403 error message while trying to hit PBI API (I am able to get the token)

[TalIL87]

Hi All!

I am tryng to user the new service proncipal profile feature in order to publish datasets on multiple tenents using PBI API.

I created an app registration, Azure AD group for the service principal and enabled all the relevat settings on the PBI servce.

I am able to get the service principal access token, but when I trying to use in order to ge t create a new profile I am getting a 403 error.

I have using the trial PPU license.

I am attaching the request that I am sending to the API

(using python)

token = GetServicePrincipalToken(APIParam['TenantID'],APIParam['ClientID'],APIParam['ClientSecret'])
api_url = "https://api.powerbi.com/v1.0/myorg/profiles"
headers = {"Authorization": f"Bearer {token}"}

payload = {"displayName": "My First Profile"}

response = requests.request("POST",api_url, json=payload, headers=headers)
#response = json.loads(response.text)
print(response)

I repreformed the entire procees of creating the Azure app registration, AD groups setting PBI service and took screenshot sthrought the entre prcess.

I used 2 guides: The full and official Microsoft guide on this link 

and the Youtube video on guy in a cube "Service principal 101" 

Link to Screenshot that I took throguht the entire proccess 

Appriciate the help, Tal

[Swetha__Balusam]

Hi, I am using Power BI trial account. Using service principal to get the token to access power BI apis. I get the token and when I access the API https://api.powerbi.com/v1.0/myorg/datasets, I get the error {
"Message": "API is not accessible for application"
} with 403 error. Can you please help me on this?

[waqas_ahmed]

To get the access token for service principal profile, you have to use the following endpoint:

https://login.microsoftonline.com/<<tenant_id>>/oauth2/token 

The following 4 parameters should be passed to the body:

• grant_type = client_credentials
• client_id = Application (client) ID
• client_secret = client secret value from Azure app
• resource = https://analysis.windows.net/powerbi/api

Sample request from postman:

[mshmordok]

https://community.powerbi.com/t5/Developer/REST-API-Get-Access-Token/m-p/1895937#:~:text=Every%20por....

[mshmordok · Accepted solution]

The AAD token you are generating in

GetServicePrincipalToken

is not set with the right audience 
make sure the token you are using is with the right audience for powerbi API's "https://analysis.windows.net/powerbi/api"

[TalIL87]

Thank you! can you please refer me to the the documantion which explain how to generate the token usingthe https you mentioned?

Thank you, Tal

[mshmordok]

1. Did you manage to make any other calls to PowerBI with the specified App  
For example try to call 
https://docs.microsoft.com/en-us/rest/api/power-bi/groups/create-group 
If not that could indicate some miss configuration os your app or the aquired token 

2. Try to enable the Profiles feature to the entire org and see if that solve the problem 

3. If issue still not resolved then add the requestId from the Create Profile API 403 reponse to this thread so we can try track the failure

[TalIL87]

Hi! Thanks for the response

first, I want to check. Can I use the Service principal and the API with PPU or do I need premium capacity?

I turned all 3 settings to "The entire organization"

I send the request below and got the 403. I also tried using postman

Request ID: 88398de2-d060-4b65-997d-a821d44f36c4

(got the ID from Postman, not using the code below)

import requests
import json
from config import APIParam
from GetServicePrincipalToken import GetServicePrincipalToken




token = GetServicePrincipalToken(APIParam['TenantID'],APIParam['ClientID'],APIParam['ClientSecret'])
api_url = "https://api.powerbi.com/v1.0/myorg/groups?workspaceV2=True"
headers = {"Authorization": f"Bearer {token}"}

payload = {"name": "Sample workspace V2"}

response = requests.request("POST",api_url, json=payload, headers=headers)
#response = json.loads(response.text)
print(response)