Authorized resources REST API reference

The Microsoft Web IQ Customer Management API returns the existing customers, Web IQ billing accounts, and Web IQ AppIDs available to the authenticated caller. Discovery does not create an account or grant access.

Endpoint: GET https://api.microsoft.ai/v1/customer/authorized-resources

For the administrator's access-grant steps and an end-to-end walkthrough, see Filter results with Scopes.

Authentication and request

Workloads use an app-only Microsoft Entra bearer token requested with https://api.microsoft.ai/.default. The workload identity must be active and have CustomerApiAccess on each intended billing account. A runtime search API key or search AppID binding does not grant management access.

GET /v1/customer/authorized-resources HTTP/1.1
Host: api.microsoft.ai
Authorization: Bearer <access-token>
Accept: application/json

No customer ID, billing account ID, or Web IQ AppID is needed to call discovery.

Response

HTTP 200 OK returns an array of customer objects. Each customer contains a billingAccounts array:

[
  {
    "customerId": "11111111-1111-4111-8111-111111111111",
    "displayName": "Example customer",
    "permissions": { "canWrite": false },
    "billingAccounts": [
      {
        "billingAccountId": "22222222-2222-4222-8222-222222222222",
        "displayName": "Example billing account",
        "isTrial": false,
        "permissions": { "canWrite": false },
        "appProfiles": []
      }
    ]
  }
]

Field	Type	Description
customerId	string (UUID)	Identifies the customer containing the billing accounts. Not the ID used in scope routes.
displayName	string	Display name of the customer or billing account.
billingAccounts	array	Billing accounts available to the caller within this customer.
billingAccounts[].billingAccountId	string (UUID)	Use this ID in scope management routes. Select the intended account explicitly rather than automatically taking the first result.
billingAccounts[].isTrial	boolean	Whether the billing account is a trial. Customers and accounts must be active; expired trials are excluded.
billingAccounts[].appProfiles	array	Web IQ AppIDs and their configuration metadata. An account can appear with an empty array.
billingAccounts[].appProfiles[].appId	string	Web IQ AppID belonging to the billing account. Not an Entra application (client) ID.
permissions.canWrite	boolean	Legacy billing-configuration write access, on either the customer or billing account. Not a scope-write capability flag: CustomerApiAccess can allow scope writes when this is false.

A valid but unknown or unassigned workload can receive 200 OK with []. This is not a service error and can occur even if the same identity can call search. Check its management grant and account eligibility rather than repeatedly calling discovery to provision access.

Status codes

Status	Meaning	Action
200	Existing authorized hierarchy, possibly empty.	Choose billingAccounts[].billingAccountId. If the intended account is absent, have the administrator check the tenant/client pair, active identity, account grant, and account eligibility.
400	Invalid request.	Correct the input. Discovery is read-only and does not accept provisioning requests.
401	Missing, expired, or invalid authentication.	Acquire a valid app-only token with https://api.microsoft.ai/.default.
403	The resolved principal is inactive or inconsistent.	Have the administrator verify the workload identity and account access.
500 or 503	Service or dependency failure.	Retry reads with bounded backoff. Do not treat this as an empty successful result.

For help with persistent failures, contact Web IQ Support with sanitized request details, never tokens or application credentials.