Microsoft Power Automate Integration

{
  "openapi": "3.0.1",
  "info": {
    "title": "Certyo Records API",
    "description": "Blockchain-backed record ingestion, verification, and query for the Certyo durable records platform.",
    "version": "1.0.0",
    "contact": {
      "name": "Certyo Developer Support",
      "url": "https://www.certyos.com/developers"
    }
  },
  "servers": [
    {
      "url": "https://www.certyos.com"
    }
  ],
  "security": [
    {
      "ApiKeyAuth": []
    }
  ],
  "paths": {
    "/api/v1/records": {
      "post": {
        "operationId": "IngestRecord",
        "summary": "Ingest a single record for blockchain anchoring",
        "description": "Accepts a record and returns 202 with a record hash. The record flows through the accumulation pipeline and is anchored on Polygon within ~60-90 seconds.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/IngestRecordRequest"
              }
            }
          }
        },
        "responses": {
          "202": {
            "description": "Record accepted for processing",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IngestRecordResponse"
                }
              }
            }
          }
        }
      },
      "get": {
        "operationId": "QueryRecords",
        "summary": "Query records by tenant and record ID",
        "parameters": [
          {
            "name": "tenantId",
            "in": "query",
            "required": true,
            "schema": { "type": "string" }
          },
          {
            "name": "recordId",
            "in": "query",
            "required": false,
            "schema": { "type": "string" }
          }
        ],
        "responses": {
          "200": {
            "description": "Matching records"
          }
        }
      }
    },
    "/api/v1/records/bulk": {
      "post": {
        "operationId": "BulkIngestRecords",
        "summary": "Ingest up to 1000 records in a single request",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BulkIngestRequest"
              }
            }
          }
        },
        "responses": {
          "202": {
            "description": "Bulk records accepted"
          }
        }
      }
    },
    "/api/v1/verify/record": {
      "post": {
        "operationId": "VerifyRecord",
        "summary": "Verify a record against its on-chain Merkle proof",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VerifyRecordRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Verification result"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "name": "X-API-Key",
        "in": "header"
      }
    },
    "schemas": {
      "IngestRecordRequest": {
        "type": "object",
        "required": ["tenantId", "database", "collection", "recordId", "recordPayload"],
        "properties": {
          "tenantId": { "type": "string", "description": "Your tenant identifier" },
          "database": { "type": "string", "description": "Logical source database or system" },
          "collection": { "type": "string", "description": "Logical table or collection" },
          "recordId": { "type": "string", "description": "Unique record identifier" },
          "recordVersion": { "type": "string", "default": "1" },
          "operationType": { "type": "string", "enum": ["insert", "update", "delete", "upsert"], "default": "upsert" },
          "recordPayload": { "type": "object", "description": "The record data as arbitrary JSON" },
          "sourceTimestamp": { "type": "string", "format": "date-time" },
          "idempotencyKey": { "type": "string", "description": "Deduplication key (24h window)" }
        }
      },
      "IngestRecordResponse": {
        "type": "object",
        "properties": {
          "recordId": { "type": "string" },
          "recordHash": { "type": "string" },
          "tenantId": { "type": "string" },
          "acceptedAt": { "type": "string", "format": "date-time" },
          "idempotencyReplayed": { "type": "boolean" }
        }
      },
      "BulkIngestRequest": {
        "type": "object",
        "required": ["tenantId", "records"],
        "properties": {
          "tenantId": { "type": "string" },
          "records": {
            "type": "array",
            "maxItems": 1000,
            "items": { "$ref": "#/components/schemas/IngestRecordRequest" }
          }
        }
      },
      "VerifyRecordRequest": {
        "type": "object",
        "required": ["tenantId", "database", "collection", "recordId", "payload"],
        "properties": {
          "tenantId": { "type": "string" },
          "database": { "type": "string" },
          "collection": { "type": "string" },
          "recordId": { "type": "string" },
          "payload": { "type": "object" }
        }
      }
    }
  }
}

