AccessToken is generated but not valid for API calls (in Python)

[Anonymous]

Dear Community,

I create an access token in Python using the below code:

import adal
import requests

application_id = "9f9439fd-4150-46c4-bxxxxxxx"
application_secret = "xxxx"
resource_url = "https://analysis.windows.net/powerbi/api"

authority_url = 'https://login.windows.net/common'
# AUTHORITY = "https://login.microsoftonline.com/513294a0-3e20-41b2-a970-6d30bf1546fa"

# first you need to authenticate using adal
context = adal.AuthenticationContext(authority=authority_url,
                                     validate_authority=True,
                                     api_version=None)

token = context.acquire_token_with_client_credentials(resource_url, application_id, application_secret)
accessToken = token['accessToken']

 The code works fine! I get a proper access token. But if I do some REST API calls like this:

#get datasets

url = "https://api.powerbi.com/v1.0/myorg/datasets"
headers = {
    'authorization': 'Bearer ' + accessToken,
    'Content-Type': 'application/json'
}


r = requests.get(
    url=url,
    headers=headers
)
print(r)

I receive the below error:

<Response [401]>

which is an authentication error. 

In Azure active directory I have created a multi-tenant application, so I use that client_id and secret.

I believe there is somewhere in Azure AD, something should be fixed. 

Does anyone have insight into why this token is not accepted?? (If I generate a token in Powershell, the API returns <Response [200]>, so I'm confused) 

Regards,

Majid 

[Jayendran]

Hi @Anonymous ,

I think you are using the SPN (Service Principal) Approach which needs to provide client id and client secret.

Changes you have to made. 

• Change the Authority url to tenant specific not common. SPN won't work with common endpoint. - See this dotnet C# example reference
• You are calling Get Datasets API end point which is nothing but all the datasets in the My Workspace. Currently the SPN has limitation that it won't work for "My Workspace" it will only work for other worksapces.

E.g, you have to call https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets