The Maxaro API platform provides a centralised gateway for integrations with Maxaro services and Dynamics 365. APIs are organised into products according to business capability and intended consumer.

API Products

Internal products are intended for Maxaro applications and services. These include Customer, Order, Catalog, Commerce and Finance capabilities.

Partner products are intended for approved external integrations. Access to partner APIs is granted only to authorised applications and partners.

Platform Operations contains operational and support functionality and is restricted to authorised internal users.

Authentication and Access

Access to Maxaro APIs is controlled through Azure API Management products, subscriptions and Microsoft Entra ID authentication.

Internal applications

Internal applications authenticate using Microsoft Entra ID OAuth 2.0. Application permissions are assigned according to the API capabilities the application requires, such as Catalog, Customers, Orders, Commerce or Finance.

API requests must include:

  • A valid APIM subscription key for the relevant product.

  • A valid Microsoft Entra ID bearer access token containing the required application permission.

Existing integrations using the legacy AllAPIs product continue to operate during the migration period and will be moved to the new product-based access model through a controlled migration.

Partner applications

Partner applications use OAuth 2.0 client credentials and are granted access only to explicitly approved partner API products.

API requests must include:

  • A partner-specific APIM subscription key.

  • A valid Microsoft Entra ID bearer access token containing the required partner application permission.

Partner access is separated from internal application access. A partner credential does not grant access to internal API products.

Partner subscriptions are also subject to API usage controls, including rate limiting. The current standard limit is 100 requests per minute per subscription.

Access requests

Access is granted according to the minimum API capabilities required by the consuming application. Subscription credentials and application credentials must be kept secure and must not be shared between applications or partners.

API Conventions

New APIs use business-capability naming and lowercase, kebab-case URL paths. Breaking changes are introduced through explicit API versions. Existing legacy API names and URLs may remain available for compatibility with existing integrations.

Consumers should use the latest supported API version for new integrations and should not build new integrations against APIs identified as legacy.

Environments

Separate API Management environments are used during development, testing and production. Applications must use the endpoint and credentials appropriate to their environment. Credentials must not be shared between environments.

Support

For access requests, integration questions or issues with an API, contact the Maxaro integration team and include the API name, environment and relevant request/error details.