Forum Discussion
Airflow Job: Run a DAG using API
Hi mmmall,
Thank you for the response. Based on the screenshot here looks like the Fabric portal is calling the Airflow API using a session cookie, not a bearer token. Because of this internal authentication flow, it is not possible to reproduce the same call externally using a client-credentials token or any token we generate ourselves.
Currently fabric does not provide a public API to directly trigger a DAG inside an Apache Airflow Job, that is why your direct API calls fail even with a valid token.
The only supported approach is to trigger a Fabric item for example like a Notebook or Pipeline using the Fabric REST API and run the logic there.
Thanks and regards,
Anjan Kumar Chippa
Hello Anjan,
When grabbing the powerBIAccessToken from Developer tools - Console, we are able directly use the Airflow API, in example below simply to list all DAGs:
curl -X 'GET' 'https://aeexxxxxxxxxxxxxx.northcentralus.airflow.svc.datafactory.azure.com/api/v1/dags?limit=100&only_active=true' \
-H 'accept: application/json' \
-H "Authorization: Bearer [TOKEN_GOES_HERE]"
But we were unable to generate a token that behaves the same way as the powerBIAccessToken. We always get a 302 Found (which sounds like a redirect to login page) when using our own token. Below is a sample of how we tried to generate a token, using a client_id & client_secret (App registration) that has permissions in below image as per documentation.
import msal
tenant_id = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"
client_id = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"
client_secret = "G63xxxxxxx"
authority = f"https://login.microsoftonline.com/{tenant_id}"
app = msal.ConfidentialClientApplication(
client_id,
authority=authority,
client_credential=client_secret
)
scopes = ["https://analysis.windows.net/powerbi/api/.default"]
token_response = app.acquire_token_for_client(scopes=scopes)
print("Bearer token:", token_response["access_token"])
Hi mmmall,
Here the reason your MSAL token does not work because it’s being created for the Power BI API not for the Airflow API. The token you see in developer tools works because it is issued specifically for the Airflow resource in Fabric. So to fix this, please follow below steps:
- Decode the working token and check the value under aud, that shows the correct resource.
- In your MSAL script, replace the scope with that value followed by /.default, for example like scopes = ["https://<your-airflow-host>/.default"]
- Run the script again to get a new token and use that in your curl call.
This way the generated token will match what fabric expects and your Airflow API calls will work same like they do with the PowerBIAccessToken.
Thanks and regards,
Anjan Kumar Chippa
Hello Anjan,
I did that before sending the previous message. The scope I see by decoding PowerBIAccessToken token is the one I've used (
Hi mmmall,
Thank you for the response. Even though the PowerBIAccessToken shows the power bi audience when you decode it, but this might not be the same token that the Fabric portal is actually sending to the Airflow API
This error with your token indicates that the token you generated is not valid for the Airflow resource. To get the correct audience, the only way is to capture the actual request the portal makes to the Airflow endpoint:
- Open Developer Tools --> Network
- Perform the action that hits the Airflow API like for example listing DAGs
- Find the actual request to the Airflow url and look at its Authorization header.
- Copy that token from that request’s Authorization header and decode it at jwt.ms
If you use this token, the Airflow API call will work the same way it does in the portal.
Thanks and regards,
Anjan Kumar Chippa
Hello Anjan,
Have you been trying out your proposed solutions, before proposing them - Do they work for you? Here if I try to do that, it apparently uses a Cookie instead, which is not a JWT decodable token.