Power Pages Web API: creating records with `fetch()`

Source: Claude.ai chat (original: power-pages-fetch-api-for-record-creation__0d864a54.md) Added: 2026-10-02

Summary

• Record creation via Power Pages Web API uses POST /_api/{entitysetname} with a JSON body. Required header: __RequestVerificationToken (anti-forgery token) — without it: 403/401 regardless of HTTP client.
• Microsoft's documented pattern uses webapi.safeAjax (jQuery wrapper that fetches the token automatically). Vanilla fetch() works too — you just have to pull the token yourself via shell.getTokenDeferred().done(...).
• Prereqs (site settings + permissions): Webapi/{table}/enabled = true; Webapi/{table}/fields = * (or an explicit list); table permission with Create privilege for the user's web role.

Key takeaways

• Verb → operation mapping: POST = create · PATCH = update · DELETE = delete · GET = read.
• The created record ID returns in the entityid response header (HTTP 204 No Content, no body) — not in the body as developers often expect.
• Lookups: use OData bind — "parentcustomerid_account@odata.bind": "/accounts(guid)".
• Call executes as the portal user, so Contact + web-role table permissions decide success, not the developer's own D365 role.
• Dev-only: Webapi/error/innererror = true for readable error payloads during development.

Learnings / how to apply

• Document the safeAjax vs fetch() tradeoff in a Praxisis Power Pages playbook — safeAjax for fast prototypes, fetch() where modern async/await syntax or non-jQuery stacks are required.
• "No token = silent 403" is a top support ticket — pre-empt by adding a checklist "verify __RequestVerificationToken present" when triaging portal API failures.

---