Hello,
I need to call an endpoint hosted on Azure (endpoint exposed by a "Flow" created in Power Automate). I call this endpoint from a C# application (running on an on-premise server),
The Power Automate endpoint has the following format (workflow GUID is fake):
https://prod-129.westeurope.logic.azure.com:443/workflows/1c88cfee2174ab788c4174cbab9d49b/triggers/manual/paths/invoke?api-version=2016-06-01
I'm having difficulties authenticating and successfully invoking this endpoint.
The configuration setting “Who can trigger the flow?” has the value set to “Any user in the tenant.”
This Flow via the above endpoint requires OAuth2 authentication.
What I’ve done so far:
I created a Registered App in Microsoft Entra with the following configuration:
Authentication > Supported account types: Accounts in this organizational directory only (note: we are using the same tenant as the one hosting the Power Automate Flow).
Authentication > Advanced settings > Allow public client flows: Enabled → “Yes”
API Permissions: API/Permissions name = "Power Automate" > Flows.Manage.All / Delegated
Below is the code snippet I’m using for my tests:
string flowUrl = @"https://prod-129.westeurope.logic.azure.com:443/workflows/1c88cfee2174ab788c4174cbab9d49b/triggers/manual/paths/invoke?api-version=2016-06-01";
string tenantId = "my_tenant_id";
static string clientId = "my_registered_app_client_id";
static string clientSecret = "my_client_secret_key";
// Scope candidates tested
static string scope = "https://service.flow.microsoft.com/.default";
// static string scope = "https://logic.azure.com/.default";
// static string scope = "https://management.azure.com/.default";
public static async Task<string> TestAPI()
{
// Acquire token using MSAL
var app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithClientSecret(clientSecret)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{tenantId}")).Build();
var result = await app.AcquireTokenForClient(new[] { scope }).ExecuteAsync();
// Prepare HTTP request
using var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);
var jsonPayload = "{\"param1\":\"CUSTOMER_GETDETAIL\",\"param2\":\"1090456\",\"param3\":\"EN\",\"param4\":\"User123\"}";
var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json");
var response = await httpClient.PostAsync(flowUrl, content);
var responseBody = await response.Content.ReadAsStringAsync();
foreach (var header in response.Headers)
{
Console.WriteLine($"{header.Key}: {string.Join(", ", header.Value)}");
}
Console.WriteLine($"Status: {response.StatusCode}");
Console.WriteLine($"Response: {responseBody}");
return responseBody;
}
The response I get when calling the endpoint
Status: Forbidden
Response: {"error":{"code":"MisMatchingOAuthClaims","message":"One or more claims either missing or does not match with the open authentication access control policy."}}
Am I doing this correctly?
If the overall approach is correct, which claims are missing, and how can I add them to my token?
I would be very grateful if someone could provide a clear and detailed answer to help solve this issue.
Thank you!
