Using Fabric Restful API to Manage item permission

[jovialttu19]

I am wandering is a way to use Fabrc Restful API to manage item permission such as add a user to have read permission to a Lakehouse or API for GraphQL?

[nilendraFabric · Accepted solution]

Hello @jovialttu19 

Microsoft Fabric’s REST API currently has limited official support for managing granular item-level permissions like adding users to Lakehouses or GraphQL APIs.

Try these endpoints, I haven't tried these personally and these are not documented 

POST https://<region-redirect>.analysis.windows.net/metadata/access

GET https://<region-redirect>.analysis.windows.net/m/access/artifacts/<item-id>

The `POST /metadata/access` endpoint is used to grant permissions (e.g., ReadAll for Lakehouses).
• The `GET /m/access/artifacts/{item-id}` endpoint retrieves existing permissions for an item

To use these endpoints, your Entra ID app must have:
• Delegated permissions: `Item.ReadWrite.All`
• Workspace access: The service principal needs at least `Contributor` role in the target workspace

Let me know if this works 

[v-pnaroju-msft]

Hi jovialttu19,

We are following up to see if your query has been resolved. Should you have identified a solution, we kindly request you to share it with the community to assist others facing similar issues.

If our response was helpful, please mark it as the accepted solution and provide kudos, as this helps the broader community.

Thank you.

[v-pnaroju-msft]

Hi jovialttu19,

We wanted to check in regarding your query, as we have not heard back from you. If you have resolved the issue, sharing the solution with the community would be greatly appreciated and could help others encountering similar challenges.

If you found our response useful, kindly mark it as the accepted solution and provide kudos to guide other members.

Thank you.

[v-pnaroju-msft]

Hi jovialttu19,

We have not received a response from you regarding the query and were following up to check if you have found a resolution. If you have identified a solution, we kindly request you to share it with the community, as it may be helpful to others facing a similar issue.

If you find the response helpful, please mark it as the accepted solution and provide kudos, as this will help other members with similar queries.

Thank you.

[v-pnaroju-msft · Accepted solution]

Thankyou @nilendraFabric for your response.

Hi @jovialttu19,

Thank you for reaching out to the Microsoft Fabric Community Forum.

Based on my research, the Microsoft Fabric REST API offers limited official support for managing granular item-level permissions. The available official endpoint, Resolve Item Permissions, allows retrieval of permissions for the authenticated principal but does not support assigning permissions.

For permission management, it is advisable to use the Microsoft Fabric portal, which provides a user-friendly interface for assigning roles and permissions to users. You may refer to the following link for detailed guidance on the permission model and management:

Permission model - Microsoft Fabric | Microsoft Learn

We recommend staying updated on API developments by regularly checking the Microsoft Fabric REST API documentation for any official updates regarding permission management.

Additionally, please refer to the following links for further information:

Workload Control - Resolve Item Permissions - REST API (Workload Development) | Microsoft Learn
Microsoft Fabric REST API references - Microsoft Fabric REST APIs | Microsoft Learn

If you find our response helpful, kindly mark it as the accepted solution and provide kudos. This will assist other community members with similar queries.

Thank you.

[nilendraFabric · Accepted solution]

Hello @jovialttu19 

Microsoft Fabric’s REST API currently has limited official support for managing granular item-level permissions like adding users to Lakehouses or GraphQL APIs.

Try these endpoints, I haven't tried these personally and these are not documented 

POST https://<region-redirect>.analysis.windows.net/metadata/access

GET https://<region-redirect>.analysis.windows.net/m/access/artifacts/<item-id>

The `POST /metadata/access` endpoint is used to grant permissions (e.g., ReadAll for Lakehouses).
• The `GET /m/access/artifacts/{item-id}` endpoint retrieves existing permissions for an item

To use these endpoints, your Entra ID app must have:
• Delegated permissions: `Item.ReadWrite.All`
• Workspace access: The service principal needs at least `Contributor` role in the target workspace

Let me know if this works