Forum Discussion
Embed Token Generation Successful, but 403 Forbidden on ExecuteQueries API
Hi KonradKolenda ,
Thanks for sharing the additional details. You are correct that the guidance recommends using a service principal for production apps and that the documentation indicates arbitrary strings can be used for RLS when generating embed tokens.
The executeQueries API examples are shown with Azure AD access tokens from a service principal or master user, and there does not seem to be a way to pass an arbitrary identity through that API call in the same way it is done when generating an embed token. This may explain why the combination of service principal, arbitrary usernames, and executeQueries is not working as expected.
Based on research and documentation, the executeQueries endpoint does not appear to support supplying an effective identity in the request body. That option is described only in the context of token generation for embedding. If the main requirement is enforcing RLS with non-AD usernames, embedding reports or using embed tokens may still be the supported approach. For programmatic queries, alternatives like XMLA endpoints could be considered, but those require valid AAD identities and do not accept arbitrary strings.
This seems to be a gap between the supported scenarios, and if this combination is critical for your use case it may be best to raise it through support ticket to confirm whether there is a way planned to enable it.
Hope this helps. Please reach out for further assistance.
Thank you.
Hi KonradKolenda ,
Thanks for posting your question in the Microsoft Fabric Community and for providing a clear explanation of your setup.
It seems that the executeQueries API may not work with embed tokens. Embed tokens are generally meant for embedding reports or dashboards, while running dataset query APIs such as executeQueries may require an Azure AD access token issued to a service principal or master user. This may be the reason you are seeing a 403 error when using an embed token.
Also, based on the documentation, embed tokens are described in the context of embedding reports, dashboards, and datasets in applications. The executeQueries API, on the other hand, is documented under dataset operations and the examples there use Azure AD tokens from a service principal or master user.
For reference, you can review the embed token documentation here:
https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/generate-token
And the executeQueries API reference here:
Datasets - Execute Queries - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Hope this helps. Please reach out for further assistance.
Thank you.