Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Find everything you need to get certified on Fabric—skills challenges, live sessions, exam prep, role guidance, and more. Get started

Reply
adrienma
Regular Visitor

API 'Get Report In Group' with invalid 'groupId' returns 200 instead of 404

I am doing some tests with the PowerBI API and I observed something unexpected.

 

I am using the route "Get Report in Group" (https://learn.microsoft.com/en-us/rest/api/power-bi/reports/get-report-in-group) to fetch details about a report present in a specific Power BI workpace.

However, in some cases it seems that the workspace id is not validated, and the request will execute successfully even if the requested workspace is not the correct one, or does not even exist.

i.e in this URL https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId} "groupId" can be set to any value such as "None" or "null" or "abcdefg", and the report details will be present in the response.

 

I understand that it may be related with how my request is authentified with a service principal that has read access on all reports. But still, I would expect the request to fail with error 404 if an invalid "groupId" is used in the request. This could also be a security issue, if the client application relies on the workspace id validation to restrict the access to a subset of reports.

1 REPLY 1
m-colbert
Resolver II
Resolver II

@adrienma 

 

This is interesting. I use the API a lot and have a whole laundry list of issues that need to be addressed, I have not found the right channel for reporting these issues that can any attention by Microsoft.  I'm confident that when posted here, only the community responds. And when reported as a bug, I get an attempt for workaround solutions from Mindtree, but rarely if ever an acknowledgement of a bug that should be fixed and submitted to the backlog to hopefully be addressed. 

 

What you have illustrated above seems like is a bug. Other similar calls don't work if you provide the incorrect workspace (group) id. 

 

When it comes to security, the service principal is granted access to use the admin api's (through the tenant admin settings) but only the read-only methods. If you are not using an admin method, then the service principal needs to be at least a viewer/contributor of the workspace to read information.  Since Get Report in Group is not an admin API, I assume your service principal has workspace access? Is that true?

 

I know that if I try to read data like dataset refreshes and the service principal is not part of the workspace, then I get a not authorized error. It's a shame the REST API can be very powerful, but I find it riddled with bugs and inconsistencies. Especially when it come to data lineage.

Helpful resources

Announcements
Europe Fabric Conference

Europe’s largest Microsoft Fabric Community Conference

Join the community in Stockholm for expert Microsoft Fabric learning including a very exciting keynote from Arun Ulag, Corporate Vice President, Azure Data.

Power BI Carousel June 2024

Power BI Monthly Update - June 2024

Check out the June 2024 Power BI update to learn about new features.

RTI Forums Carousel3

New forum boards available in Real-Time Intelligence.

Ask questions in Eventhouse and KQL, Eventstream, and Reflex.