Forum Discussion
Get 403 in Postman trying to GenerateToken or List Group/Reports after getting access token
Thanks, v-ljerr-msft. My problem was not that. Actually I just figured out my problem with Azure AD support, so let me share it here. Hopefully it can benefit others. The reason for the 403 was because the Power BI account I used was an internal domain account, and at Microsoft only corp account can share content with Pro license, not internal domain account. The 403 forbidden was right, but I wish it indicated why. I did scratch my head for quite a while.
The lesson to learn here is because I was able to get the access token using Postman, that indicated the Auth URL and Token URL were working for me. The Power BI API end point was not working, and that indicated app permission issue.
Also because I was doing "app owns data", I should have registered my app as Native App, not Server Side/Web App, even though I was going to embed my reports inside a web app. This was very confusing and counter-intuitive. I needed to give interactive consent for the user/service account I was using. This was a one time set up, after which my app was able to get both access token and the embed token, embed URL, etc.
Microsoft EmployeeHi Aarush
Did you make sure in Power BI admin portal that service principals are allowed in your tenant? Did you add your service principal to the relevant workspaces wih Viewer/Member role?
If most cases when you get an error response from Power BI the message body contains more information on the error that might be helpful.
AmosHersch - Thanks for your reply, Yes I have alreday added service principal users into workspace as admin. Also, with this 403 error code, I am not getting any error message in response body, so no clue what access is missing. Let me know if need any details further.
Below are steps I have followed , let me know if you see I'm missing anything here.
1) Created Azure AD app and gave Power BI service deletgaed permissions to this app.
2) Retrieve access token using client id and secret as below.
3) Then token recieved form step 2, used as authrozation header and passed to power bi rest api service in post man client as below.
- AmosHersch
Aarush I can't say for sure what's missing, but I might be able to help if you can provide the request ID from the header of the response message.
AmosHersch - Thanks for your reply. I was able to resolve it.
The resolution is, I was using oauth 2.0 V1 end point for token generation which was giving 403 when being used with Power BI rest api, but when I tried oauth 2.0 V2 end point to generate tojen , it worked.
I would really be happy, if some kind of error message was thrown in response body to troubleshoot this, but this resolution may help for other users if they fall into similar issue.