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "contentVersion": "1.0.0.0",
    "triggers": {
      "When_a_row_is_added_or_modified": {
        "type": "OpenApiConnectionWebhook",
        "inputs": {
          "host": {
            "connectionName": "shared_commondataserviceforapps",
            "operationId": "SubscribeWebhookTrigger",
            "apiId": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps"
          },
          "parameters": {
            "subscriptionRequest/message": 4,
            "subscriptionRequest/entityname": "salesorder",
            "subscriptionRequest/scope": 4,
            "subscriptionRequest/filterexpression": "statecode eq 1"
          }
        }
      }
    },
    "actions": {
      "Compose_Certyo_Record": {
        "type": "Compose",
        "inputs": {
          "tenantId": "@{parameters('CertyoTenantId')}",
          "database": "dynamics-365",
          "collection": "sales-orders",
          "recordId": "@{triggerOutputs()?['body/salesorderid']}",
          "recordVersion": "@{triggerOutputs()?['body/versionnumber']}",
          "operationType": "upsert",
          "recordPayload": {
            "orderId": "@{triggerOutputs()?['body/salesorderid']}",
            "orderNumber": "@{triggerOutputs()?['body/ordernumber']}",
            "customerId": "@{triggerOutputs()?['body/_customerid_value']}",
            "totalAmount": "@{triggerOutputs()?['body/totalamount']}",
            "currency": "@{triggerOutputs()?['body/transactioncurrencyid']}",
            "status": "@{triggerOutputs()?['body/statuscode']}",
            "createdOn": "@{triggerOutputs()?['body/createdon']}",
            "modifiedOn": "@{triggerOutputs()?['body/modifiedon']}"
          },
          "sourceTimestamp": "@{triggerOutputs()?['body/modifiedon']}",
          "idempotencyKey": "@{triggerOutputs()?['body/salesorderid']}-@{triggerOutputs()?['body/versionnumber']}-@{utcNow('yyyy-MM-dd')}"
        },
        "runAfter": {}
      },
      "Ingest_Record_to_Certyo": {
        "type": "OpenApiConnection",
        "inputs": {
          "host": {
            "connectionName": "shared_certyo-records-api",
            "operationId": "IngestRecord",
            "apiId": "/providers/Microsoft.PowerApps/apis/shared_certyo-records-api"
          },
          "parameters": {
            "body": "@outputs('Compose_Certyo_Record')"
          }
        },
        "runAfter": {
          "Compose_Certyo_Record": ["Succeeded"]
        }
      },
      "Update_D365_with_Hash": {
        "type": "OpenApiConnection",
        "inputs": {
          "host": {
            "connectionName": "shared_commondataserviceforapps",
            "operationId": "UpdateRecord",
            "apiId": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps"
          },
          "parameters": {
            "entityName": "salesorders",
            "recordId": "@{triggerOutputs()?['body/salesorderid']}",
            "item/cr_certyorecordhash": "@{body('Ingest_Record_to_Certyo')?['recordHash']}",
            "item/cr_certyoacceptedat": "@{body('Ingest_Record_to_Certyo')?['acceptedAt']}"
          }
        },
        "runAfter": {
          "Ingest_Record_to_Certyo": ["Succeeded"]
        }
      },
      "Handle_Failure": {
        "type": "Compose",
        "inputs": {
          "error": "Certyo ingestion failed",
          "orderId": "@{triggerOutputs()?['body/salesorderid']}",
          "statusCode": "@{outputs('Ingest_Record_to_Certyo')['statusCode']}",
          "timestamp": "@{utcNow()}"
        },
        "runAfter": {
          "Ingest_Record_to_Certyo": ["Failed", "TimedOut"]
        }
      }
    },
    "parameters": {
      "CertyoTenantId": {
        "type": "string",
        "defaultValue": "acme-corp"
      }
    }
  }
}

using System.Net;
using System.Net.Http.Json;
using System.Text.Json;
using System.Text.Json.Serialization;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Azure.Functions.Worker.Http;
using Microsoft.Extensions.Logging;

namespace Certyo.PowerAutomate.Bridge;

/// <summary>
/// Azure Function that acts as a bridge between Power Automate and Certyo
/// for complex transformation scenarios that exceed Power Automate's
/// expression capabilities (nested loops, conditional mappings, etc.).
/// </summary>
public class CertyoBridge
{
    private readonly HttpClient _http;
    private readonly ILogger<CertyoBridge> _logger;
    private readonly string _certyoApiKey;
    private readonly string _certyoBaseUrl;

    public CertyoBridge(
        IHttpClientFactory httpFactory,
        ILogger<CertyoBridge> logger)
    {
        _http = httpFactory.CreateClient("Certyo");
        _logger = logger;
        _certyoApiKey = Environment.GetEnvironmentVariable("CERTYO_API_KEY")
            ?? throw new InvalidOperationException("CERTYO_API_KEY not set");
        _certyoBaseUrl = Environment.GetEnvironmentVariable("CERTYO_BASE_URL")
            ?? "https://www.certyos.com";
    }

