This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Integrate SQL solutions with Azure services
      --> Configure entities for REST and GraphQL, including data caching, pagination, searching, and filtering

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern applications increasingly expose data through APIs rather than allowing applications to connect directly to databases. APIs provide a secure abstraction layer that simplifies application development while protecting the underlying database.

For the DP-800 certification, Microsoft expects candidates to understand how Data API Builder (DAB) exposes SQL Server and Azure SQL Database objects through automatically generated REST and GraphQL endpoints. Candidates should know how to configure entities, control which operations are available, implement pagination, filtering, searching, caching, relationships, and understand the security implications of exposing database objects through APIs.

Unlike traditional custom-built APIs that require significant development effort, Data API Builder allows developers to expose database objects by using a configuration file. Developers describe database objects as entities, define the allowed operations, and configure API behavior.

Understanding entity configuration is an important skill because it enables organizations to rapidly build secure, scalable APIs without writing extensive backend code.

Learning Objectives

After completing this topic, you should be able to:

• Explain how Data API Builder exposes SQL data.
• Configure entities in a DAB configuration file.
• Expose entities through REST and GraphQL.
• Configure CRUD operations.
• Configure relationships between entities.
• Implement pagination.
• Configure filtering and searching.
• Configure sorting.
• Understand caching behavior.
• Apply security best practices.

What is Data API Builder (DAB)?

Data API Builder is an open-source Microsoft service that automatically creates REST and GraphQL APIs for relational databases.

Supported databases include:

• Azure SQL Database
• SQL Server
• Azure SQL Managed Instance
• Azure Database for PostgreSQL
• Azure Cosmos DB (NoSQL support in certain scenarios)

Rather than developing controllers and endpoints manually, developers define a configuration file that describes:

• Database connection
• Authentication
• Authorization
• Entities
• API settings
• Runtime behavior

DAB automatically generates the endpoints.

Example architecture:

Application
        │
REST / GraphQL
        │
Data API Builder
        │
Azure SQL Database

Why Use Data API Builder?

Benefits include:

• Rapid API development
• Less custom code
• Built-in GraphQL
• Automatic REST endpoints
• Security integration
• Microsoft Entra authentication
• Managed Identity support
• Authorization rules
• Entity relationships
• Simplified deployment

For many internal business applications, DAB eliminates the need to build an entire ASP.NET Web API project.

Understanding Entities

An entity represents a database object that Data API Builder exposes through an API.

Typically an entity maps to:

• Table
• View
• Stored procedure (REST only in specific scenarios)

Example database:

Customers
CustomerID
FirstName
LastName
Email

Entity configuration:

Customers

Automatically becomes

REST

GET /api/Customers
POST /api/Customers
GET /api/Customers/{id}

GraphQL

customers
customer_by_pk
createCustomer
updateCustomer
deleteCustomer

Entity Configuration Basics

Each entity is defined inside the configuration file.

Typical properties include:

• Source object
• Permissions
• REST settings
• GraphQL settings
• Relationships
• Fields
• Operations

Conceptually:

Entity
    Source Table
    REST enabled
    GraphQL enabled
    Permissions
    Relationships

Entity Source

The source identifies the database object.

Examples include:

• Table
• View

Example concept:

Entity
Product
Source
dbo.Products

The entity name does not have to match the table name.

Example:

Database table

SalesOrders

Exposed as

Orders

This abstraction creates cleaner APIs.

Exposing REST Endpoints

REST endpoints are enabled per entity.

Typical operations include:

• GET
• POST
• PUT
• PATCH
• DELETE

Example endpoints:

GET /api/products
GET /api/products/10
POST /api/products
PATCH /api/products/10
DELETE /api/products/10

Developers can disable operations they do not want clients to perform.

Example:

Allow:

• GET

Disable:

• DELETE

This creates read-only APIs.

Exposing GraphQL Endpoints

When GraphQL is enabled, DAB generates a GraphQL schema automatically.

Example query:

query
{
  books
  {
    BookID
    Title
    Price
  }
}

Mutation example:

mutation
{
  createBook(...)
}

GraphQL allows clients to request exactly the fields they need.

Example:

{
  products
  {
      Name
      Price
  }
}

instead of

SELECT *

This reduces network traffic.

Configuring CRUD Operations

Each entity can expose one or more CRUD operations.

Supported operations include:

Organizations frequently expose:

• Read
• Create

while disabling:

• Delete

to protect data.

Primary Keys

Entities require primary keys for many operations.

