APIs & Cloud Identity Automation

1🌐 Calling APIs with Invoke-RestMethod

The primary command for this is Invoke-RestMethod — it sends HTTP/HTTPS requests to REST services and automatically deserialises many JSON responses straight into PowerShell objects.

$response = Invoke-RestMethod `
    -Uri "https://api.example.com/users" `
    -Method GET

$response

HTTP methods behave exactly as Module 13 described: GET retrieves, POST creates, PUT replaces, PATCH modifies, DELETE removes. Headers get passed as a hash table:

$Headers = @{
    Authorization = "Bearer TOKEN"
    Accept        = "application/json"
}

Invoke-RestMethod `
    -Uri "https://api.example.com/users" `
    -Method GET `
    -Headers $Headers

A POST request needs a JSON body, built from a hash table and converted with ConvertTo-Json (Lesson 2):

$Body = @{
    username   = "asmith"
    department = "Finance"
}
$JsonBody = $Body | ConvertTo-Json

$response = Invoke-RestMethod `
    -Uri "https://api.example.com/users" `
    -Method POST `
    -ContentType "application/json" `
    -Body $JsonBody

2🔑 API Authentication & Secrets

PowerShell scripts may authenticate to APIs with API keys, bearer tokens, OAuth 2.0, client credentials, certificates, managed identities, Windows authentication, or (in some legacy environments) Basic authentication (Module 13, Lesson 3 covers each mechanism in full).

$Token = "eyJ..."

$Headers = @{
    Authorization = "Bearer $Token"
}

$response = Invoke-RestMethod `
    -Uri "https://api.example.com/users" `
    -Headers $Headers `
    -Method GET

This is exactly where Module 9's OAuth/OIDC/JWT content, Module 13's API authentication content, and this module's own automation techniques all converge into one working script.

3🏢 Microsoft Graph & Legacy Cloud Modules

Microsoft Graph is the API ecosystem behind most Microsoft cloud administration — Entra ID, Microsoft 365, users, groups, devices, applications, authentication methods, Conditional Access, Teams, SharePoint, Intune. The Microsoft Graph PowerShell SDK exposes these APIs as PowerShell cmdlets, and Microsoft describes it as the replacement path for the legacy Azure AD PowerShell and MSOnline modules. You'll typically start a session with Connect-MgGraph, then use Graph cmdlets from there.

Older environments may still contain scripts built on MSOnline or AzureAD/AzureADPreview — Connect-MsolService or Connect-AzureAD. Recognise these as legacy: Microsoft recommends migrating this automation to Microsoft Graph PowerShell or Microsoft Entra PowerShell, and current Entra PowerShell documentation describes the older modules as deprecated legacy modules.

Legacy:  MSOnline, AzureAD
Modern:  Microsoft Graph PowerShell, Microsoft Entra PowerShell

This is exactly the kind of knowledge you need when inheriting scripts from an older corporate environment — recognising which generation a script belongs to before you try to modify or trust it.

4🔍 API Investigation Example

Suppose a service is returning 401 Unauthorized. PowerShell can test the API directly, wrapped in error handling (Lesson 5 covers try/catch in full):

$Headers = @{
    Authorization = "Bearer $Token"
}

try {
    $Response = Invoke-RestMethod `
        -Uri "https://api.example.com/profile" `
        -Headers $Headers `
        -Method GET `
        -ErrorAction Stop
}
catch {
    Write-Host "API request failed"
    Write-Host $_
}

From here, investigate exactly the checklist Module 13's Lesson 2 taught: is the token valid? Has it expired? Is the audience correct? Does it carry the required scopes? Is the endpoint correct? Is the authentication scheme correct? Is the API even reachable? PowerShell turns that checklist from something you reason about abstractly into something you can actually test, one line at a time, interactively.

Lesson Outcome

You should now be able to call a REST API with Invoke-RestMethod using GET and POST, pass headers and a JSON body, authenticate with a bearer token and explain why hardcoded secrets are dangerous, distinguish Microsoft Graph PowerShell from legacy AzureAD/MSOnline modules, and use PowerShell to interactively troubleshoot an API authentication failure. Lesson 4 moves from calling APIs to administering the systems most enterprise PowerShell work actually touches day to day: Active Directory, services, and remote servers.