romano

Hi Michel,

Thank you for your response. That makes it clear! We can go further now to make it work again, thnx!

Best Regards, Romano

Hi,

We have an application that makes API calls using Invoke-PSUEndpoint. However, after an update (I believe from 2026.2.5 to 2026.3.0, or at least to 2026.3.3), this functionality no longer works as expected.

Our endpoints are protected by authentication. Currently, when a user does not have permission to access a particular endpoint, the application throws the following error: Exception of type 'PowerShellUniversal.ApiResponseException' was thrown. When the user does have the required permissions, everything works as expected.

Previously, however, this worked even when the user did not have explicit permissions for the endpoint. Our API security model in appsettings.json is set to Permissive. We have also tested with and without the -Integrated switch, but the issue occurs in both cases.

The idea behind this setup is to have an application that uses API calls without requiring every user to have permissions for all kinds of APIs.

Is this a bug that can be fixed, or is there another way we should configure this to achieve the desired behaviour? My suspicion is that this is a bug, since it worked as expected before the update.

I look forward to hearing from you.

Thanks in advance!

Best regards,

Romano

Hi Patrick,

Thank you for your clear explanation! After updating to 2026.3.4 the error is gone!

Kind Regards,

Romano

Hi Michel,

Thank you for your response. For now, I’ll indeed put the variable in variables.ps1 in the .universal folder of the PowerShell Universal repository.

I look forward to hearing from you when a new release containing this fix is available!

Thanks again for your help so far.

Best regards,

Romano

Hi Patrick,

Thank you for your response.

I find it strange that I am getting a SQL error, while there are no entries for endpoints or endpoint documentations in the SQL database when I check it.

• I am running version 2026.3.3 (I was already experiencing this issue in earlier versions as well).

• The IIS server uses a Microsoft SQL Server database, while my dev machine uses SQLite.

• New-PSUEndpointDocumentation is called from the .universal folder in multiple modules.

• Endpoints.ps1:

$Parameters = @{

Url = '/api/v1/test'

Description = 'test api for endpointdocumentation error'

Method = @('GET')

Module = 'powershelluniversal.test'

Command = 'Invoke-APITest'

Tag = @('Test')

Documentation = 'TEST'

}

New-PSUEndpoint @Parameters

In the Invoke-APITest function for the endpoint i have the synopsis:

<#

.SYNOPSIS

Test endpoint

.DESCRIPTION

Test endpoint for endpointdocumentation error

.OUTPUTS

200:

Description: Successful operation.

Content:

application/json: DSH_ComputerOutput

400:

Description: Bad Request

403:

Description: The user does not have permission to perform the operation.

500:

Description: Output from the error.

#>

• EndpointDocumentation.ps1:

$Parameters = @{

Name = 'TEST'

Description = 'TEST Endpoint Documentation'

Definition = {

[Documentation()]

class TEST_Output {

[string]$Test

}

}

Url = '/doc/v1/test'

Version = 'v1'

}

New-PSUEndpointDocumentation @Parameters

• I only see this happening when using Reload All Configurations.

• I have not noticed anything missing or broken apart from the error message itself.

I hope this provides you with enough information to investigate the issue further.

Kind regards,

Romano

Hi Michel,

Thank you again for your response. This is exactly the issue I am running into. My switch is also defined directly in roles.ps1, not in the role's policy script block.

I can move the variable definition to the PowerShell Universal repository's .universal folder, but I would have expected this to work with a root module as well. I see the benefits of using a root module, especially when combined with the other capabilities it offers.

Is this behavior by design, or would it be possible to improve or adjust the loading process to support this scenario?

Best regards,

Romano

Hi Michel,

Thank you for your response. I am running PowerShell Universal 2026.3.3, and the modules are stored in the `Modules` folder within the PowerShell Universal repository.

You're right, but I meant something slightly different. Sorry for the unclear question.

In `MODULE.Root`, I create a PowerShell Universal variable using `New-PSUVariable` in `.universal/variables`, for example, `PSU_ENV`.

In `MODULE.Aa`, I create a PowerShell Universal role that uses this `PSU_ENV` variable in a switch statement to determine which AD group to use.

However, it seems that `MODULE.Aa` loads before `MODULE.Root`, meaning that the `PSU_ENV` variable is not yet available when `MODULE.Aa` is loaded. This happens when the root module is not set in the appsettings.json

My thought was to configure the root module in `appsettings.json`, as described in the documentation, to ensure that it loads before the other modules.

However, after configuring this setting, the modules no longer load when I reload all configurations through the GUI, as you reproduced. They only load correctly again after restarting the PowerShell Universal service.

I hope that makes things a bit clearer

We are using a root module in PowerShell Universal. When I add the root module configuration to the `"Data": {}` section of `appsettings.json`, no errors occur, and the module appears to load correctly. Like this example: https://docs.devolutions.net/powershell-universal/platform/modules#example

However, when I reload all configurations through the GUI, the root module and all other modules no longer load. If I remove the root module setting from `appsettings.json`, everything works as expected again.

