Contacts APIs

Base routes: /api/contacts and /api/auth/contacts  |  Content-Type: application/json

Tip: This site enforces HTTPS redirection. Always call the API using https:// (or a relative path like /api/auth/contacts) so requests such as POST/PUT aren't converted to GET during a redirect.
Microsoft Entra authorization: Every request to /api/auth/contacts requires an Entra access token in the Authorization: Bearer <token> header. Signed-in users need Contacts.Read or Contacts.ReadWrite for GET requests. POST, PUT, and DELETE requests require Contacts.ReadWrite. The original /api/contacts route intentionally remains anonymous.
MCP servers: The Contacts API is also exposed as MCP server (Streamable HTTP) endpoints at /mcp and /mcp/auth. Both expose GetContacts, GetContact, CreateContact, UpdateContact, and DeleteContact for use by MCP-compatible AI agents and clients (e.g. VS Code, Claude Desktop). Because each endpoint exposes mutation tools, it requires Contacts.ReadWrite for a signed-in user or Contacts.ReadWrite.All for an app-only token.

Controllers

Controller Base route Behavior
ContactsController /api/contacts Original anonymous contacts CRUD API
AuthContactsController /api/auth/contacts Entra-protected contacts API with read/write role enforcement

Endpoints

Replace {baseRoute} with either controller base route listed above.

Method Route Description Body
GET {baseRoute} Get all contacts —
GET {baseRoute}/{id} Get a single contact by id —
POST {baseRoute} Create a new contact { "name", "email", "phone", "address", "status" }
PUT {baseRoute}/{id} Update an existing contact (body id must match route id) { "id", "name", "email", "phone", "address", "status" }
DELETE {baseRoute}/{id} Delete a contact by id —

Sample requests

# Create
curl -X POST "https://<your-host>/api/auth/contacts" ^
    -H "Authorization: Bearer <access-token>" ^
  -H "Content-Type: application/json" ^
  -d "{\"name\":\"Jane Doe\",\"email\":\"jane.doe@example.com\",\"phone\":\"555-123-4567\",\"address\":\"123 Main St\",\"status\":true}"

# Get all
curl "https://<your-host>/api/auth/contacts" -H "Authorization: Bearer <access-token>"

# Get by id
curl "https://<your-host>/api/auth/contacts/1" -H "Authorization: Bearer <access-token>"

# Update
curl -X PUT "https://<your-host>/api/auth/contacts/1" ^
    -H "Authorization: Bearer <access-token>" ^
  -H "Content-Type: application/json" ^
  -d "{\"id\":1,\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.com\",\"phone\":\"555-987-6543\",\"address\":\"456 Oak Ave\",\"status\":false}"

# Delete
curl -X DELETE "https://<your-host>/api/auth/contacts/1" -H "Authorization: Bearer <access-token>"

$baseUrl = "https://<your-host>/api/auth/contacts"
$headers = @{ Authorization = "Bearer <access-token>" }

# Create
$body = @{ name="Jane Doe"; email="jane.doe@example.com"; phone="555-123-4567"; address="123 Main St"; status=$true } | ConvertTo-Json
$created = Invoke-RestMethod -Uri $baseUrl -Method Post -Headers $headers -Body $body -ContentType "application/json"
$id = $created.id

# Get all
Invoke-RestMethod -Uri $baseUrl -Method Get -Headers $headers

# Get by id
Invoke-RestMethod -Uri "$baseUrl/$id" -Method Get -Headers $headers

# Update
$updateBody = @{ id=$id; name="Jane Smith"; email="jane.smith@example.com"; phone="555-987-6543"; address="456 Oak Ave"; status=$false } | ConvertTo-Json
Invoke-RestMethod -Uri "$baseUrl/$id" -Method Put -Headers $headers -Body $updateBody -ContentType "application/json"

# Delete
Invoke-RestMethod -Uri "$baseUrl/$id" -Method Delete -Headers $headers

Try it live

Requests below are sent via fetch to the selected controller on this same site.

Create contact (POST)
Get by id (GET)
Delete (DELETE)
Response