How to Create OAuth Credentials for Microsoft Dynamics 365 Business Central

This guide will help you set up your Microsoft Dynamics 365 Business Central OAuth app to connect with Apideck and start using the Accounting API.

This uses a standard Microsoft Entra ID app registration with the right permissions — there is no marketplace listing to submit. For quick testing you can start with Apideck's temporary shared sandbox credentials; register your own Entra app for production so your consumers authorize against your application.

Prerequisites

Before you begin, make sure you have:

1. A Microsoft Entra ID tenant and an account with at least the Cloud Application Administrator role in it, so you can create an app registration and grant admin consent. See Microsoft's Register an application quickstart.
2. Access to the Microsoft Entra admin center
3. An Apideck account

1. Enable the Microsoft Dynamics 365 Business Central connector in Apideck

1. Navigate to the Apideck Dashboard
2. Go to Configuration > Accounting > Microsoft Dynamics 365 Business Central
3. The connector will be available for configuration

2. Create OAuth App in Microsoft Entra

Access Microsoft Entra Admin Center

1. Log in to the Microsoft Entra admin center as at least a Cloud Application Administrator
2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application from the Directories + subscriptions menu
3. Navigate to Home > App registrations and select New registration

Configure Basic Information

On the Register an application page, enter your application's registration information:

1. Name - Enter a meaningful application name that will be displayed to users of the app

2. Supported account types - Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant). Multitenant is what allows your consumers to authorize from their own Business Central tenants; they sign in with their work Business Central account, so the personal-Microsoft-account option is not needed.

3. Redirect URI - Select the Web platform and enter exactly https://unify.apideck.com/vault/callback

4. When finished, select Register

Add API Permissions

After your app is created, select API permissions in the sidebar.

1. Select Add a permission > Dynamics 365 Business Central > Delegated Permissions and choose:
   • user_impersonation
   • Financials.ReadWrite.All

2. Select Add a permission > Dynamics 365 Business Central > Application Permissions and choose:

   • app_access
   • AdminCenter.ReadWrite.All
   • API.ReadWrite.All
   • Automation.ReadWrite.All

3. Grant admin consent for the permissions by clicking Grant admin consent for [Your Organization]

Note: Application permissions always require administrator consent, so this step is not optional — skip it and calls made through the connector will fail. An Entra administrator in each consumer's own tenant also grants consent once, the first time someone from that tenant authorizes your app.

Get Your Credentials

Get Client ID

1. On the Overview page of your app, locate the Application (client) ID
2. Copy the Client ID - you'll need this for Apideck configuration

Create Client Secret

1. Go to Certificates & secrets > Client secrets and select New client secret

2. Enter a description and select an expiry time. Client secret lifetime is limited to two years (24 months) or less. You can't specify a custom lifetime longer than 24 months

IMPORTANT: After the secret is generated, you'll see both a Secret ID and a Value.

• Copy the VALUE only - this is what you'll use as your Client Secret in Apideck
• The Value is shown once and cannot be retrieved after you leave this page
• Do not use the Secret ID - that's different from the Value you need

Record the expiry date somewhere you will see it again: rotating the secret before it expires is yours to own, and every consumer connection using this app registration stops working once it lapses. See Client secret expired or connections stopped working below.

3. Configure the Microsoft Dynamics 365 Business Central connector in Apideck

1. Open the Apideck Microsoft Dynamics 365 Business Central connector settings in the Apideck Dashboard
2. Select the Use your client credentials option
3. Enter your OAuth credentials:
   • Client ID - Paste the Client ID from your Microsoft Entra app (from the Overview page)
   • Client Secret - Paste the Value of the client secret from your Microsoft Entra app
4. Click Save settings to save your credentials

Apideck requests two scopes on the Microsoft consent screen your consumers will see:

• https://api.businesscentral.dynamics.com/user_impersonation
• openid

That shorter list is expected, and is not a mismatch with step 2. The consent scopes are what the authorization-code exchange asks the signing-in user for; the delegated and application permissions you registered above are what the underlying Business Central API calls need. Both sets have to be in place.

4. Set the required journal batch names

Three resources will not work until a Business Central journal batch is named for them on the connection. Each setting is required, and the batch cannot be chosen per request:

Resource	Setting	Business Central batch	Example value
journal-entries	journal_entries_journal_batch_name	General Journals	DEFAULT
expenses	expenses_journal_batch_name	General Journals	EXPENSES
bill-payments	bill_payments_journal_batch_name	Payment Journals	CASH

Batch codes are per-company, so only the consumer who owns the connected Business Central company can look them up and enter them — this is guidance to relay to your consumers rather than a step you perform yourself:

1. The batch must exist in Business Central. The value is the batch code, taken from the General Journal Batches page — or, for bill payments, from the batches under the Payment Journals template. A code that is unset, unknown in the connected company, or under the wrong template causes an explicit journal-batch error on that resource's reads and writes.
2. The consumer sets the value on their connection, alongside the Environment and Company selection, when configuring the connection in Apideck Vault — the consumer connection guide walks them through it.

Journal entries and expenses are also read from that one batch: an unfiltered list returns draft entries from the configured batch only.

5. Test Your Connection

You can test your Microsoft Dynamics 365 Business Central connector by clicking Test Vault in the Apideck Dashboard.

