Most Pax8 Partners Never Touch the API They Already Pay Nothing For. Here Is the Power Automate Setup

If you work with Pax8 today, the API is one of the better unadvertised parts of the relationship. Many Pax8 partners do not know it exists, it costs nothing extra to use, and it exposes the following endpoints:

• Customers
• Orders (purchase net new)
• Subscriptions (increment and decrement seats)
• Products (catalog info and rate plans)
• Contacts
• Invoices
• Usage Summaries (think Azure billing)

There is a lot you can build on that surface. The common starting point is user onboarding and offboarding, where the flow modifies seat counts. A step further is billing: integrate directly into QuickBooks Online or whatever ERP you invoice from, instead of relying on Pax8's fixed set of native integrations. An open vendor makes that choice yours.

A working example: we run a Power Automate flow against the Pax8 API that automatically creates a PSA ticket when an NCE subscription is coming up for renewal, so the team evaluates license counts before the strict contract terms lock in again. With renewal dates scattered across customers, that one flow removes a real liability. The full build is documented in the NCE renewal notices walkthrough.

Prefer PowerShell over flows? Luke Whitelock has published a PowerShell module for the Pax8 API on GitHub: lwhitelock/Pax8API (opens in new tab).

What you need on the Pax8 side#

Get a client ID and client secret:

1. As a Primary Partner Admin or Partner Admin, go to Tools > Partner Shells and find the Pax8 Partner API Partner Shell:

1. Fill out the fields and submit. Once you do, you will get information about the API docs. You can always find the API documentation later under the ? icon in the top right corner:

1. Click your name in the right-hand corner > User Settings > Developer Apps > Create:

1. Give it a name of your choosing and click Create.
2. You will be given a client ID and secret. Store these somewhere secure like Azure Key Vault or IT Glue.

What you need on the Microsoft side#

A premium Power Platform license. The flow uses premium actions (HTTP requests) to get access tokens and call the Pax8 API. Power Platform licensing is confusing, but any one of the plans below covers it, and you only need one:

If you hold a Silver or Gold membership in Microsoft's partner program, you may already be receiving these licenses through your internal-use rights.

Azure Key Vault (optional, recommended). Storing the client ID and secret in Key Vault lets the flow populate them dynamically instead of carrying them in plain text. There are other ways to handle this, but Key Vault is what this walkthrough uses.

Why this is not a custom connector tutorial#

Normally we would recommend setting Pax8 up as a custom connector in Power Automate, the same pattern shown in Creating Syncro as a Custom Connector in Power Automate. Pax8's API, however, uses client credentials as the grant type for issuing access tokens, and custom connectors do not support that grant type as of August 2022. That blocks authentication at the connector level, so the token request has to live inside the flow itself. Here is that build.

Build the flow: credentials first#

1. Navigate to https://make.powerautomate.com/ (opens in new tab).
2. Click Create > Instant Cloud Flow.
3. Give it a name and choose Manually trigger a flow. The manual trigger is just for testing this example; in production you would give it whatever trigger fits.

1. The flow will use your client ID and secret to request an access token, and exposing those in plain text is best avoided. Pull them from Azure Key Vault instead: click New Step > search Azure Key Vault > click Get Secret under Actions:

1. Populate your client ID:

One gotcha worth knowing: if you get an error about not being able to connect to a vault, click Connectors in the left navigation and edit your Key Vault connection from there. In our experience the vault could not be selected from the flow screen after signing in, and the Connectors page was the fix.

1. Repeat the Get Secret step for the client secret:

Request the access token#

1. Click New Step > search HTTP > choose the HTTP action:

1. Make the POST call to get the access token per the Pax8 API documentation (viewable from the Pax8 portal). Add the URL and the body by copying them straight from the docs:

1. Adjust the body so client_id and client_secret are populated with the dynamic values coming from Azure Key Vault, and add a Content-Type header:

1. Parse the JSON response to extract the access token for later calls. Search for Parse JSON as the next step:

1. For the Content field, dynamically populate the Body value from the previous step. Then copy the access token response example from the Pax8 API documentation, click Generate from Sample in Power Automate, and paste it in. The schema generates itself from the sample:

Make your first authenticated call#

1. With an access token in hand, every other endpoint is open. To test, call the companies endpoint with another HTTP action, using the Fetch a paginated list of your companies GET request from the docs. One of the headers is Authorization, populated dynamically in the format Bearer, then a space, then the access token:

1. Save the flow and run a test. The flow runs and the output shows your company records:

What to build next#

That is the whole connection. From here, Parse JSON actions pull values out of any call so you can feed them into other steps: PSA tickets, Teams messages, billing systems. The renewal-notice flow mentioned above is the natural next build. The full video version of this setup is on YouTube; post any questions there: watch the tutorial (opens in new tab).