This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Integrate SQL solutions with Azure services
      --> Configure REST or GraphQL endpoints

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern applications rarely connect directly to a database. Instead, they communicate with APIs that provide a secure, scalable, and well-defined interface for accessing and modifying data. Microsoft Data API Builder (DAB) simplifies this process by automatically exposing SQL Server and Azure SQL Database objects through REST and GraphQL endpoints with minimal custom code.

For the DP-800: Developing AI-Enabled Database Solutions certification exam, candidates should understand how to configure and secure REST and GraphQL endpoints, determine when each API style is appropriate, configure authentication and authorization, expose database objects as entities, and optimize endpoint performance.

This topic builds on previous areas such as configuring entities and Data API Builder configuration files. While entities define what database objects are exposed, endpoints determine how applications interact with those objects.

Learning Objectives

After completing this topic, you should be able to:

• Explain the purpose of REST and GraphQL endpoints.
• Understand how Data API Builder exposes SQL data.
• Configure REST endpoints.
• Configure GraphQL endpoints.
• Understand endpoint routing.
• Configure CRUD operations.
• Secure API endpoints.
• Implement authentication and authorization.
• Optimize endpoint performance.
• Choose between REST and GraphQL for various scenarios.
• Troubleshoot common endpoint issues.

Why APIs Are Important

Without APIs:

Application
↓
Direct Database Connection
↓
SQL Database

Applications require:

• Database credentials
• Knowledge of table structures
• SQL query logic
• Network connectivity to the database

This approach introduces security and maintenance challenges.

With Data API Builder:

Application
↓
REST / GraphQL API
↓
Data API Builder
↓
Azure SQL Database

Benefits include:

• Simplified development
• Better security
• Centralized authentication
• Controlled data exposure
• Consistent API design
• Easier scalability

Understanding REST

REST (Representational State Transfer) is an architectural style that exposes resources through HTTP methods.

Common HTTP verbs include:

Example:

GET /api/products

returns:

[
  {
    "ProductID":1,
    "Name":"Laptop"
  }
]

REST Endpoint Structure

Typical endpoint format:

https://server/api/entity

Examples:

GET /api/customers
GET /api/orders
POST /api/products
PATCH /api/orders/25
DELETE /api/customers/10

REST uses URLs to identify resources.

Understanding GraphQL

GraphQL is a query language developed to allow clients to request exactly the data they require.

Unlike REST, GraphQL typically uses a single endpoint.

Example:

/graphql

The client submits queries.

Example:

query {
  products {
    Name
    Price
  }
}

Only the requested fields are returned.

REST vs. GraphQL

Neither approach is universally better.

Microsoft expects developers to choose the appropriate API based on application requirements.

Data API Builder Architecture

Data API Builder sits between applications and the database.

Application
↓
REST / GraphQL
↓
Data API Builder
↓
Azure SQL Database

Responsibilities include:

• Endpoint generation
• Authentication
• Authorization
• SQL execution
• CRUD operations
• Entity mapping
• Relationship handling

Configuring REST Endpoints

REST endpoints are enabled within the Data API Builder configuration.

Developers specify:

• Entity
• Source table
• Permissions
• Allowed operations

Example concept:

Entity
↓
Customers
↓
REST Enabled

Automatically creates endpoints similar to:

GET /api/customers
POST /api/customers
PATCH /api/customers/15
DELETE /api/customers/15

Configuring GraphQL Endpoints

When GraphQL is enabled, Data API Builder generates a GraphQL schema automatically.

Example query:

query {
  customers {
      CustomerName
      City
  }
}

Mutation example:

mutation {
  createCustomer(...)
}

Developers do not manually write the GraphQL schema.

Endpoint Routing

Routing determines how incoming requests reach the appropriate entity.

REST example:

/api/products

Routes to:

Products Entity

GraphQL example:

/GraphQL

Routes all requests through:

GraphQL Engine

The GraphQL engine determines which entities participate in the query.

CRUD Operations

Data API Builder supports CRUD operations.