I would like to load the root module through `appsettings.json` because it seems that PowerShell Universal loads modules in alphabetical order.

For example, I have a module called `MODULE.Aa`, which uses a variable defined in my `MODULE.Root` module. Since `MODULE.Aa` appears to load before `MODULE.Root`, the variable is not available when `MODULE.Aa` runs, causing an error.

Is there a way to configure the root module so that it loads correctly and its variables are available to other modules, even after reloading all configurations through the GUI?

We are using PSU modules and when i reload all configurations then i get standard this error:

[11:33:08 ERR] UniversalAutomation.Services.ConfigurationScript Failed to read configuration file. endpointDocumentation.ps1

Microsoft.EntityFrameworkCore.DbUpdateException: An error occurred while saving the entity changes. See the inner exception for details.

---> Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 19: 'FOREIGN KEY constraint failed'.

at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db)

at Microsoft.Data.Sqlite.SqliteDataReader.NextResult()

at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior)

at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken)

at Microsoft.Data.Sqlite.SqliteCommand.ExecuteDbDataReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Update.ReaderModificationCommandBatch.ExecuteAsync(IRelationalConnection connection, CancellationToken cancellationToken)

--- End of inner exception stack trace ---

at Microsoft.EntityFrameworkCore.Update.ReaderModificationCommandBatch.ExecuteAsync(IRelationalConnection connection, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable`1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable`1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable`1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.Storage.RelationalDatabase.SaveChangesAsync(IList`1 entries, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(IList`1 entriesToSave, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(StateManager stateManager, Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)

at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)

at PowerShellUniversal.Extensibility.EFTable`2.SaveWithRetryAsync(DbContext context) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Extensibility\Persistence\EFTable.cs:line 1032

at PowerShellUniversal.Extensibility.EFTable`2.SaveWithRetryAsync(DbContext context) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Extensibility\Persistence\EFTable.cs:line 1038

at PowerShellUniversal.Extensibility.EFTable`2.DeleteAsync(T item) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Extensibility\Persistence\EFTable.cs:line 228

at PowerShellUniversal.Extensibility.EFTable`2.DeleteAsync(T item) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Extensibility\Persistence\EFTable.cs:line 228

at PowerShellUniversal.Configuration.EndpointDocumentationService.DeleteAsync(ModelOperationContext`1 context) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Configuration\EndpointDocumentation.cs:line 75

at UniversalAutomation.Services.ConfigurationScript`1.ReadAsync(SyncContext syncContext, CancellationToken cancellationToken) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal\ConfigurationScript.cs:line 391

In this modules we are creating endpoints with their endpointdocumentations.

Running on IIS but also from my dev seat running throug a running universal.server.exe command from my powershell 7 shell.

I have same sort of issue. From my dashboard app i call an API with Invoke-PSUEndpoint.

Before upgrading from 2026.2.5 to 2026.3.3 this was working without -Integrated switch or something. In AppSettings the SecurityModel is Permissive. When the logged in user push a button which is running the Invoke-PSUEndpoint he gets an error: Exception of type 'PowerShellUniversal.ApiResponseException' was thrown. This user haven't access to the API. But in older version it was no problem.

I have read the docs also and have added in the appsettings the Url and TrustCerticiate on true because of running in IIS.

For now it is not working with and without -Integrated switch. Only give the logged on user the right Role is now working.

Hi Michel,

Thank you for your response!

Your reaction triggered me to test something more. What I have noticed is that it does not work when the API is created from a PSU module, but it does work when the API is created directly from the PSU admin console.

I am running PSU (2026.3.3) on my dev seat which is Windows 11 and running PSU directly from a powershell 7 process. So the api's are running both in PowerShell 7 environment.

For this further test i created my endpoint like this:

$endpointParams = @{

Url = '/api/v1/test/apiresponse'

Description = 'API for testing API Responses with errors.'

Method = @('GET')

Module = 'psu.test'

Command = 'Invoke-APITestAPIResponse'

Environment = 'PowerShell 7'

Tag = @('test')

Documentation = 'TEST'

}

New-PSUEndpoint @endpointParams

I do a simple Invoke-Webrequest without extra parameters for this test.

I have some issues with the New-PSUApiResponse. I have done many tests for debugging and my conclusion is:

When an error comes from a function in a try{} block then the catch{} block will do something strange with New-PSUApiResponse. Then it is always Error 400 Badrequest without any output.

For example:

This is an error from ConvertFrom-Json for example with a wrong body format. Where Left is my code and right the result.

$body = '{"sizeGb"= 200}' # Wrong JSON format to test error

This is an error in try{} block itself for example. Where left is also my code and right the result.

I expect that the second example always works with any error from any function.

I hope this is clear enough