Example

CustomerID

REST endpoint

GET /api/customers/25

GraphQL

customer_by_pk

Without a primary key:

• Updates become difficult
• Deletes become difficult
• Relationships cannot always be generated

Composite Keys

Some tables use multiple columns as a primary key.

Example

OrderID
ProductID

REST requests must uniquely identify both values.

GraphQL also requires all key fields.

Candidates should understand that Data API Builder supports composite keys but requires complete key values for entity identification.

Entity Relationships

Relationships allow clients to retrieve related data.

Database:

Customers
Orders

Relationship

Customer
    │
Many Orders

GraphQL example:

{
    customers
    {
        CustomerName
        orders
        {
            OrderDate
            Total
        }
    }
}

REST clients can also retrieve related resources depending on configuration.

Relationships reduce the need for multiple API requests.

Data Caching

Caching improves API performance by reducing repeated database queries.

Although Data API Builder itself is intentionally lightweight, caching can be implemented through surrounding Azure services such as:

• Azure Front Door
• Azure API Management
• Azure CDN
• Reverse proxy caches
• Client-side caching
• HTTP caching headers

Benefits include:

• Lower latency
• Reduced database load
• Better scalability
• Faster responses

Example

Without cache:

1000 requests
↓
1000 SQL queries

With cache:

1000 requests
↓
50 SQL queries
↓
950 cached responses

Caching is especially useful for:

• Product catalogs
• Reference data
• Geographic lookup tables
• Public information
• Configuration data

It is generally less appropriate for frequently changing transactional data.

Pagination

Returning every row from a large table is inefficient.

Pagination divides results into smaller pages.

Example

Instead of:

100,000 rows

Return:

100 rows
Page 1

then

Page 2
Page 3
Page 4

Benefits include:

• Faster response time
• Lower memory usage
• Better user experience
• Reduced network traffic

Common pagination parameters include:

Page Size
Offset
Limit
Continuation Tokens

GraphQL implementations may also support cursor-based pagination depending on the configuration and client.

Best Practices for Pagination

Microsoft recommends:

Choose reasonable page sizes.

Avoid unlimited result sets.

Return metadata when appropriate, such as:

• Total records
• Current page
• Next page
• Previous page

Limit maximum page size to prevent excessive resource consumption.

Example:

Good

50 rows

Better

100 rows

Poor

500,000 rows

Filtering

Filtering reduces the number of returned records.

Example:

Products
Price > 100

Instead of every product:

5000 products

Return only

150 products

Examples include:

Category = 'Electronics'
Status = 'Active'
Price > 100
City = 'London'

Benefits:

• Reduced bandwidth
• Faster queries
• Better application performance
• Improved user experience

Filtering should be pushed to the database whenever possible rather than filtering results in application code after retrieval.

Searching

Searching differs from filtering.

Filtering matches specific conditions.

Searching finds records based on user-provided values.

Example

Search text:

Laptop

Possible matches:

Gaming Laptop
Business Laptop
Laptop Bag

Search operations commonly involve:

• LIKE
• Full-text search
• Prefix searches
• Keyword searches

Organizations should consider indexing frequently searched columns to improve performance.

Sorting

Sorting determines the order of results.

Examples:

Ascending:

Product Name
A → Z

Descending:

Price
High → Low

Sorting can be combined with:

• Filtering
• Pagination
• Searching

Example workflow:

Products
↓
Filter
↓
Search
↓
Sort
↓
Page Results

Combining these capabilities creates efficient, user-friendly APIs while minimizing unnecessary data transfer.

Performance Considerations

When configuring entities, developers should avoid exposing inefficient queries.

Recommendations include:

• Use indexed columns for filtering.
• Paginate large datasets.
• Avoid returning unnecessary columns.
• Limit expensive joins.
• Optimize frequently executed queries.
• Use appropriate database indexes.
• Cache relatively static data where appropriate.
• Monitor API and query performance using Azure monitoring tools and SQL performance features.

Proper entity design directly affects both API responsiveness and database workload.

Security Considerations

Exposing database objects through APIs introduces additional security considerations.

Best practices include:

• Expose only required tables and views.
• Disable unnecessary CRUD operations.
• Use Microsoft Entra ID authentication whenever possible.
• Implement role-based authorization.
• Avoid exposing sensitive columns such as passwords, secrets, or internal identifiers.
• Validate client input.
• Use HTTPS for all API traffic.
• Apply the principle of least privilege.
• Monitor API usage and audit access.