Organizations often disable unnecessary operations.

Example:

Internal reporting API:

Allowed:

• GET

Disabled:

• POST
• PATCH
• DELETE

This reduces security risks.

Endpoint Configuration Best Practices

Microsoft recommends exposing only the endpoints required by the application.

Good practices include:

• Enable only necessary entities.
• Disable unnecessary CRUD operations.
• Hide internal tables.
• Use descriptive endpoint names.
• Keep URL structures consistent.
• Avoid exposing sensitive objects.

Authentication

Authentication answers:

Who is making the request?

Common authentication methods include:

• Microsoft Entra ID
• Managed Identity
• JWT Bearer Tokens
• OAuth 2.0
• API keys (where appropriate)

Microsoft strongly recommends Microsoft Entra ID for Azure-hosted solutions.

Microsoft Entra ID Integration

Data API Builder integrates with Microsoft Entra ID.

Authentication flow:

User
↓
Microsoft Entra ID
↓
Access Token
↓
REST / GraphQL
↓
Data API Builder
↓
Azure SQL Database

Benefits include:

• Single sign-on
• Central identity management
• Multi-factor authentication
• Conditional Access
• Token-based authentication

Authorization

Authentication determines identity.

Authorization determines permissions.

Example:

Developer:

Can:

• Read
• Update

Auditor:

Can:

• Read only

Guest:

Can:

• View public data only

Authorization should follow the principle of least privilege.

Endpoint Security

APIs should never expose more information than necessary.

Security recommendations include:

• Use HTTPS exclusively.
• Require authentication.
• Use Microsoft Entra ID where possible.
• Implement role-based authorization.
• Validate client input.
• Disable unused operations.
• Avoid exposing sensitive columns.
• Log API access.
• Monitor suspicious activity.

Protecting Sensitive Data

Poor API:

Employee
Name
Salary
SSN
PasswordHash

Better API:

Employee
Name
Department
Title

Sensitive fields should remain inaccessible.

Often this is accomplished through:

• Database views
• Entity configuration
• Role-based permissions

Error Handling

REST commonly returns HTTP status codes.

Examples:

Applications should use these responses to handle failures appropriately.

GraphQL Error Responses

GraphQL responses may contain both successful data and error information.

Example concept:

{
  "data": {
      "products": null
  },
  "errors": [
      {
          "message":"Unauthorized"
      }
  ]
}

Unlike REST, GraphQL often returns HTTP 200 while including error details in the response body.

Developers should inspect both the HTTP status code and the GraphQL response payload.

Performance Considerations

Well-designed endpoints improve application performance.

Recommendations include:

• Return only required data.
• Filter data at the database.
• Use pagination.
• Cache relatively static responses.
• Index frequently searched columns.
• Avoid returning excessively large result sets.
• Reduce unnecessary joins.

GraphQL helps minimize over-fetching because clients specify the required fields.

REST Performance

REST benefits from mature HTTP infrastructure.

Advantages include:

• Browser caching
• Proxy caching
• Azure Front Door
• Azure API Management caching
• CDN support

REST is often preferred for:

• Public APIs
• High-volume read workloads
• Static content
• Mobile applications

GraphQL Performance

GraphQL reduces unnecessary network traffic.

Instead of:

GET Customer
GET Orders
GET Products

A single GraphQL query can retrieve all related information.

Example:

{
  customer(id:1){
      Name
      Orders{
          OrderDate
          Total
      }
  }
}

This minimizes the number of client-server round trips.

Monitoring Endpoints

Production APIs should be monitored continuously.

Useful Azure services include:

• Azure Monitor
• Application Insights
• Log Analytics
• Azure API Management analytics

Monitor:

• Request counts
• Response times
• Error rates
• Authentication failures
• Throughput
• Latency

These metrics help identify bottlenecks and security issues.

