---
id: change/bcapps/12194
type: change
title: "#12194 Harden web request helpers: opt-in default credentials"
summary: Http Web Request Mgt. and SOAP Web Service Request Mgt. now disable default credentials by default and require callers to opt in with SetUseDefaultCredentials(true) for on-premises installations, preventing unintended transmission of Business Central service account credentials to external hosts.
tier: official
language: en
tags:
  - breaking
  - main
  - bc30
  - codeunit http web request mgt.
  - codeunit soap web service request mgt.
  - codeunit extension marketplace
system: integration
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:02:43.571Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: c38d79551ed59d60a537632818e5e6670ea88c3d
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/12194
    title: "microsoft/BCApps#12194: Harden web request helpers: opt-in default credentials"
    date: "2026-10-02"
    commit: c38d79551ed59d60a537632818e5e6670ea88c3d
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/codeunit/1297
    - object/codeunit/1290
    - object/codeunit/2501
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 12194
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/12194
kind: pr
base_branch: main
major: "30"
merged_at: "2026-10-02T09:51:28Z"
author: darjoo
author_type: User
community_contribution: false
labels:
  - "AL: System Application"
  - "Team: Integrations"
change_class: code
change_kind: breaking
behavior_change: true
breaking: true
files:
  count: 6
  additions: 51
  deletions: 5
  al: 3
apps:
  - Base Application
  - System Application
objects_touched:
  - key: codeunit/1297
    page: codeunit/1297
    type: codeunit
    id: 1297
    name: Http Web Request Mgt.
    app: Base Application
    status: modified
  - key: codeunit/1290
    page: codeunit/1290
    type: codeunit
    id: 1290
    name: SOAP Web Service Request Mgt.
    app: Base Application
    status: modified
  - key: codeunit/2501
    page: codeunit/2501
    type: codeunit
    id: 2501
    name: Extension Marketplace
    app: System Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 652511
systems:
  - integration
  - development
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #12194 Harden web request helpers: opt-in default credentials

> Http Web Request Mgt. and SOAP Web Service Request Mgt. now disable default credentials by default and require callers to opt in with SetUseDefaultCredentials(true) for on-premises installations, preventing unintended transmission of Business Central service account credentials to external hosts.

[Pull request](https://github.com/microsoft/BCApps/pull/12194) · merged into `main` (BC30) on 2026-10-02 by darjoo · 6 files (+51 -5), 3 AL · breaking · tier official · reviewed (checked by Opus)

## What changed

- Http Web Request Mgt. and SOAP Web Service Request Mgt. no longer use default credentials unless the caller opts in
- New OnPrem SetUseDefaultCredentials(Boolean) lets callers turn default credentials back on
- Fault-response trace logging in Http Web Request Mgt. is now off by default; use SetTraceLogEnabled(true)
- Extension Marketplace never sends default credentials for its AppSource telemetry callback
- Library - Graph Mgt test library opts in because API tests call the local BC server
- Breaking: existing extensions can stop compiling or working.

## AL objects touched

- [Codeunit 1297 "Http Web Request Mgt."](../../objects/codeunit/1297.md), Base Application: modified
- [Codeunit 1290 "SOAP Web Service Request Mgt."](../../objects/codeunit/1290.md), Base Application: modified
- [Codeunit 2501 "Extension Marketplace"](../../objects/codeunit/2501.md), System Application: modified

## Context

- Work items: AB#652511
- Labels: AL: System Application, Team: Integrations
- Systems: integration, development

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).