Question

You are building a custom API message named contoso_RecalculateInventory that performs a sensitive, long batch operation. Business requirements state that only users who hold a specific security privilege should be able to invoke it, and the operation must be callable both from the Web API and from within other plug-ins. When defining the Custom API record in Dataverse, which configuration correctly enforces the privilege requirement without writing extra authorization code?

Accepted Answer

Set the 'Execute Privilege Name' field on the Custom API to the required privilege so Dataverse checks the caller's privilege before running the plug-in.

Answer

Set 'Is Private' to Yes on the Custom API so that only privileged users appear in the Web API metadata.

Answer

Set 'Binding Type' to Entity and 'Is Function' to Yes so the message inherits table-level security roles automatically.

Answer

Add a check in the plug-in's pre-validation stage that queries the systemuserroles table and throws if the privilege is missing.