Lattice - Trial & Day-One Guide

Goal. Get Lattice from a downloaded package into a working sandbox, make your first authenticated service call, and see an event fire - in one sitting.

Audience. An evaluator with administrator access to a non-production D365 F&O environment (a Tier-1 developer box or a cloud-hosted sandbox). Nothing here should be run against production.

What this guide is not. It does not re-document the full deployment surface. Where a step has a deeper reference, this guide links down into it - Deployment stays authoritative for detail. Read this end to end first; it is the shortest correct path.

What you are evaluating

Area	Surface
Integration operations	30 services · 13 auto-deploying service groups · 182 inbound REST operations
Data entities	149 data entities (46 read-only, 103 writable) + 1 composite + 2 entity extensions
Business events	81 business events across 16 modules
Security	291 privileges · 22 duties · 4 roles

The operations cover accounts receivable, accounts payable (including generating vendor check payments), inventory, production, general ledger (journals with ledger, customer, vendor and bank lines), fixed assets (from acquisition through adjustments, transfers, splits and reversals), projects, expense reports and workflow. They can also post a journal that is already in F&O - entered on its page, imported through data management or created through the standard journal entities - for callers that hold the operation that posts that journal type.

All three pillars ship in one model, one deployable package (Lattice, publisher Magicite, model ID 990000048, ISV layer 8). The package also carries Siren, the licensing module Lattice requires.

Before you start

You need all four of these. Item 3 is the one evaluators most often miss.

A non-production D365 F&O environment, 10.0.x or later, where you can deploy an ISV package and run a database synchronization.
Administrator access to that environment (to assign security roles; the service groups deploy with the package).
An Entra ID (Azure AD) app registration for the calling client, mapped to a D365 user - Deployment.
An HTTP client. The fastest start is a Postman collection that you generate in Lattice itself (see Day one).

Lattice requires the Siren licensing module. The Lattice packages include it, so there is nothing to deploy for it separately (see Step 3).

Install

Step 1 - Get the package

Each Lattice build is delivered in two package formats. Both contain Lattice and Siren, compiled code only. Each release ships one package per supported Finance and Operations version: take the one built for the version your sandbox runs.

Artifact	Format	Use it for
`lcs-package`	`AXDeployableRuntime_Lattice_<version>.zip`, the LCS software deployable package	A cloud-hosted sandbox managed in LCS (upload to the Asset library), or a Tier-1 developer box (`AXUpdateInstaller.exe devinstall`)
`drop`	The Power Platform unified package	An environment managed in the Power Platform admin center

Step 2 - Install into the sandbox

Cloud-hosted sandbox (LCS): upload the lcs-package zip to the LCS Asset Library and apply it to the environment - Deployment.

Tier-1 developer box: install the lcs-package zip with AXUpdateInstaller.exe devinstall (Install the compiled package).

On a developer box, then synchronize the database (Deployment); a deployment through LCS or the Power Platform admin center synchronizes it for you. Lattice adds 181 tables to the database; skipping the sync is the most common cause of a broken first call.

Step 3 - Licensing (Siren)

Lattice's descriptor references the shared Siren module, and licensing (product id Lattice) is enforced at the Lattice write surface. The Lattice packages carry Siren, so applying the package installs it as well.

There is no license key to enter. Environment identity is derived server-side and licenses are provisioned by the Magicite licensing service. Siren works with nothing set: it checks in with the licensing service by itself when the environment starts and once a day. Its pages are under System administration > Setup > Siren and need the Siren license administrator role or System administrator:

Siren license parameters holds optional overrides only (a different licensing service, usage telemetry, the environment type, timeouts). Leave it as it is.
Siren license diagnostics shows the license state: find the Lattice line under Products and live verdicts.
Siren license refresh checks in now instead of waiting for the daily refresh.

What to expect on a fresh trial install: nothing. Until its first check-in, an environment reports Unlicensed, and Unlicensed is allowed through: the gate fails open. Your trial works without any licensing setup at all. Licensing only ever blocks on a definitive adverse verdict.

Full behavior, including what an admin should do when calls start failing: Licensing.

Step 4 - Set up the calling identity

Create the Entra ID app registration and client secret.
Register it in System administration → Setup → Microsoft Entra ID applications and map it to a dedicated, non-interactive D365 user.
Assign that user a Lattice role. For a trial, MGCLatticeIntegrationOperatorRole (posting + queries + monitoring, no high-risk operations) is the right default. Use MGCLatticeIntegrationReadOnlyRole if you only want to look.

Do not assign MGCLatticeDatabaseAccessAdministrator. It grants just-in-time db_owner over AxDB. It is not needed for any trial activity. Read Database access administrator before granting it to anyone, ever.
Set the user's default company to the legal entity you will test against.

