Add unbound Custom API Server Logic sample

[Suyash Kumar Patel (suyash1208)]

Summary

• add a ready-to-import unmanaged solution containing two unbound Dataverse Custom APIs, their parameters and response properties, the Server Logic component, and a signed plug-in assembly
• include an enhanced-data-model Power Pages site named Custom API Support in Server Logic with no Code Site components
• make the home page automatically invoke the unbound Custom Action (POST) and parameterized unbound Custom Function (GET with OData aliases), then render both results and reference code
• include self-contained Header and Footer templates plus the homepage markup and JavaScript source
• add visible security guidance for anonymous/authenticated endpoint access and minimum production privileges
• ensure the full page remains vertically scrollable, render nested reference code legibly, and guard homepage initialization so only one Server Logic request is issued

Validation

• local MasterPortal home page returned HTTP 200 and reached overall PASS
• action returned HTTP 200 with ResponseNumber = 42
• parameterized function received InputNumber = 61, returned HTTP 200 with ResponseNumber = 68, and preserved the encoded OData alias URL
• browser trace contained exactly one request to /_api/serverlogics/sl-unbound-customapi-manual-test
• the updated homepage rendered from the exact packaged source with the Security Note visible; axe-core WCAG A/AA/2.1 AA reported 0 violations, 24 passing checks, and 0 incomplete checks
• public solution version: 1.0.0.2; SHA-256: 52B3C0100D132E767210008A72EF743B3CA7A101402975E8E541F4A748E4A6C6
• Power Platform CLI unpacked and repacked the final ZIP; all 30 XML files parsed, source/package parity passed, and no target-environment or Code Site strings were present
• the final package intentionally omits a primary domain, and an exact-package update preserved the activated site's existing address
• the exact 1.0.0.2 package imported successfully with all 30 solution components intact; all 12 component/API assertions passed, including direct Action 42 and Function 68 results
• the localized Home component explicitly clears legacy page CSS/JavaScript, preventing unmanaged updates from retaining an older second invocation script

Deployment note

After the first import, reactivate the included site, choose an available site address, and publish all customizations. The package does not carry a primary domain, so importing a newer version does not replace an activated site's address. When updating an existing test import, publish and clear the site configuration cache. Parameterized unbound Custom Functions through InvokeCustomApi are available starting with Power Pages runtime version 9.8.9.xx.

Homepage

[T-Nid (tyaginidhi)]

Could you please verify the CSRF handling for the Server Logic request in samples/server-logic/unbound-custom-api/source/homepage.js?

The current implementation uses plain fetch with only an Accept header. Power Pages Server Logic requests may require an __RequestVerificationToken (or shell.safeAjax), so this could return HTTP 403 before get() executes. If the token is required here, please update the script and regenerate the solution ZIP containing it.