    [Function("TransformAndIngest")]
    public async Task<HttpResponseData> TransformAndIngest(
        [HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequestData req)
    {
        var input = await req.ReadFromJsonAsync<SourceRecord>();
        if (input is null)
        {
            var bad = req.CreateResponse(HttpStatusCode.BadRequest);
            await bad.WriteAsJsonAsync(new { error = "Invalid request body" });
            return bad;
        }

        // Transform SharePoint document metadata to Certyo record
        var certyoRecord = new CertyoRecord
        {
            TenantId = Environment.GetEnvironmentVariable("CERTYO_TENANT_ID")
                ?? "acme-corp",
            Database = "sharepoint",
            Collection = input.LibraryName ?? "documents",
            RecordId = input.DocumentId,
            RecordVersion = input.Version?.ToString() ?? "1",
            OperationType = input.IsNew ? "insert" : "upsert",
            RecordPayload = new Dictionary<string, object?>
            {
                ["documentId"] = input.DocumentId,
                ["fileName"] = input.FileName,
                ["fileSize"] = input.FileSize,
                ["contentHash"] = input.ContentHash,
                ["libraryName"] = input.LibraryName,
                ["author"] = input.Author,
                ["modifiedBy"] = input.ModifiedBy,
                ["metadata"] = input.CustomMetadata
            },
            SourceTimestamp = input.ModifiedAt ?? DateTime.UtcNow,
            IdempotencyKey = $"{input.DocumentId}-{input.Version}-"
                + $"{DateTime.UtcNow:yyyy-MM-dd}"
        };

        // Call Certyo API
        using var request = new HttpRequestMessage(
            HttpMethod.Post,
            $"{_certyoBaseUrl}/api/v1/records");
        request.Headers.Add("X-API-Key", _certyoApiKey);
        request.Content = JsonContent.Create(certyoRecord);

        var certyoResponse = await _http.SendAsync(request);

        if (!certyoResponse.IsSuccessStatusCode)
        {
            _logger.LogError(
                "Certyo ingestion failed: {Status} for doc {DocId}",
                certyoResponse.StatusCode, input.DocumentId);

            var errorResp = req.CreateResponse(certyoResponse.StatusCode);
            await errorResp.WriteAsJsonAsync(new
            {
                error = "Certyo ingestion failed",
                status = (int)certyoResponse.StatusCode,
                documentId = input.DocumentId
            });
            return errorResp;
        }

        var result = await certyoResponse.Content
            .ReadFromJsonAsync<IngestResponse>();

        _logger.LogInformation(
            "Record ingested: {Hash} for doc {DocId}",
            result?.RecordHash, input.DocumentId);

        var response = req.CreateResponse(HttpStatusCode.Accepted);
        await response.WriteAsJsonAsync(result);
        return response;
    }

    [Function("VerifyRecord")]
    public async Task<HttpResponseData> VerifyRecord(
        [HttpTrigger(AuthorizationLevel.Function, "post",
            Route = "verify")] HttpRequestData req)
    {
        var input = await req.ReadFromJsonAsync<VerifyRequest>();
        if (input is null)
        {
            var bad = req.CreateResponse(HttpStatusCode.BadRequest);
            await bad.WriteAsJsonAsync(new { error = "Invalid request" });
            return bad;
        }

        using var request = new HttpRequestMessage(
            HttpMethod.Post,
            $"{_certyoBaseUrl}/api/v1/verify/record");
        request.Headers.Add("X-API-Key", _certyoApiKey);
        request.Content = JsonContent.Create(input);

        var certyoResponse = await _http.SendAsync(request);
        var result = await certyoResponse.Content.ReadAsStringAsync();

        var response = req.CreateResponse(certyoResponse.StatusCode);
        response.Headers.Add("Content-Type", "application/json");
        await response.WriteStringAsync(result);
        return response;
    }
}

public record SourceRecord
{
    public string DocumentId { get; init; } = "";
    public string? FileName { get; init; }
    public long? FileSize { get; init; }
    public string? ContentHash { get; init; }
    public string? LibraryName { get; init; }
    public string? Author { get; init; }
    public string? ModifiedBy { get; init; }
    public int? Version { get; init; }
    public bool IsNew { get; init; }
    public DateTime? ModifiedAt { get; init; }
    public Dictionary<string, object?>? CustomMetadata { get; init; }
}