Common DP-800 Exam Scenarios

You should be comfortable answering questions such as:

• When should REST be preferred over GraphQL?
• When is GraphQL more efficient than REST?
• How are CRUD operations exposed through each API style?
• Why should unnecessary CRUD operations be disabled?
• Which authentication mechanism is recommended for Azure-hosted APIs?
• How should endpoint authorization be implemented?
• How can API performance be improved?
• Why is HTTPS required?
• How does GraphQL reduce over-fetching?
• What monitoring information should be collected for production APIs?

DP-800 Exam Tips

• Know the differences between REST and GraphQL.
• Understand how Data API Builder automatically generates endpoints.
• Remember that REST typically uses multiple endpoints, while GraphQL commonly uses a single endpoint.
• Understand the mapping between CRUD operations and HTTP verbs.
• Recognize the importance of Microsoft Entra ID authentication.
• Apply least-privilege authorization principles.
• Use HTTPS for all endpoint communication.
• Know when GraphQL reduces over-fetching and when REST benefits from HTTP caching.
• Understand how endpoint configuration affects security, scalability, and performance.

Summary

Configuring REST and GraphQL endpoints is a core competency for developers building modern SQL-backed applications with Microsoft Data API Builder. REST provides resource-oriented endpoints that align naturally with HTTP methods and benefit from widespread tooling and caching support. GraphQL offers a flexible query model that enables clients to retrieve exactly the data they need, reducing over-fetching and minimizing network traffic.

For the DP-800 exam, candidates should understand how Data API Builder automatically generates these endpoints from configured entities, how CRUD operations map to each API style, how to secure endpoints using Microsoft Entra ID and role-based authorization, and how to optimize performance through pagination, filtering, caching, and efficient query design. Mastering these concepts enables developers to build secure, scalable, and maintainable APIs that integrate SQL databases with modern cloud-native applications.

Practice Exam Questions

Question 1

You are deploying Microsoft Data API builder in front of an Azure SQL Database. The security team requires that users authenticate with Microsoft Entra ID before accessing either the REST or GraphQL endpoints.

Which authentication provider should you configure?

A. Anonymous authentication

B. Microsoft Entra ID authentication

C. Basic Authentication

D. SQL Authentication

Correct Answer:

B. Microsoft Entra ID authentication

Explanation

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s recommended authentication mechanism for cloud services. Data API builder supports Microsoft Entra ID authentication, enabling secure token-based authentication for both REST and GraphQL endpoints.

Why the other answers are incorrect:

• A: Anonymous authentication provides no identity validation.
• C: Basic authentication transmits usernames and passwords and is generally discouraged.
• D: SQL Authentication secures the database connection but is not intended for authenticating API consumers.

Question 2

A development team wants consumers of a REST endpoint to retrieve data using standard HTTP semantics.

Which HTTP method should clients use when reading data?

A. POST

B. PUT

C. GET

D. DELETE

Correct Answer:

C. GET

Explanation

REST follows standard HTTP conventions.

• GET retrieves data.
• POST creates resources.
• PUT replaces existing resources.
• DELETE removes resources.

Using the appropriate HTTP method improves interoperability and aligns with REST best practices.

Question 3

A GraphQL endpoint exposes Customer information.

A client application only requires the customer’s first name and email address.

What is the primary advantage of GraphQL in this scenario?

A. GraphQL automatically encrypts returned data.

B. GraphQL always executes faster than REST.

C. GraphQL allows clients to request only the required fields.

D. GraphQL eliminates authentication requirements.

Correct Answer:

C. GraphQL allows clients to request only the required fields.

Explanation

GraphQL enables clients to specify exactly which fields should be returned, reducing unnecessary data transfer and improving application efficiency.

The other options are incorrect because:

• GraphQL does not provide encryption.
• Performance depends on workload.
• Authentication remains necessary.

Question 4

An organization wants to expose only the Products table through Data API builder.

The Orders and Customers tables must never be accessible.

What is the best configuration?

A. Configure only the Products entity in the DAB configuration.

B. Create views for all tables.

C. Grant db_owner permissions.

D. Disable GraphQL.

Correct Answer:

A. Configure only the Products entity in the DAB configuration.

Explanation

Only configured entities become accessible through DAB endpoints. Tables not defined in the configuration cannot be queried through the generated APIs.