Remember that DAB simplifies API generation but does not replace the need for a comprehensive security strategy.

Common DP-800 Exam Scenarios

You should be comfortable answering questions such as:

• When should you expose a table as an entity versus creating a custom API?
• How do REST and GraphQL differ when exposing SQL data?
• When should pagination be implemented?
• Which workloads benefit most from API caching?
• How do filtering and searching differ?
• Why should delete operations be disabled for certain entities?
• Why are primary keys required for update and delete operations?
• How do entity relationships simplify GraphQL queries?
• Which API design practices improve performance for large datasets?
• How should security be enforced when exposing database objects through Data API Builder?

Scenario-based questions may ask you to identify the most appropriate configuration for performance, scalability, or security, requiring an understanding of how entity settings affect API behavior.

DP-800 Exam Tips

• Understand the differences between REST and GraphQL entity exposure.
• Know how entities map to database tables and views.
• Be familiar with CRUD operation configuration.
• Understand why primary keys and relationships are important.
• Know when to use pagination, filtering, sorting, and searching.
• Understand that caching is typically implemented by Azure services surrounding DAB rather than by DAB itself.
• Apply security best practices, including least privilege and selective exposure of database objects.
• Recognize performance optimization techniques such as indexing filtered columns, limiting result sets, and avoiding over-fetching.

Summary

Configuring entities in Data API Builder is a foundational skill for developing modern SQL-based APIs. By defining entities that map to database objects, developers can automatically expose secure REST and GraphQL endpoints with minimal code. Effective entity configuration includes selecting appropriate CRUD operations, defining relationships, implementing pagination, filtering, searching, and sorting, and designing for scalability and security. For the DP-800 exam, candidates should understand not only how these features work individually but also how they combine to create performant, maintainable, and secure API solutions that integrate SQL databases with modern cloud applications.

Practice Exam Questions

Question 1

A company uses Azure SQL Database to store product information. Developers want to expose product data through Data API Builder. Customers should be able to view products but must not be able to modify or delete product records.

Which configuration should you implement?

A. Enable only the POST operation for the product entity
B. Enable only read operations for the product entity
C. Disable REST and enable GraphQL mutations only
D. Create a stored procedure that handles all product requests

Correct Answer: B

Explanation

Data API Builder allows developers to control which operations are exposed for each entity. If customers should only view product information, the entity should expose read-only access.

A read-only entity configuration allows:

• GET operations through REST
• Query operations through GraphQL

but prevents:

• INSERT
• UPDATE
• DELETE

Why the other options are incorrect:

• A. POST allows creating new records, which violates the requirement.
• C. GraphQL mutations allow data modification and should not be enabled.
• D. A stored procedure is unnecessary for this requirement and does not directly address entity permissions.

Question 2

A developer exposes an Orders table as a Data API Builder entity. The table contains 5 million rows. Users need to browse orders through a web application.

What should the developer implement to improve API performance?

A. Return all rows and allow the browser to filter results
B. Disable indexing because APIs handle optimization automatically
C. Implement pagination with reasonable page sizes
D. Duplicate the table into multiple databases

Correct Answer: C

Explanation

Pagination is the appropriate solution when exposing large datasets through APIs.

Benefits include:

• Reduced response size
• Lower memory consumption
• Faster response times
• Improved user experience

Why the other options are incorrect:

• A. Returning millions of rows creates unnecessary network and database overhead.
• B. Indexing remains important for database performance.
• D. Database duplication does not solve the API result-size problem.

Question 3

A developer creates a GraphQL endpoint using Data API Builder. Users want to retrieve customers and their related orders in a single query.

What should the developer configure?

A. A relationship between the Customer and Order entities
B. A separate database for each entity
C. A REST-only endpoint for the Orders table
D. A SQL Agent job to combine the tables nightly

Correct Answer: A

Explanation

Entity relationships allow related data to be retrieved together, especially through GraphQL queries.

Example:

{
  customers {
    CustomerName
    orders {
      OrderDate
    }
  }
}

The relationship configuration enables Data API Builder to understand how entities are connected.

Why the other options are incorrect:

• B. Separate databases do not create entity relationships.
• C. REST-only endpoints do not enable GraphQL relationship queries.
• D. Scheduled jobs do not provide real-time relational querying.

Question 4

A company exposes a Product entity through Data API Builder. Users frequently search products by product name. Query performance has degraded as the product catalog grows.

What should you do first?

