Forum Discussion
Government API 403 error: powerbi gcc endpoint api.powerbigov.us always return 403 error
To address my own inquiry, when dealing with GCC cloud customers, it's essential to engage in an interactive OAuth process to acquire the token; conventional username and password authentication is not supported. Furthermore, to obtain the correct access token, we must supply the Power BI resource ID, which differs from that of regular commercial users. In our specific situation, we must request permission from the resource located at "https://analysis.usgovcloudapi.net/powerbi/api". To ascertain the GCC endpoint and resource ID, Power BI offers a REST API. You can initiate a POST request to "https://api.powerbi.com/powerbi/globalservice/v201606/environments/[email protected]" to retrieve endpoint information for GCC cloud users.
Hi Liu Yang,
Thank you for your prompt response. The suggestion to add the scope parameter doesn't align with our specific scenario.
We utilized the endpoint "https://login.windows.net/common/oauth2/token" to acquire the token and designated "https://analysis.windows.net/powerbi/api" as the resource parameter for our API calls. In this context, the scope parameter isn't applicable, and attempts to add ".default" to the resource URL resulted in a "resource not found" error.
below is the sample code how we call the token api:
request(
{
json: true,
method: 'post',
url:'https://login.window.net/common/oauth2/token',
form: {
grant_type:'password',
resource:"https://analysis.windows.net/powerbi/api",
username: "username",
password: "password",
client_id: "client_id"
},
headers: {
"Content-Type": "application/x-www-form-urlencoded"
}
}, ProcessTokenResponse);Our objective is to access the GCC Power BI API from a public network, where there are no connectivity restrictions in place. Could you please advise if there are any specific configurations required on the GCC endpoint to allow connections from a public network?
Thanks!
Hello Liu Yang,
We have another question regarding the API call. Is there a need to assign a specific role to the user for the API call to work correctly? We examined the "wid" from the access token returned for our current user and noticed that it has a default role of "b79fbf4d-3ef9-4689-8143-76b194e85509."
Thanks!