Small and medium business | Business Central, N...

Hiding columns from table in OData API calls

(1) Share

Report

Posted on by MarcL

We have a security problem with API access to our Business Central database.

We have a table that needs to be accessed by all employees.

That table contains Salary information fields that are hidden in BC but can be accessed via an OData API call from PowerBI or Excell.

I’m pretty sure our company wasn’t setup right, but API access must be maintained for reporting purposes and using linked tables is not a viable solution.

Applying security filters, from BC, to the specific fields doesn’t do the trick, since the hole line gets filtered, and we need it.

Does anyone know how we can hide fields from API calls while the others, from the same line can still be read?

Thanks

Categories:

Dynamics 365 Business Central

I have the same question (0)

All responses (3)

Answers (0)

Suggested answer

Valentin Castravet 31,481 Super User 2025 Season 2 on at

Like (1)

Report

I would create a copy of that API and exclude the salary field in the newly created API. All employees would use the new API.

Valentin Castravet
Work: Zander ERP Services
Blog: Dynamics 365 Business Central Insights
LinkedIn: www.linkedin.com/in/valentin-c-0500a247/

Was this reply helpful? Yes No
Suggested answer

YUN ZHU 95,729 Super User 2025 Season 2 on at

Like (1)

Report

Hi, hope the following helps.

Dynamics 365 Business Central: Can we extend standard APIs? – Download Standard Source Code for APIs

https://yzhums.com/20960/

If you are using a Web Service, you can hide this field on the published page so that users cannot see it.

If it is a Flowfield or TableRelation field, it can be managed through permissions.

More details:

Dynamics 365 Business Central: What happens if users don’t have permission to read the table set in a FlowField?

https://yzhums.com/33649/

Dynamics 365 Business Central: What happens if users don’t have permission to read the table set in the TableRelation Property?

https://yzhums.com/46458/

Thanks.

ZHU

Was this reply helpful? Yes No
Suggested answer

Saurav.Dhyani 14,380 Super User 2025 Season 2 on at

Like (1)

Report

Hi,

You cannot change the field list exposed by a standard API.

If it a custom API Endpoint created by your partner, you can ask them to remove fields that are sensitive and have a separate endpoint for specific people in team to access that data.

If filters need to be applied on data that can also be done by a developer on Custom API Endpoint.

Let me know if you have additional questions, but I think your solution should be simple enough with one or more custom API Endpoints.

Regards,

Saurav Dhyani

https://bit.ly/SubscribeSauravYouTube

Was this reply helpful? Yes No