Data entities come with the role. The operator role includes MGCLatticeDataEntitiesView and MGCLatticeDataEntitiesMaintain, and the read-only role includes MGCLatticeDataEntitiesView, so the OData data entities are reachable without a custom role. The 33 cross-reference entities come through their own duties: both roles can read them (MGCLatticeCrossReferenceViewDuty), and only the administrator role can change them (MGCLatticeCrossReferenceMaintainDuty); see Cross-reference keys. The three monitoring entities (LatticeServiceCallLogs, LatticeServiceIdempotencyLogs, LatticeAsyncOperationTrackingRecords) come through MGCLatticeIntegrationServiceMonitoringDuty, which both roles hold.

Detail: Deployment and §9.

Step 5 - Verify the install

Before calling anything, confirm the surface is live:

Service groups - the 13 Lattice service groups deploy with the package, so there is nothing to set up. To confirm they are live, open https://{env}/api/services in a browser signed in to the environment: every MGCLattice...ServiceGroup should be listed. If one is missing, see Deployment.
OData entities - GET https://{env}/data/ should list the Lattice entity sets.
Security - the four Lattice roles appear on the Roles tab of System administration → Security → Security configuration, and in the role list of System administration → Security → Assign users to roles.
Documentation - the Help icon on every Lattice page opens that page's documentation. It defaults to https://go.magicite.tech/documentation; an administrator can point it at their own copy on System administration → Setup → Siren → Documentation help (Deployment).

Full checklist: Deployment.

Day one: your first five calls

Work these in order. Each one proves a different part of the stack, cheapest and safest first.

To get requests ready to send, generate a Postman collection with Postman (under Specifications) on the Service metadata explorer (System administration > Inquiries > Lattice > Services) for the service operations, or on the OData entity metadata explorer (System administration > Inquiries > Lattice > OData) for the data entities. Both build the collection from the explorer's stored metadata, so run the explorer's refresh (Refresh metadata or Refresh OData metadata) once after the deployment.

All service operations follow one URL shape:

POST https://{environment-url}/api/services/{ServiceGroupName}/{ServiceName}/{OperationName}

The request contract goes in a _request property. The bodies below use the USMF demo company (Contoso demo data): customer US-001, item D0001, journal name GenJrn, main accounts 110110 (Bank Account - USD) and 110180 (Petty Cash). They run exactly as shown against a USMF sandbox. In your own data, substitute a customer, an item with a sales price, a journal name of type Daily, and two main accounts that allow manual entry.

1. Get a token

Client-credentials flow, scope https://{environment-url}/.default. If this fails, you have an app registration problem, not a Lattice problem - HTTP 401.

2. A read-only call (proves auth + routing)

POST /api/services/MGCLatticeAccountsReceivableServiceGroup/MGCLatticePriceInquiryService/resolveSalesPrice

{
  "_request": {
    "LegalEntityId": "USMF",
    "CustAccount": "US-001",
    "ItemId": "D0001",
    "Qty": 1
  }
}

Expected: "Success": true, "PriceFound": true and a UnitPrice (480.00 USD for D0001 in USMF).

resolveSalesPrice reads and writes nothing, is granted by the read-only MGCLatticePriceInquiryServiceView privilege, and is not license-gated. It is the safest possible first call. A 200 here means auth, routing, security, and the legal-entity mapping are all correct.

3. A preview (proves validation without committing)

Send a posting request with PreviewMode set to true:

POST /api/services/MGCLatticeGeneralLedgerServiceGroup/MGCLatticeGeneralLedgerJournalService/postGeneralJournal

{
  "_request": {
    "RequestId": "9b2d5f60-1c34-4e8a-b7d2-0a4c6e8f1b23",
    "LegalEntityId": "USMF",
    "UserContext": "trial",
    "JournalNameId": "GenJrn",
    "Description": "Lattice trial journal",
    "PostingDate": "2026-09-28",
    "PreviewMode": true,
    "Lines": [
      {
        "MainAccountId": "110110",
        "OffsetMainAccountId": "110180",
        "AmountCurDebit": 10.00,
        "AmountCurCredit": 0,
        "CurrencyCode": "USD",
        "Description": "Lattice trial",
        "TransDate": "2026-09-28"
      }
    ]
  }
}

Use today's date in PostingDate and TransDate (the period must be open). Expected: "Success": true, "PreviewApplied": true and the message "... is valid. No journal was created or posted." The service validates the payload and returns the projected outcome without consuming a number sequence, committing a document, or emitting an event.

Previews are deliberately not license-gated, so they keep working even on a lapsed license. See Posting preview.

