Power Pages- Information regarding the end of support for Wildcard (*) in the Web API field configuration

Starting on September 14, 2026, Wildcard (*) in the Web API field configuration will have reached end of support.

How does this affect me?
After September 14, 2026, support for the Wildcard value (*) in the Web API field configuration will be removed in phases over the following weeks.

The Wildcard (*) configuration exposes all columns in a Dataverse table through the Power Pages Web API. To improve security and align with least-privilege access principles, Power Pages now requires an explicit list of columns to be specified in the Webapi//fields site setting. This change helps prevent unintended exposure of additional columns and provides greater control over data accessible through the Web API. For more details, please refer to Power Pages portals Web API overview.

What action do I need to take?
If your websites currently use the wildcard value (*) in any Webapi//fields site setting, please perform the below steps:

• Review the tables exposed through the Power Pages Web API.
• Replace the Wildcard value (*) with an explicit comma-separated list of columns that should be accessible.
• Validate your website's functionality after updating the configuration.

If action is not taken before phased enforcement reaches your site after September 14, 2026, Web API requests against any table that use the Wildcard value (*) may return an HTTP 403 error, which could affect functionality based on those Web API calls until the configuration is updated.

Please contact Microsoft support if you need further assistance.