How can we monitor Power Automate connection health using an API?

No supported Microsoft API currently returns the complete tenant-wide connection-health dataset described; the supported approach is to enumerate environments and connections, use Power Platform inventory to map connector usage to flows and agents, and treat run failures as separate telemetry rather than authoritative connection health.

1. Enumerate connections across environments

First list the tenant’s environments:

GET https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments?api-version=2020-10-01&$expand=properties.capacity,properties.addons
Authorization: Bearer <token>
Accept: application/json

The environment-list API is preview. It returns tenant environments when correctly authenticated.^1^

For every returned environment ID, call:

GET https://api.powerplatform.com/connectivity/environments/{environmentId}/connections?api-version=2024-10-01
Authorization: Bearer <token>
Accept: application/json

This is the supported List connections in environment endpoint.^2^

A minimal enumeration loop is:

$headers = @{ Authorization = "Bearer $token" }

foreach ($environmentId in $environmentIds) {
    $uri = "https://api.powerplatform.com/connectivity/environments/" +
           "$environmentId/connections?api-version=2024-10-01"

    $response = Invoke-RestMethod -Uri $uri -Headers $headers
    foreach ($connection in $response.value) {
        [pscustomobject]@{
            EnvironmentId = $environmentId
            ConnectionId  = $connection.id
            Name          = $connection.name
            DisplayName   = $connection.properties.displayName
        }
    }
}

Implement continuation handling if the actual response supplies a continuation link or token; the returned connection reference does not document a pagination contract.

The documented response includes connection id, name, display name, connector metadata, creation/change times, capabilities, publisher, tier, and runtime metadata. It does not document:

• Connection owner
• Connected/disconnected/error/expired status
• Authentication or token state
• Last successful usage
• Authentication expiration
• Reauthentication requirement
• Failure history
• Referencing flows or agents

Therefore, fields such as changedTime must not be interpreted as last successful use or last authentication.

As a PowerShell alternative, Get-AdminPowerAppConnection returns connection information. Global administrators can search all environments; otherwise, results are limited to environments where the caller is an environment administrator.^3^

2. Map connectors to flows and agents

Use the Power Platform inventory API to query cloud flows, agent flows, workflow agent flows, and Copilot Studio agents. Inventory exposes each resource’s properties.powerPlatformConnectors array, including connector IDs and operations.^4^

POST {PowerPlatformAPI url}/resourcequery/resources/query?api-version=2024-10-01
Authorization: Bearer <delegated-user-token>
Content-Type: application/json

{
  "TableName": "PowerPlatformResources",
  "Clauses": [{
    "$type": "where",
    "FieldName": "type",
    "Operator": "in~",
    "Values": [
      "'microsoft.powerautomate/cloudflows'",
      "'microsoft.powerautomate/agentflows'",
      "'microsoft.powerautomate/m365agentflows'",
      "'microsoft.copilotstudio/agents'"
    ]
  }],
  "Options": { "Top": 1000, "Skip": 0, "SkipToken": "" }
}

Continue querying with the returned skip token until exhausted. Inventory normally reflects created, updated, or deleted resources within 15 minutes.^5^

This produces a resource-to-connector map, not necessarily a resource-to-specific-connection-instance map. The documented inventory schema exposes connector IDs and operations, but not connection IDs. Consequently, joining inventory to the connection list by connector can be ambiguous when an environment has multiple connections for the same connector.

Additional limitations include:

• Built-in HTTP, Control, and Data Operations actions are not connector inventory entries.
• Tabular connectors can have an empty operations array.
• Copilot Studio agent inventory returns at most 200 resources of each capability type per agent.^6^
• The flow inventory owner field currently represents the creator and does not update after ownership changes.

3. Permissions and unattended monitoring

For the Connections API, request the Power Platform API delegated permission:

• Connectivity.Connections.Read
• EnvironmentManagement.Environments.Read when using the corresponding Power Platform environment API

These permissions are defined in the Power Platform permission reference.^7^

For a service principal, Power Platform API access is granted through Power Platform RBAC rather than application permissions; the built-in Power Platform reader role includes permissions ending in .Read.^8^

However, Power Platform inventory cannot currently be queried app-only. It supports delegated user authentication only; service principals and managed identities receive HTTP 403.^9^ This prevents a fully app-only scheduled monitor from including inventory associations. Such monitoring must maintain a supported delegated-user sign-in/session, or omit inventory correlation.

4. Failure and usage telemetry

For cloud flows, the Dataverse FlowRun table contains run start/end times, status, error code, error message, owner, workflow name, and workflow ID. It can be queried through standard Dataverse APIs.^10^

This requires appropriate Dataverse table privileges in every applicable environment, separately from Power Platform API permissions. FlowEvent should also be checked because FlowRun records can be incomplete.

Important interpretation limits:

• A successful run proves that the flow execution succeeded, not that every referenced connection was used successfully.
• A failed action can suggest a connector problem, but run-level telemetry generally cannot identify the exact connection instance when several connections use the same connector.
• A 401 can be classified as a likely authentication failure.
• A DLP block is a policy-related runtime failure, not an authentication failure.
• Other 4xx/5xx failures can represent permissions, throttling, unavailable resources, gateways, networks, or target-service errors.

The available documentation does not provide the environment-specific Dataverse URL, exact FlowRun Web API entity-set name, or required table privilege names, so those should be obtained from each environment’s Dataverse service metadata rather than guessed.

A practical monitoring model can report derived, not platform-authoritative, states:

• Healthy: recent relevant runs succeeded and no recent connection-related failure was detected.
• Authentication suspected: repeated relevant 401 or expired-grant errors.
• Runtime error: repeated non-authentication failures.
• Unknown: connection exists but there is insufficient or ambiguous run telemetry.

Reauthentication remains an owner-driven remediation: expired tokens, password changes, Conditional Access changes, disabled accounts, and inactivity can break connections, but no listed API exposes a universal expiration timestamp.^11^

References

1. List environments (preview)
2. Connections - List Connections
3. Get-AdminPowerAppConnection-Syntax
4. Power Platform inventory schema reference
5. Power Platform inventory
6. Microsoft Copilot Studio Agent inventory
7. Permission reference
8. Role-based access control for Power Platform admin center (preview)
9. Power Platform inventory API
10. Manage cloud flow run history in Dataverse
11. Troubleshoot broken connections in Microsoft Power Platform