public record CertyoRecord
{
    [JsonPropertyName("tenantId")] public string TenantId { get; init; } = "";
    [JsonPropertyName("database")] public string Database { get; init; } = "";
    [JsonPropertyName("collection")] public string Collection { get; init; } = "";
    [JsonPropertyName("recordId")] public string RecordId { get; init; } = "";
    [JsonPropertyName("recordVersion")] public string RecordVersion { get; init; } = "1";
    [JsonPropertyName("operationType")] public string OperationType { get; init; } = "upsert";
    [JsonPropertyName("recordPayload")] public Dictionary<string, object?> RecordPayload { get; init; } = new();
    [JsonPropertyName("sourceTimestamp")] public DateTime SourceTimestamp { get; init; }
    [JsonPropertyName("idempotencyKey")] public string IdempotencyKey { get; init; } = "";
}

public record IngestResponse
{
    [JsonPropertyName("recordId")] public string RecordId { get; init; } = "";
    [JsonPropertyName("recordHash")] public string RecordHash { get; init; } = "";
    [JsonPropertyName("tenantId")] public string TenantId { get; init; } = "";
    [JsonPropertyName("acceptedAt")] public DateTime AcceptedAt { get; init; }
    [JsonPropertyName("idempotencyReplayed")] public bool IdempotencyReplayed { get; init; }
}

public record VerifyRequest
{
    [JsonPropertyName("tenantId")] public string TenantId { get; init; } = "";
    [JsonPropertyName("database")] public string Database { get; init; } = "";
    [JsonPropertyName("collection")] public string Collection { get; init; } = "";
    [JsonPropertyName("recordId")] public string RecordId { get; init; } = "";
    [JsonPropertyName("payload")] public object? Payload { get; init; }
}

#!/usr/bin/env pwsh
<#
.SYNOPSIS
    Deploys the Certyo custom connector to a Power Platform environment.

.DESCRIPTION
    Imports the OpenAPI definition, configures API Key authentication,
    and creates a connection for the specified environment.

.PARAMETER EnvironmentId
    Power Platform environment ID (GUID).

.PARAMETER OpenApiPath
    Path to the certyo-connector-openapi.json file.

.PARAMETER CertyoApiKey
    Certyo API key to configure on the connection.
#>
param(
    [Parameter(Mandatory)]
    [string]$EnvironmentId,

    [Parameter(Mandatory)]
    [string]$OpenApiPath,

    [Parameter(Mandatory)]
    [string]$CertyoApiKey
)

$ErrorActionPreference = "Stop"

# Ensure Power Apps admin module is installed
if (-not (Get-Module -ListAvailable -Name Microsoft.PowerApps.Administration.PowerShell)) {
    Write-Host "Installing Power Apps admin module..."
    Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser -Force
}

Import-Module Microsoft.PowerApps.Administration.PowerShell

# Authenticate to Power Platform
Write-Host "Authenticating to Power Platform..."
Add-PowerAppsAccount

# Read the OpenAPI definition
$openApiContent = Get-Content -Path $OpenApiPath -Raw
$openApiJson = $openApiContent | ConvertFrom-Json

Write-Host "Deploying Certyo connector to environment: $EnvironmentId"

# Create or update the custom connector
$connectorParams = @{
    EnvironmentName = $EnvironmentId
    ConnectorName   = "certyo-records-api"
    OpenApiDefinition = $openApiContent
}

try {
    # Check if connector already exists
    $existing = Get-AdminPowerAppConnector -EnvironmentName $EnvironmentId |
        Where-Object { $_.ConnectorName -eq "certyo-records-api" }

    if ($existing) {
        Write-Host "Updating existing Certyo connector..."
        Set-AdminPowerAppConnector @connectorParams
    } else {
        Write-Host "Creating new Certyo connector..."
        New-AdminPowerAppConnector @connectorParams
    }

    Write-Host "Connector deployed successfully." -ForegroundColor Green

    # Create a connection with the API key
    Write-Host "Creating connection with API key..."
    $connectionParams = @{
        ConnectorName   = "certyo-records-api"
        EnvironmentName = $EnvironmentId
        ConnectionParameters = @{
            "api_key" = $CertyoApiKey
        }
    }
    New-AdminPowerAppConnection @connectionParams

    Write-Host "Connection created successfully." -ForegroundColor Green
    Write-Host ""
    Write-Host "Next steps:" -ForegroundColor Cyan
    Write-Host "  1. Open Power Automate (https://make.powerautomate.com)"
    Write-Host "  2. Create a new flow"
    Write-Host "  3. Search for 'Certyo Records API' in the connector list"
    Write-Host "  4. Use IngestRecord, BulkIngestRecords, or VerifyRecord actions"

} catch {
    Write-Error "Deployment failed: $_"
    exit 1
}