REST API Get RLS details

[patpel96]

Hello, 
Through the Power BI REST API, I am trying to obtain all access given to users in the company. 

I have an overview of which users have access to which report, but some reports use RLS, and I want to show to which role(s) a user has access to. 

I found this endpoint: https://learn.microsoft.com/en-us/rest/api/power-bi/admin/workspace-info-get-scan-result#role
where you see the example response containing: 

"roles": [
            {
              "name": "Teams",
              "modelPermission": "Read",
              "members": [
                {
                  "memberName": "john@contoso.com",
                  "memberId": "ee96296b-fb71-4f65-a8af-c0ec5a7daced",
                  "memberType": "User",
                  "identityProvider": "AzureAD"
                },
                {
                  "memberName": "group@contoso.com",
                  "memberId": "0a1cdbc3-f82c-4001-8b96-be04ae9d25a3",
                  "memberType": "Group",
                  "identityProvider": "AzureAD"
                }
              ],
              "tablePermissions": [
                {
                  "name": "DW_Revenues DW_RevenuesTest",
                  "filterExpression": "[InTeams] = \"True\""
                }
              ]
            }
          ],

This is exactly the reponse that I am looking for. However, when runing the query myself, I don't get this response. "roles" is not even appearing in my overview... 

In my call to PostWorkspaceInfo, I use all parameters: https://api.powerbi.com/v1.0/myorg/admin/workspaces/getInfo?lineage=true&datasourceDetails=true&getA... 

Why is "roles" not showing in my response from GetScanResult? 

Thanks!

[DavidWong]

Hi Patpel,

1st Step in Admin Portal you need to enable 

1) Enhance admin APIs responses with detailed metadata
2) Enhance admin APIs responses with DAX and mashup expressions

2nd Step you need to add on parameter in the Admin - WorkspaceInfo PostWorkspaceInfo.
Parameter Setting: 

Then continue remaining steps: Admin - WorkspaceInfo GetScanStatus and Admin - WorkspaceInfo GetScanResult.

It works on myside to get the RLS data!

[Anonymous]

Hi, @patpel96 

Calling the GetScanStatus API before using GetScanResult, the verbose result appears to be generated by the ScanStatus API. You may need to implement a polling step to wait for the scan status to Successful. Use the REST API Admin - WorkspaceInfo GetScanStatus to get the scan status. Once the status is Success, you can use the GetScanResult API to get the scan results for the specified scan. You can check the following link:

Solved: API - Admin - WorkspaceInfo GetScanResult is not r... - Microsoft Fabric Community

Confirm that the dataset has been refreshed/republished to activate the scan API.The reason why you are not getting the expected results may be due to the permissions of the token you generated. You can check the following link:

Solved: Getting no pbi entity found error in rest api call - Power Platform Community (microsoft.com...

When you send a Power BI REST API request, it might arrive at a cluster that doesn't contain tenant data. In this case, the redirect request may fail due to a timeout. To fix the timeout exception, resend the request and set the preferClientRouting URL query parameter to true.

Troubleshoot Power BI REST APIs - Power BI | Microsoft Learn

How to Get Your Question Answered Quickly

Best Regards

Yongkang Hua

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[patpel96]

Hi @Anonymous 
Thanks for your elaborate response. Unfortunately, I haven't managed to 

My workflow: 
Make POST call to: https://api.powerbi.com/v1.0/myorg/admin/workspaces/getInfo?lineage=true&datasourceDetails=true&getArtifactUsers=true&datasetSchema=true&datasetExpressions=true

Reponse: 

{
    "id": "xxxxxxx-xxxx-xxxx-xxxx-9822ea41c460",
    "createdDateTime": "2024-07-15T08:32:16.4022468Z",
    "status": "NotStarted"
}

Then I make a GET request to: https://api.powerbi.com/v1.0/myorg/admin/workspaces/scanStatus/xxxxxxx-xxxx-xxxx-xxxx-9822ea41c460

Response: 

{
    "id": "xxxxxxx-xxxx-xxxx-xxxx-9822ea41c460",
    "createdDateTime": "2024-07-15T08:32:16.403",
    "status": "Succeeded"
}

Then I make a GET request to: https://api.powerbi.com/v1.0/myorg/admin/workspaces/scanResult/xxxxxxx-xxxx-xxxx-xxxx-9822ea41c460

Here I get a long reponse with lots of information: 

...           
           "datasets": [
                {
                    "id": "xxxxxxx-xxxx-xxxx-xxxx-e23a1eaf739a",
                    "name": "Project Management",
                    "tables": [
                       ...
                    ],
                    "configuredBy": "johndoe@example.com",
                    "configuredById": "xxxxxxx-xxxx-xxxx-xxxx-80651f3cb81f",
                    "isEffectiveIdentityRequired": true,
                    "isEffectiveIdentityRolesRequired": true,
                    "refreshSchedule": {
                        ...
                    },
                    "targetStorageMode": "Abf",
                    "createdDate": "2024-05-21T13:06:11.277",
                    "contentProviderType": "PbixInImportMode",
                    "upstreamDataflows": [
                        ...
                    ],
                    "datasourceUsages": [
                        {
                            "datasourceInstanceId": "xxxxxxx-xxxx-xxxx-xxxx-d81f3362a287"
                        }
                    ],
                    "users": [
                        ...
                    ]
                }
            ],
...

Information with tables and column names, measures, but no information about the RLS...

This whole section is not appearing: https://learn.microsoft.com/en-us/rest/api/power-bi/admin/workspace-info-get-scan-result#role

Am I missing a setting somewhere? 

Your help is highly appreciated. Thanks!

[lbendlin]

Are you a tenant admin?

[patpel96]

Yes! I mean I can change admin settings in Power BI, create apps in Azure AD and allocate users to security roles. So I believe I should have all the access.