403 GraphQL API

Hi. I'm guessing you are missing granting service principals to use fabric api. A fabric administrator can switch this at admin portal - tenant settings:

Make sure your service principal is in a security group in there or the entire org.

I'm not sure about the endpoint yet.

I hope that helps,

Hi Ibarra,

Thanks for your response.

We have enabled the service principal in the security group. However, when we call the GraphQL endpoint using an Entra ID access token, we receive the following error:

“The current user is not authorized to execute this operation.”

Could you please suggest how we can resolve this issue?

Thanks for your help.

Hi harsh_chandra​ 

The error “The current user is not authorized to execute this operation” points to an authorization issue, but doesn’t identify which permission is missing. Enabling the tenant setting allows the service principal to use Fabric APIs; it does not grant access to a specific GraphQL API.

Please check these permissions and settings:

1. Tenant setting: Ask your Fabric admin to enable Service principals can use Fabric APIs under Fabric admin portal → Tenant settings → Developer settings. If the setting is scoped to a security group, confirm your service principal is included.
2. GraphQL API permission: In the GraphQL API item’s Manage permissions, grant the service principal Run Queries and Mutations.
3. Underlying data access: Check the API’s connection mode. With SSO, the service principal needs appropriate access to the underlying data source. With saved credentials, the identity used by the saved connection needs that access. The service principal still needs Execute permission on the GraphQL API.
4. Token and endpoint: The endpoint format you provided is consistent with the GraphQL API endpoint; use the URL copied from the API item. For client-credentials authentication, the documented scope is https://api.fabric.microsoft.com/.default. Delegated GraphQLApi.Execute.All permissions are for user-delegated access, not app-only client-credentials authentication.

If it still fails, please share the connection mode and sanitized HTTP status/response details. Please don’t share the access token or client secret.

References:

• Use service principals with Fabric API for GraphQL
• Connect applications to Fabric API for GraphQL

Thank you.

Hi harsh_chandra​ 

We would like to inquire whether have you got the chance to check the solutions provided by me and other users in community to resolve the issue. We hope the information provided helps to clear the query. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Hi v-csrikanth​ 

We are getting this error :

{
    "errors": [
        {
            "message": "The request to data source failed with authentication error. Ensure the access to data source is configured correctly.",
            "path": [
                "accounts"
            ],
            "extensions": {
                "code": "BadRequest"
            }
        }
    ],
    "data": null
}

I believe it is also related to graphQl API permission?

Thanks,
Harsh

Hi harsh_chandra​ 

Thanks for sharing the error details. This error points to authentication between the GraphQL API and its underlying data source, rather than simply a missing GraphQL Execute permission. The request is reaching the accounts resolver, but the API cannot successfully authenticate to the source.

Please check the connection mode configured for your GraphQL API:

1. If using Single sign-on (SSO): The calling service principal needs access to the underlying data source and the tables exposed by the API. For a lakehouse-backed API, verify access to its SQL analytics endpoint and the relevant Account table—not just the GraphQL item. Grant only the read permissions required for your query.
2. If using Saved credentials: Check the connection used by the API. Ensure its credentials are valid and that the configured identity can connect to the source and read the Account table. Reauthenticate or update the connection if needed. In this mode, granting the calling service principal direct source access is not the first fix; the saved connection is used to access the data.

Keep Run Queries and Mutations assigned to the calling service principal on the GraphQL API. However, that permission alone does not resolve a data-source authentication failure.

To isolate the issue, test access to the backing table using the same identity used for source access. A successful test in the Fabric editor under your personal account does not prove that the service principal or saved connection has equivalent access.

Please share the backing data-source type (lakehouse SQL analytics endpoint, warehouse, SQL database, etc.) and whether the API uses SSO or Saved credentials. These details will help identify the specific permission or connection setting to check. Please don’t share tokens, passwords, or client secrets.

Reference: Connect to a data source and build your GraphQL schema.

Thank you.

Hi harsh_chandra​ 

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. And, if you have any further query do let us know.

Thank you.