Question 420
At fictional Foxglove Medical, the Business Central development team is supporting regulated item distribution and reviewing external-service integration during a troubleshooting exercise (MB820-6.2-200). The observed development issue is that a custom API returns sensitive customer columns because all fields from the backing table were added to the API page. Which recurring engineering check would best prevent this issue from returning?
Explanation
Correct Answer
The ongoing check is to audit API field lists and permission behavior after schema changes. This helps detect recurrence when a custom API returns sensitive customer columns because all fields from the backing table were added to the API page. The associated correction is to expose only the minimal approved fields and apply entitlement and permission rules; a confirming result is that the API payload omits protected fields for unauthorized consumers. Applied here, the relevant facts are: The observed development issue is that a custom API returns sensitive customer columns because all fields from the backing table were added to the API page. The question asks which recurring engineering check would best prevent this issue from returning.
Incorrect Answers
“Diff published schemas before deployment” concerns the alternative task “preserve compatible contracts or introduce a deliberate versioned API and migration path”, but the stated failure is that a custom API returns sensitive customer columns because all fields from the backing table were added to the API page. The required measure is to audit API field lists and permission behavior after schema changes.
“Test multi-line and missing-child API responses” supports the separate task “design appropriate API page parts or supported related entity navigation with stable keys”, not the reported problem: a custom API returns sensitive customer columns because all fields from the backing table were added to the API page. This case instead calls for “Audit API field lists and permission behavior after schema changes”.
“Check supported API object capabilities before planning extensions” concerns the separate step “publish a compatible new API contract or supported API page design rather than assuming API page extension is available”. The reported issue is that a custom API returns sensitive customer columns because all fields from the backing table were added to the API page, so the direct response is to audit API field lists and permission behavior after schema changes.