Custom API returning internal server error

[Brank]

Hello,

I am using a custom API with Powerapps for collect data from database, I have been working with this with no problem when I was working with Azure App Server, the thing is that now I want to migrate this app server to a phyisical server in my organization, after I've done I checked that the API was working as expected but Powerapps is returning the following error:

The service return an error: WebApplication1!DispositivoGET: { "statusCode":500, "message": "Internal server error", "activityId":"c87e2c0c-041c-4d88-b11b-99bc80a6eb4e"}

Obviously this error is not from my side because I have tested the same method outside powerapps and it works just fine.

I obviously modify the swagger.json for point to the new host. The main difference I see in this is that I know that powerapps needs to use HTTPS for the custom API, and I've already enable HTTPS in my IIS (that is hosting the custom API) but of course the certificate is self-signed.

Is powerapps just working with CA Certificates for use custom API? In my case I don't see the point for use or pay for a CA certificate for using an internal web service. However, how can I fix this?

I am sorry but this is urgent for fix this as soon as possible.

Thanks in advance

Regards,

[v-yamao-msft]

Hi Brank,

Have you recreate the connection from PowerApps to Custom API to see if it work?

Please check this blog for a reference:
https://powerapps.microsoft.com/en-us/blog/custom-api-with-authentication/

Best regards,
Mabel Mao

[Brank]

Hello Mabel,

Actually my API has no Authentication, this means that everybody can call my API methods, the thing is that instead of using a Webservice with Azure I installed the web application in IIS Server, I tested without a CA Certification and it wont work because it just return the 500 internal server, I got a CA certificate and it just work, this means that Powerapps just let work with an API that is CA certificate.

This is so bad for me actually because I can't tell to my client at this time for buy a CA certificate.

Is there a way to communicate to my API with an unsecured connection?

Regards,

[carlosag]

I just looked in our telemetry for your request and can confirm that this is indeed that we are unable to trust the certificate:

    The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

Unfortunately for security reasons we cannot skip certificate verification since you could imagine that would make us succeptible to a 'man-in-the-middle attack' which we cannot allow.

Is there any way you could get a certificate from a trusted authority? Nowadays there are many authorities that do allow for close to free (if not free) certificates.

I also believe it is possible to specify in your swagger HTTP and that would enable calling over non-https, but I would recommend for security reasons to get a certificate, since even though the data from the device to our middle-tier would be over SSL, the data from our middle-tier to your custom API would go over an unsecure connection.

[Brank]

Thanks for the reply @carlosag I see that this is a restriction and is ok, but the documentation should be better for say these kind of restrictions. Anyway, I can see that you control this topic so I would like to ask you about other problem I have related to API authentication.

In my API I just put authentication, the HTTP request should have an "Authorization" header and the value of that header should be the API Key, in case the api key is incorrect it just return a 401 unauthorized but on the contrary it should return 200 OK, I tested this on my own with a Rest Client and it is just working fine but when I try to use this with Powerapps it is always return 401 Unauthorized. Obviously I defined in the swagger file the "securityDefinitions" just as the follow:

SecurityDefinitions:

     - type: apiKey

     - name: Authorization

     - in: header

When I add the custom API connection in Powerapps it is requesting the API Key and then I put the correct API Key.

I have just tested a lot with this. I even put in the server side that if it has to return a 401 unauthorized it should send as well the APIKey that is sent (for look what Powerapps is sending)  and I just see that powerapps is sending a null value all the time no matter what I put when powerapps when is requesting the api key.

I hope you can help me with this issue.

Regards,