API keys

Create and manage Plur-e tenant API keys — the eight scopes and what each requires, the Business Central and CRM roles, ERP codes and their precedence, expiry, the 25-key limit and revocation.

Quick answer

A tenant administrator creates API keys in Developers → APIs → API keys → New API key. A key has a name, an expiry (30, 90, 180 or 365 days), one or more of eight scopes and the Business Central and/or CRM roles it runs under. The key is shown only once, at creation. A tenant can have 25 active keys at the same time; an active key is one that is neither revoked nor expired.

Create a key

Open Developers → APIs → API keys and press New API key. You need the Developer APIs module on your subscription and the admin role of the tenant.

Fill in the form:

Name — 1 to 100 characters, to recognise the key later (for example the integration that uses it).
Expires in — 30, 90, 180 or 365 days. The default is 90. There are no keys without expiry.
Scopes — what kind of operation the key may do. See the table below.
Business Central roles and CRM roles — shown when you choose scopes of that group. See Roles.
ERP codes used for writes — shown when you choose bc:write or bc:post. See ERP codes.

Press Create. Copy the key right away: Plur-e shows it once and stores only a hash, so it cannot be shown again. If you lose it, create another key and revoke the lost one.

Use the key as shown in Authentication. The table of keys shows each key's name, scopes, roles, last four characters, creator, creation and expiry dates, last use and status (Active, Expired or Revoked).

Scopes

A scope allows one kind of operation. Some scopes need another one to be selected too: the form selects the requirement for you.

Scope	Allows	Requires
`bc:read`	Business Central · Read: list methods, run read methods, query entities	—
`bc:write`	Business Central · Write: methods that change data	`bc:read`
`bc:post`	Business Central · Post: methods that post documents (irreversible)	`bc:read`
`crm:read`	Dynamics 365 CRM · Read: entities, records, FetchXML and search	—
`crm:write`	Dynamics 365 CRM · Create and update: create, update, state, assign, associate and actions	`crm:read`
`crm:delete`	Dynamics 365 CRM · Delete: delete records, disassociate and delete-type actions	`crm:read`
`panel:read`	Plur-e panel · Mobile users, devices, roles, modules and activity	—
`panel:locations:read`	Plur-e panel · Recorded locations of mobile users (personal data)	`panel:read`

A call without the scope it needs answers 403 with error plure_1321, for example This API key does not have the scope 'crm:delete'. Give each integration the smallest set of scopes it needs.

Roles

Scopes say what kind of operation; roles say on which entities and areas. The API uses the same MCP roles as the AI assistants. Create them in Developers → AI & MCP → Roles; see MCP roles for how roles work.

A key with any Business Central scope needs at least one Business Central role.
A key with any CRM scope needs at least one CRM role, and all the CRM roles must belong to the same CRM connection. That connection is the one the key uses.
Roles are assigned to the key explicitly. The tenant's default role is not added automatically.
A key gets the intersection of its roles and its scopes. The scope sets a ceiling on the actions the roles can grant:

Scope	Highest action it allows
`bc:read`	Read
`bc:write`	Update
`bc:post`	Post
`crm:read`	Read
`crm:write`	Create and Update
`crm:delete`	Delete

So a role that grants Delete on an entity does nothing for a key that lacks crm:delete, and a key with bc:post still cannot post in an area whose role does not grant Post.

ERP codes

Some Business Central methods act on behalf of a person: a warehouse employee, a salesperson or a sales location. For keys with bc:write or bc:post you can set a default for each:

Warehouse employee
Salesperson
Sales location

Each is at most 50 characters. Plur-e does not check them against Business Central when you save them. For every write call the code used is, in order of precedence:

The value you pass explicitly in the parameters of the call.
The code stored on the key.
The tenant default set in Developers → AI & MCP → Settings → ERP identity.
If none exists, the call is refused with 422 and the code erp_user_not_mapped.

Limits

Limit	Value
Active keys per tenant	25 (creating another answers `409`, error `plure_1317`)
Expiry choices	30, 90, 180 or 365 days (default 90)
Name length	1 to 100 characters
ERP code length	50 characters
Requests per key	120 per minute

Revoke a key

In the table of keys, press Revoke and confirm. Revoking is immediate in the Admin Center and effective on the API within one minute; see Authentication. Revoking an already revoked key does nothing.

Only tenant administrators can create and revoke keys. Support staff can list them, and trying to create or revoke answers error plure_1319.

Usage log

Developers → APIs → Usage log lists every request authenticated by your keys, newest first, and can be filtered by key. Each row shows the time, the key, the API (bc, crm or panel), the operation, the target (method, entity or resource), the status, the duration and the error code. It never stores the key or the request body. Rows are kept for 90 days.