Forum Discussion
Power Bi Rest Api App Endpoints
I want to use the power bi rest api to query the app to get the lists of reports. I would like to not use a username and password to retrieve a token to do this.
That's not something you do with the app. You need to call the Group/Workspace endpoint for that.
I understand that and we do that for other use cases. However, this use case is to only get reports that are associated to an app. I'd also like to leverage a service principal to call the api endpoint.
I understand this functionality is not allowed and I am very interested to know why. As I said before, people are assigning an admin user to the app and using their credentials to retreive information about the app. That seems like a very bad practice and I am curious to know why this is the accepted route.I am of the opposite opinion. I consider service principals to be "very bad practice" as you completely lose the auditability. You will have no idea who to yell at when things go pear shaped.
The service principal is merely polling from an app. There is nothing that could go pear shaped because the only authorization bit you can assign is read access to a service principal. Users, who are viewing the app's reports in a different form on a website, have their own RLS, permissions, and identity management with auditing invovled. I am not interested in leaking a credential that could risk PHI loss.
I'm trying to understand why a service principal cannot access a domain's endpoints. I have found,
https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=7f91faef-43f4-45b4-bbb6-80ca1fd8a627, which means we cannot embed the app. Our options are pretty limited unless we forgo the app and create something custom on our end, to forgo a service principal, which goes against a lot of the domains on the power bi rest api.