REFRACT Platform Connector for Power Platform

Overview

The REFRACT Platform Connector for Microsoft Power Platform lets Power Automate flows and Power Apps generate PDFs, trigger e-signature and approval workflows, and retrieve sealed documents - all connected to your organization's self-hosted REFRACT Platform Dispatcher.

Key characteristics:

• No coding required - pre-built actions in Power Automate and Power Apps
• Self-hosted - connects to your organization's own Dispatcher, not a shared service
• OAuth 2.0 client credentials - each connection is created with a Dispatcher URL and an Azure AD app registration's tenant ID, client ID, client secret, and scope; there is no interactive user sign-in
• Data sovereignty - documents are generated and stored in your Azure tenant; REFRACT eSign and REFRACT Workflow use a REFRACT-hosted portal to reach signers and recipients

A Different Kind of Connector

Most document connectors are tightly coupled to specific document types. Adding a new document type means updating the connector, redeploying it, and rebuilding flows. REFRACT Platform is architected differently.

The four connector actions cover the entire document lifecycle regardless of how many document types your organization manages:

Authentication Model

The REFRACT Platform Connector uses OAuth 2.0 client credentials (app-to-app), not an interactive user sign-in.

Creating a connection requires five values: the Dispatcher URL, and the tenant ID, client ID, client secret, and OAuth scope of an Azure AD app registration your IT admin sets up for the connector. The connector's own code acquires a fresh access token from Azure AD for every request using these values, then forwards the request to the Dispatcher with that token as a Bearer credential. There is no per-user sign-in window and no token refresh to manage - each call re-authenticates with the stored client credentials.

Flow runs an action
    │
    ├── Power Platform reads the connection's stored parameters
    │     (Dispatcher URL, Tenant ID, Client ID, Client Secret, Scope)
    │
    ├── Connector's script acquires an Azure AD token via
    │     grant_type=client_credentials using those values
    │
    └── Request forwarded to Dispatcher with the resulting Bearer token
          Dispatcher validates iss, aud, and tid claims - processes request

The client secret is entered once when the connection is created and stored encrypted as part of that connection. It is never sent to the Dispatcher directly - only the resulting Bearer token is.

Capabilities

Prerequisites

The flow maker needs five values from their IT admin to create a connection - there is no interactive sign-in step:

Quick Start

Create a Connection

Open Power Automate

Go to make.powerautomate.com and sign in.

Navigate to Connections

In the left sidebar go to Data → Connections. Click + New connection.

Find the REFRACT Platform Connector

Search for REFRACT Platform. Select the connector from the results.

Enter the Connection Fields

Field	What to enter
Dispatcher URL	Base URL of the Dispatcher Function App - no /api suffix
Azure AD Tenant ID	Your organization's tenant GUID
Client ID	Application (client) ID of the App Registration created for this connector
Client Secret	That App Registration's client secret value
OAuth Scope	api://<dispatcher-app-client-id>/.default, where <dispatcher-app-client-id> is the client ID of "REFRACT Dispatcher API"

No trailing /api in Dispatcher URL

Enter https://func-dispatcher-contoso-prod.azurewebsites.net - not https://func-dispatcher-contoso-prod.azurewebsites.net/api. The /api prefix is handled automatically.

Create the Connection

Click Create. The connection is saved with these five values - there is no sign-in window and no connection test at creation time, since this connector does not define one. The first action call in a flow is what actually exercises the credentials; if they are wrong, that call fails with an authentication error (see Troubleshooting).

Common Flow Patterns

Trigger: When a record is created (Dataverse  -  Sales Order)
Condition: Status = Approved

Action: Generate Document
  templatePath: "BC/Sales/SalesInvoice.rpkg"
  payloadPath:  "payloads/[Order Number].json"
  options: {
    "documentId": "[Order Number]",
    "docType": "invoice",
    "sourceSystem": "BusinessCentral",
    "generatedBy": "erp-service@contoso.com",
    "features": {
      "generatedDocuments": true,
      "auditSnapshot": true
    }
  }

Action: Send an email
  To:         [Customer Email]
  Subject:    Invoice [Order Number]
  Body:       Your invoice for order [Order Number] is attached.
  Attachment: body of Generate Document (the PDF binary returned directly by the action)

Trigger: When a record is created (Dataverse  -  Contract)

Action: Generate Document
  templatePath: "Legal/Contracts/ServiceAgreement.rpkg"
  payloadPath:  "payloads/contracts/[Contract ID].json"
  templateSettings: {
    "esign": {
      "enabled": true,
      "signers": [{ "slotIndex": 0, "role": "Signer", "email": "[Signer Email]", "namePrefill": "[Signer Name]" }],
      "expiresInMinutes": 10080
    }
  }
  options: {
    "documentId": "[Contract ID]",
    "docType": "contract",
    "features": {
      "generatedDocuments": true,
      "auditSnapshot": true,
      "vaultESign": true,
      "immutableAudit": true,
      "explainDocument": true
    }
  }

Action: Store Workflow ID in Dataverse record
  workflowId: [X-Refract-WorkflowId header from Generate Document]

Action: Do Until  state = "complete"  OR  state = "rejected"  OR  state = "cancelled"
  ├── Delay: 2 minutes
  └── Check Workflow Status
        Workflow ID: [Workflow ID]

Action: Condition  state = "complete"
  Yes → Download Sealed PDF (Workflow ID)
         Create file in SharePoint (body of Download Sealed PDF - the PDF binary)
  No  → Send rejection notification

Trigger: When a record is created (Dataverse  -  Purchase Requisition)

Action: Generate Document
  templatePath: "Procurement/PurchaseRequisition.rpkg"
  payloadPath:  "payloads/requisitions/[Req ID].json"
  templateSettings: {
    "workflow": {
      "enabled": true,
      "recipients": [{ "email": "manager@contoso.com", "displayName": "Finance Manager" }],
      "message": "Please approve requisition [Req ID]",
      "expiresInDays": 1
    }
  }
  options: {
    "documentId": "[Req ID]",
    "docType": "workflow",
    "features": {
      "generatedDocuments": true,
      "auditSnapshot": true,
      "vaultESign": true,
      "immutableAudit": true
    }
  }

Action: Update record - store Workflow ID

Action: Do Until  state = "complete"  OR  state = "rejected"  OR  state = "cancelled"
  ├── Delay: 10 minutes
  └── Check Workflow Status (Workflow ID)

Action: Condition  state = "complete"
  Yes → Update record: Status = Approved
         Download Sealed PDF → attach to record
  No  → Update record: Status = Rejected
         Send notification to requestor

Security Model

Every API call to the Dispatcher is validated against three JWT claims:

The connection stores the client secret encrypted; it is used only by the connector's own code to acquire a Bearer token from Azure AD for each request and is never forwarded to the Dispatcher itself. Acquired tokens are not visible in flow run history, logs, or action outputs.

Rate Limiting

To prevent runaway loops from overwhelming the Dispatcher:

• Limit: 100 requests per 60 seconds per tenant/app combination
• When exceeded: 429 Too Many Requests with a Retry-After header
• Scope: In-memory per function instance

Next Steps

• Connector Setup & Configuration - IT admin App Registration setup and connection creation
• API Reference - Full parameter definitions, response schemas, error codes

Security & Legal

• Trust Center - Security controls, compliance posture, and data handling - share with your security or procurement team
• Privacy Policy - How data is processed and protected within your Azure tenant
• Terms of Service - Legal terms governing use of REFRACT Platform