter properties file with an authentication template (NoAuth, BasicAuth, ApiKey, OAuthGeneric, OAuthAAD).

pac connector init --connection-template "ApiKey" --generate-settings-file --outputDirectory .\ApiInterne
pac connector create --api-definition-file .\apiDefinition.json --api-properties-file .\apiProperties.json --solution-unique-name MaSolution
pac connector list

Check: The connector appears among the solution's components and pac connector list returns it (only solution-aware connectors are listed).

3Step 3: Configure API key authentication

On the Security tab, choose API Key as the authentication type. If your OpenAPI file declares a securityDefinitions entry of type apiKey, these fields are already filled in.

Fill in Parameter label, Parameter name and Parameter location. The label is shown when someone creates a connection. The name and location (Header or Query) must match exactly what the API expects.

If the API expects a bearer token, the user types Bearer followed by a space before the key when creating the connection.

Check: The Security tab shows API Key with the header name your API expects, and the connector saves without errors.

4Step 4: Or configure OAuth 2.0 with Microsoft Entra ID

Microsoft recommends Entra ID to secure an API and its connector. In the Azure portal, create an app registration for the connector. Note its Application ID, add the required delegated permissions under API permissions, then create a client secret under Certificates and secrets.

On the connector's Security tab, choose OAuth 2.0 and the Azure Active Directory identity provider. Fill in Client ID, Client secret and Resource URL (your API's identifier, entered exactly).

Save: the Redirect URL field is populated. Each connector has its own redirect URL. Copy it into the app registration, under Authentication > Add URI.

Option with no secret to renew: select managed identity on the Security tab, then add the issuer and subject shown as Federated Credentials in the Entra application. It requires a single-tenant application and an actual tenant ID, not common.

Check: Creating a connection opens the Microsoft sign-in page, then the connection appears with no redirect error.

5Step 5: Define and refine the actions

On the Definition tab, the left pane lists actions, triggers and references. To add one: New action, then Summary, Description and Operation ID.

Visibility controls how an operation or parameter is displayed: none (normal), advanced (under a menu), internal (hidden), important (shown first).

Under Request, Import from sample creates the parameters from a verb, a URL and a sample JSON body. Under Response, Add default response does the same for the response. Then edit each body parameter to give it a title, a description, a default value and whether it's required.

Fix whatever the Validation area reports, then Update connector. The optional Code tab accepts C#: five seconds of execution at most, 1 MB file at most.

Check: The Validation area shows a green check mark and every action has an explicit Operation ID.

6Step 6: Test the connector in the wizard

Open the Test tab, select New connection, provide the API key or sign in, then Create connection. With an API key, wait a few minutes after creating it: the connector isn't ready right away.

In Power Automate, go back to the Test tab and refresh the connections list. Choose an operation, enter its parameters, then Test operation.

Read the response: HTTP status, headers and body. A 401 error indicates an incorrect key or OAuth credentials. A 403 error can come from a firewall that blocks the outbound IP addresses of managed connectors.

Check: Test operation returns a 200 status and the expected body from your API.

7Step 7: Use the connector in Power Automate and Power Apps

A connector created in Power Automate is available in Power Apps and Copilot Studio, and vice versa. In a flow, add an action, search for your connector, then choose the operation: its name and description come from the definition.

In a canvas app, open the Data pane and add the connection. Then call the operation in a formula, in the form ConnectorName.OperationId(...).

To let other makers use it: More > Discover all > Data > Custom connectors, then ... > Invite another user, with Can view or Can edit. Sharing an app or a team flow also shares the connector.

If you change the API, update the connector, then remove and re-add the data source in the apps that use it.

// OnSelect property of a button (canvas app)
ClearCollect(colClient, ApiInterne.GetClient(txtId.Text))

Check: The test flow runs successfully and the Power Apps formula returns data with no connection error.

8Step 8: Classify the connector in data policies

At the environment level, the custom connector appears on the data policy's Connectors page, alongside the prebuilt connectors. Classify it as Business, Non-business or Blocked. Without an explicit classification, it falls into the default group.

At the tenant level, custom connectors are classified by host URL pattern, on the policy's Custom connectors page, via Add connector pattern. Rules are ordered. The * rule is always last and defaults to Ignore.

For example, create a https://api.exemple.fr* rule as Business, above the * rule. Avoid managing custom connectors by name in a tenant-level policy: a name is only meaningful within its own environment.

Check: The policy's Custom connectors page lists your URL pattern above the * rule, with the intended classification.