Granting broad database permissions or disabling GraphQL does not prevent REST access.

Question 5

A developer receives HTTP 401 Unauthorized when calling a secured REST endpoint.

Which issue is the most likely cause?

A. The endpoint uses HTTPS.

B. The client failed to provide a valid authentication token.

C. The SQL query contains joins.

D. Pagination is enabled.

Correct Answer:

B. The client failed to provide a valid authentication token.

Explanation

HTTP 401 indicates that authentication failed or credentials were not supplied.

Typical causes include:

• Missing bearer token
• Expired token
• Invalid token
• Incorrect authentication configuration

The remaining options are unrelated to authentication failures.

Question 6

Your organization wants GraphQL clients to create new database records.

Which GraphQL operation should the clients perform?

A. Query

B. Subscription

C. Mutation

D. Schema

Correct Answer:

C. Mutation

Explanation

GraphQL defines three primary operation types:

• Query → Read data
• Mutation → Insert, update, or delete data
• Subscription → Receive real-time updates (where supported)

Creating records is accomplished using mutations.

Question 7

An application experiences slower response times because every request repeatedly retrieves identical reference data.

Which feature would most likely improve endpoint performance?

A. Increase SQL authentication timeout.

B. Enable response caching where appropriate.

C. Replace GraphQL with SOAP.

D. Disable indexes.

Correct Answer:

B. Enable response caching where appropriate.

Explanation

Caching reduces repeated database reads for frequently requested data.

Benefits include:

• Lower latency
• Reduced database workload
• Improved scalability

Disabling indexes would significantly reduce performance.

Question 8

Which statement best describes GraphQL schemas?

A. They define the structure of available queries, mutations, and data types.

B. They replace SQL indexes.

C. They encrypt REST endpoints.

D. They create database backups.

Correct Answer:

A. They define the structure of available queries, mutations, and data types.

Explanation

The GraphQL schema acts as the contract between clients and the API.

It specifies:

• Available object types
• Fields
• Queries
• Mutations
• Relationships

It does not manage indexing, encryption, or backups.

Question 9

Your organization deploys Data API builder to production.

Which practice best protects REST and GraphQL endpoints?

A. Enable anonymous access for easier testing.

B. Store secrets directly in configuration files.

C. Require HTTPS and strong authentication.

D. Disable authorization checks.

Correct Answer:

C. Require HTTPS and strong authentication.

Explanation

Production APIs should always:

• Use HTTPS
• Authenticate users
• Authorize requests
• Protect credentials
• Follow least-privilege principles

Anonymous access and embedded secrets introduce significant security risks.

Question 10

A developer modifies a Data API builder configuration file by adding a new entity.

What must occur before clients can use the new endpoint?

A. Restart or redeploy the Data API builder service so the updated configuration is loaded.

B. Rebuild the Azure SQL Database.

C. Delete the GraphQL schema.

D. Recreate the database indexes.

Correct Answer:

A. Restart or redeploy the Data API builder service so the updated configuration is loaded.

Explanation

After modifying the DAB configuration, the running service must reload the updated configuration. Depending on the hosting environment, this typically involves restarting the application or redeploying the container or service.

Database rebuilding, deleting the GraphQL schema, and recreating indexes are unrelated to exposing newly configured endpoints.

Exam Tips for DP-800

For the exam, you should be comfortable with:

• Configuring REST and GraphQL endpoints using Microsoft Data API builder.
• Understanding REST HTTP methods (GET, POST, PUT/PATCH, DELETE).
• Understanding GraphQL queries, mutations, and schemas.
• Configuring Microsoft Entra ID authentication.
• Applying authorization using database permissions and DAB configuration.
• Exposing only intended database objects.
• Using HTTPS to secure endpoint communications.
• Improving performance through caching and efficient endpoint design.
• Deploying configuration changes safely.
• Understanding the differences and appropriate use cases for REST versus GraphQL.

Go to the DP-800 Exam Prep Hub main page