Get admin access to personal workspace through REST API

Update:

I took the advice of a couple commenters and tried going down the PowerShell route with the "Add-PowerBIWorkspaceUser" command, but had no success. I tried both options for the -Scope parameter, along with several combinations of the other parameters and nothing worked.

I also looked up other forum posts specifically about performing this task through PowerShell instead of the API, and it was a mixed bag of answers on whether or not it's possible. I couldn't find anyone saying they got it to work, only one or two people saying it should work if the OP changes this, that, and the other thing.

However, I did find a way to do it via API call... just not with any of Microsoft's documented REST API endpoints.

I found the API endpoint by running Fiddler to trace my system traffic then clicking on the "Get Access" button for a personal workspace in the Power BI admin settings GUI. The below API call was being used to perform the action of adding an admin to the personal workspace. I was able to recreate and successfullY call this API in Postman and in a C# desktop app by adding the headers shown.

Method: PUT

Url: 

https://wabi-west-us-d-primary-redirect.analysis.windows.net/metadata/admin/workspaces/~WorkspaceId~/adminAccess

Headers (Key : Value):

• Authorization : Bearer ~XXXXXX~
• Referer : https://app.powerbi.com
• Origin : https://app.powerbi.com
• X-PowerBI-HostEnv : Power BI Web App
• X-PowerBI-User-Admin : True

To generate a bearer token that works with this API call, I used PowerShell. Start with the "Connect-PowerBIServiceAccount" command and log in with an account that has Power BI administrator rights. Then use the "Get-PowerBIAccessToken -AsString" command to generate the bearer token and show it as an output in the PowerShell terminal.

I'm guessing there's no guarantee this method will work indefinitely since it's not one of their supported REST API endpoints, but it's getting the job done for now.

One last note, doing it this way should be the same as doing it through the GUI where it will automatically revoke your access after 24 hours. But in case you want the equivalent of clicking the "Remove access" button in the GUI, you can just change the API call from a PUT to a DELETE. The URL and all the headers can stay the same. This was also found through a Fiddler trace, and tested in Postman and my C# app.