A. Remove filtering capabilities from the API
B. Store product names in an external file
C. Add appropriate database indexing for search columns
D. Increase the API response size limit

Correct Answer: C

Explanation

Search operations frequently depend on database performance. Adding appropriate indexes improves query execution speed for commonly searched columns.

For example:

CREATE INDEX IX_Product_Name
ON Products(ProductName);

Why the other options are incorrect:

• A. Removing functionality does not solve the performance problem.
• B. External files are not an appropriate database optimization strategy.
• D. Increasing response size can make performance worse.

Question 5

A developer wants users to retrieve only active products from a Data API Builder endpoint.

Which capability should be used?

A. Filtering
B. Pagination
C. Caching
D. Sorting

Correct Answer: A

Explanation

Filtering restricts returned records based on conditions.

Example:

Status = 'Active'

Only matching records are returned.

Why the other options are incorrect:

• B. Pagination controls the number of results returned, not which records qualify.
• C. Caching improves performance but does not limit returned data.
• D. Sorting changes order but does not restrict records.

Question 6

An application displays a product catalog. Product information changes only once per day, but thousands of users access the catalog every hour.

What approach provides the greatest performance benefit?

A. Disable indexes on product tables
B. Implement caching for product API responses
C. Return every product column for every request
D. Disable pagination

Correct Answer: B

Explanation

Caching is ideal for frequently accessed, rarely changing data.

Examples of good caching candidates:

• Product catalogs
• Reference data
• Geographic lookup information
• Configuration settings

Caching reduces repeated database queries and improves scalability.

Why the other options are incorrect:

• A. Removing indexes reduces performance.
• C. Returning unnecessary data increases workload.
• D. Disabling pagination can create large inefficient responses.

Question 7

A developer configures an entity in Data API Builder but update and delete operations fail. The table does not have a primary key.

What is the most likely reason?

A. GraphQL cannot access SQL databases
B. REST endpoints require Azure Functions
C. Entity identification requires a primary key
D. Pagination prevents updates

Correct Answer: C

Explanation

Primary keys allow Data API Builder to uniquely identify individual records.

Operations such as:

• Update
• Delete
• Retrieve by identifier

typically require a primary key.

Example:

GET /api/customers/100

requires knowing which row represents customer 100.

Why the other options are incorrect:

• A. GraphQL supports SQL data sources.
• B. REST endpoints do not require Azure Functions.
• D. Pagination does not prevent updates.

Question 8

A developer creates a REST endpoint for a Customer entity. The application needs to retrieve customers located in a specific city.

Which capability should be used?

A. Sorting
B. Filtering
C. Caching
D. Relationship mapping

Correct Answer: B

Explanation

Filtering returns only records matching specified criteria.

Example:

City = 'Seattle'

The database performs the filtering before returning results.

Why the other options are incorrect:

• A. Sorting changes ordering only.
• C. Caching improves performance but does not select records.
• D. Relationships connect entities but do not filter records.

Question 9

A developer exposes a table containing employee information through Data API Builder. The table contains salary information that should never be visible to API consumers.

What should the developer do?

A. Expose the table but rely on client applications to hide the salary column
B. Create an entity that exposes only required fields
C. Increase the database timeout value
D. Enable caching for the employee table

Correct Answer: B

Explanation

A secure API design exposes only the data required by consumers.

Possible approaches include:

• Creating database views
• Limiting exposed fields
• Configuring entity permissions

Sensitive information should not be sent to clients and hidden only through application logic.

Why the other options are incorrect:

• A. Client-side hiding is not a security control.
• C. Timeout settings do not protect sensitive data.
• D. Caching sensitive data can increase risk.

Question 10

A company uses GraphQL through Data API Builder. Developers want clients to request only the fields they need instead of receiving large unnecessary payloads.

Which GraphQL capability supports this requirement?

A. Field selection in queries
B. Database replication
C. SQL Server Agent scheduling
D. Data compression only

Correct Answer: A

Explanation

One of GraphQL’s primary advantages is allowing clients to specify exactly which fields they need.

Example:

{
  products {
    Name
    Price
  }
}

Only the requested fields are returned.

Benefits include:

• Reduced network traffic
• Smaller responses
• Improved application performance

Why the other options are incorrect:

• B. Replication improves availability but does not control query fields.
• C. SQL Agent scheduling is unrelated to API responses.
• D. Compression reduces payload size but does not allow field selection.

Topic Summary

Key concepts tested in this section:

Go to the DP-800 Exam Prep Hub main page