4. A real post (proves the write path and exactly-once)

Resend the same request with "PreviewMode": false and a stable RequestId. Expected: "Success": true, a DocumentId (the journal number) and the message "General journal {number} posted successfully." Then send it again unchanged: the second call must return the same DocumentId, with the message "Duplicate request detected ..." and the note "This is a cached response from a previous execution of the same RequestId", without creating a second journal. That is the exactly-once guarantee, and it is the single most important thing to verify in a trial. (A preview does not use up its RequestId; you can post with the same one.)

Walkthrough: Post a journal exactly once. Payloads: Endpoint payload specification.

Prefer to click rather than curl? The in-app Service test console (MGCLatticeServiceTestConsole) invokes any operation interactively, including in preview mode.

5. An event (proves the outbound path)

System administration → Setup → Business events → Business events catalog.
Find a Lattice event. The easiest to trigger from here is the general journal one, MGCLatticeGeneralJournalPostedBusinessEvent (payload).
Activate it for USMF against an endpoint (Event Grid, Service Bus, or a plain HTTPS webhook).
Repeat call 4 with a new RequestId (a repeated one returns the cached result and posts nothing) and watch the payload arrive.

These are standard BusinessEventsBase events, so they route to any supported endpoint and behave like first-party events in monitoring and retry. Per-event payload reference: Event catalog.

Then: watch what you did

The monitoring entities are read-only OData feeds - query them straight away:

LatticeServiceCallLogs: each posting call, previews included, with its status and duration. Read-only calls, such as the price inquiry and status queries, are not logged.
LatticeServiceIdempotencyLogs - the claim rows behind the exactly-once guarantee.
LatticeAsyncOperationTrackingRecords - async/bulk operation state.

When it goes wrong

Symptom	Most likely cause	Where to look
HTTP 401	No valid token: wrong scope or an expired secret	Deployment
HTTP 403	The token is valid, but the app is not registered on Microsoft Entra ID applications (or its user is disabled), or the user has no Lattice role that grants the operation	Deployment
HTTP 403 on a Lattice data entity specifically	The user holds a custom role without the entity duties, or is writing a cross-reference entity without the administrator role - see Step 4	Security model
HTTP 404 on a service URL	The service group is not deployed (the package did not finish deploying), or a name in the URL is misspelled	Deployment
`LicenseNotValid` error code	License expired/invalid, or offline too long	Deployment
"Voucher not specified"	Number sequences not configured in the legal entity	Environment setup, not a payload problem
Entities missing from `/data/`	Database sync not run, or entity list not refreshed	Deployment

Honest trial limits

Things an evaluator should know up front, because they are not obvious:

Licensing does not get in the way of a trial. An environment that has not checked in reads Unlicensed, which blocks nothing; after its first check-in it runs on the license the licensing service provisions for it, and only Expired, Invalid or OfflineExceeded stops write operations. Ask Magicite about the terms of your evaluation license.
There is no license key to enter and no activation screen. To see the license state, open System administration > Setup > Siren > Siren license diagnostics.
Data entities (reads and writes) and business events are never license-gated - only Lattice service writes and interactive processing actions are. A lapsed license stops new postings through the services and warns on the pages; it never stops Data management jobs or integrations writing through the entities.
Distribution is direct, not AppSource. There is no marketplace "get it now" button; the package comes from Magicite.
MGCLatticeDbAccessService ships in the package. It is not fenced out. Its role is unassigned by default and must stay that way unless you have read Security model.

Removing it

Lattice is an ISV-layer (8) model with no over-layering, so removal is a package-level operation: remove the model and re-synchronize. Custom Lattice tables and their data are dropped by the sync. Business events you activated should be deactivated in the catalog first so endpoints stop receiving traffic. See Deployment for version and layer behavior.

Where to go next

You want to…	Read
Evaluate commercially	What Lattice offers · Offering deep dive
See every operation and payload	API reference · Endpoint payload specification
Plan security properly	Security model
Wire a file-based integration	Inbound file to posted document
Understand exactly-once	Post a journal exactly once · Idempotency reconcile runbook
Deploy for real	Deployment
Get help, report a problem or request a feature	Contact Magicite, which sells and supports Lattice directly

What you are evaluating​

Before you start​

Install​

Step 1 - Get the package​

Step 2 - Install into the sandbox​

Step 3 - Licensing (Siren)​

Step 4 - Set up the calling identity​

Step 5 - Verify the install​

Day one: your first five calls​

1. Get a token​

2. A read-only call (proves auth + routing)​

3. A preview (proves validation without committing)​

4. A real post (proves the write path and exactly-once)​

5. An event (proves the outbound path)​

Then: watch what you did​

When it goes wrong​

Honest trial limits​

Removing it​

Where to go next​