1. Click Authorize to start the OAuth flow

2. You'll be redirected to Microsoft to grant permissions
3. After successful authorization, select the Environment and Save, then select the Default Company from the dropdown and Save the changes
4. The connection will show as Connected

6. Do your first API call to the Accounting API

1. Connect through Vault
2. Test with this call:

curl --location 'https://unify.apideck.com/accounting/customers' \
 --header 'x-apideck-consumer-id: test-consumer' \
 --header 'x-apideck-app-id: {APIDECK_APP_ID}' \
 --header 'x-apideck-service-id: microsoft-dynamics-365-business-central' \
 --header 'Authorization: Bearer {APIDECK_API_KEY}'

---

Now your app and Microsoft Dynamics 365 Business Central integration are configured! 🎉

FAQ and troubleshooting

Client secret expired or connections stopped working

Two different expiries can break a working connection, and they are fixed in different places:

• Your client secret expired. Microsoft caps a client secret at 24 months, and when it lapses every consumer connection using this app registration fails. Create a new secret under Certificates & secrets, paste its Value into the connector settings, and save. This one is yours to do — Apideck cannot rotate it for you.
• One consumer's connection went dormant. Microsoft Entra expires a refresh token after 90 days without use, so a single connection nobody has touched needs that consumer to authorize again. Apideck refreshes tokens automatically while a connection is in use.

If a connection still fails once both are ruled out, contact Apideck Support.

Vendor Posting Group Error When Creating Bills

When creating a bill in Business Central with a supplier created through the API, you may encounter this error:

{
  "error": {
    "code": "Application_FieldValidationException",
    "message": "Vendor Posting Group must have a value in Vendor: No.=V00050. It cannot be zero or empty. CorrelationId: ..."
  }
}

This happens because Vendor Posting Group is a required field for vendors in Business Central, but it cannot be set through the API. Without it, the vendor cannot be used in bills.

To resolve this, you have two options:

---

Option 1: Set the Vendor Posting Group manually via the UI

1. Open Business Central and navigate to Vendors.
2. Select the vendor created via the API.
3. On the Vendor Card, locate the Vendor Posting Group field.
4. Assign the correct posting group and save.

---

Option 2: Use a Vendor Template with a predefined Posting Group

1. In Business Central, search for Templates and create a new template.
2. Fill in the following key fields:
   • Code: Give the template a code, e.g. VEND_API.
   • Description: Add a meaningful description, e.g. Template to add posting group.
   • Table ID: Select the vendor table.
   • Enabled: Make sure the toggle is switched on.
3. In the API Setup page, link this template so that vendors created via the API automatically inherit the posting group.

4. Test by creating a new vendor through the API; the posting group should now be set automatically.

---

✅ By applying either of these methods, every supplier created through the API will have a valid posting group, allowing you to use them in bills without errors.

---

G/L Account Posting Group Errors When Creating Bills, Invoices, or Expenses

When creating a bill, invoice, or expense with a G/L Account line item, you may encounter one or more of these errors:

{
  "error": {
    "code": "Application_FieldValidationException",
    "message": "Gen. Prod. Posting Group must have a value in Purchase Line: Document Type=Invoice, Document No.=... It cannot be zero or empty."
  }
}

{
  "error": {
    "code": "Application_FieldValidationException",
    "message": "Setup is blocked in VAT Posting Setup: VAT Bus. Posting Group=DOMESTIC, VAT Prod. Posting Group=."
  }
}

{
  "error": {
    "code": "Application_DialogException",
    "message": "Tax Group Code must have a value in Purchase Line: Document Type=Invoice, Document No.=... It cannot be zero or empty."
  }
}

These errors occur because Business Central requires posting group fields to be configured directly on the G/L Account card used for the line item. These fields cannot be set through the API.

The exact fields required depend on your Business Central localization:

Field	Required in	Controls
Gen. Posting Type	EU/UK tenants (VAT)	Classifies the account as Purchase or Sale for VAT purposes
Gen. Prod. Posting Group	All tenants	Revenue/cost account routing (General Posting Setup)
VAT Prod. Posting Group	EU/UK tenants (VAT)	VAT calculation (VAT Posting Setup)
Tax Group Code	US/Canada tenants (Sales Tax)	Sales tax calculation

How to configure posting groups on a G/L Account

1. In Business Central, open the Chart of Accounts.
2. Find and open the G/L Account used for bill, invoice, or expense line items.
3. Go to the Posting tab (or expand the Posting FastTab).
4. Set the Gen. Prod. Posting Group field to an appropriate group (e.g., MISC, SERVICES).
5. Set the tax field for your localization:
   • EU/UK tenants: set Gen. Posting Type to Purchase, then set VAT Prod. Posting Group (e.g., STANDARD for the standard VAT rate).
   • US/Canada tenants: set Tax Group Code (e.g., SUPPLIES, NONTAXABLE).
6. Save the account card.

For bills and invoices, Business Central automatically inherits these values onto purchase lines when the account is selected.

For expenses (journal-based), Business Central copies Gen. Posting Type from the account card when a journal line is created. If you configure posting groups on an account after expenses have already been created as drafts, those existing draft journal lines will not be updated — they will still have a blank Gen. Posting Type and will fail to post. In that case, delete the draft expense and recreate it so new journal lines are created with the correct values inherited from the account card.

Note: These are Business Central tenant configuration requirements. These fields on G/L Accounts are not exposed in the Business Central v2.0 API and cannot be set programmatically.

✅ After configuring the posting groups on the G/L Account, bills, invoices, and expenses using that account as a line item will post successfully.