PowerShell REST APIs

Invoke-RestMethod calls an HTTP API and parses the response for you: JSON comes back as objects you can pipe. Invoke-WebRequest is the lower-level option, returning the raw response with status code, headers and content, which is what you want when you care about the transport rather than the data.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

The parameters you will use every time are -Uri, -Method, -Headers with a hashtable, and -Body. For a JSON API, pipe your object through ConvertTo-Json and set -ContentType 'application/json'.

Authentication is usually a bearer token in the Authorization header. Never put a real token in a script file. Read it from an environment variable or a secret store, and if you must prompt, use Read-Host -AsSecureString.

Paging is the part people forget. Most APIs return a page at a time plus a link to the next one, so a single call gives you the first 100 records and no warning that there are 4,000 more. Loop while the next-link property is present.

Inspect this example’s structure

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

$headers = @{
  Authorization = 'Bearer <token>'
  Accept = 'application/json'
}
$body = @{ name = 'demo';enabled = $true } | ConvertTo-Json
Write-Output $body

Stage 1$headersPositional values or no named parameters
Stage 2ConvertTo-JsonPositional values or no named parameters

An example to inspect

Preview the example. Sign in for the full lesson and activities.

$headers = @{
  Authorization = 'Bearer <token>'
  Accept = 'application/json'
}
$body = @{ name = 'demo';enabled = $true } | ConvertTo-Json
Write-Output $body

What happens

This builds the two pieces every authenticated JSON request needs and prints the body rather than sending it, so nothing leaves the machine. The headers hashtable carries the bearer token and the Accept type. The body starts as a PowerShell hashtable and becomes JSON text through ConvertTo-Json, which is exactly what you would pass to -Body.

Worth remembering

Invoke-RestMethod parses JSON into objects. Invoke-WebRequest returns the raw response.
Set -ContentType 'application/json' when posting JSON.
Keep tokens out of script files; read them from the environment or a secret store.
Follow the next-page link or you will silently process only the first page.

Primary documentation

ConvertTo-Json reference

Try it

Illustrative output · values vary by environment

1PS> $headers = @{

2PS> Authorization = 'Bearer <token>'

3PS> Accept = 'application/json'

4PS> }

5PS> $body = @{ name = 'demo';enabled = $true } | ConvertTo-Json

6PS>

7PS> Write-Output $body

Example reader

Inspect this page's example

Fictional browser data when supported

Run supported commands against the practice data, or inspect the example without executing it.

$headers = @{
  Authorization = 'Bearer <token>'
  Accept = 'application/json'
}
$body = @{ name = 'demo';enabled = $true } | ConvertTo-Json

Write-Output $body

Ready to inspect.

Builds the headers and JSON body for an authenticated request without sending it.

Show reference output