Hi,
We're running into an issue we were hoping you would be able to assist with.
In PowerBI we have the following table, named MONTHLYDATA:
| Date | Client | Field1 | Field2 | Field3 | Field4 |
| 01-01-2024 | A | 1 | 1 | 1 | 1 |
| 01-01-2024 | B | 2 | 2 | 2 | 2 |
| 01-01-2024 | C | 3 | 3 | 3 | 3 |
We want to expose this data via API, namely via the POST https://api.powerbi.com/v1.0/myorg/groups/{{group-id}}/datasets/{{-dataset-id}}/executeQueries endpoint.
This table contains data of multiple different clients. We want those clients to access their data, and ONLY their data. As such, we've set up a proof of concept where we have enabled RLS (Row-level security) in PowerBI desktop on this table, where RoleA on this filter may only access rows where Client = A. Consequently, in the browser app we've assigned a test user directly to RoleA. This test user's account has also been directly onboarded in the workspace, in the viewer role.
In the browser app of PowerBI this works, in the sense that in the report the user can only view the row with Client = A. The semantic model cannot be viewed at all.
However, if we try to call the above API, using a valid bearer token and the following POST body:
{
"queries": [
{
"query": "EVALUATE VALUES(MONTHLYDATA)"
}
]
}
We're getting a 404 Not found with the following response body:
{
"error": {
"code": "PowerBIEntityNotFound",
"pbi.error": {
"code": "PowerBIEntityNotFound",
"parameters": {},
"details": [
{
"code": "DetailsMessage",
"detail": {
"type": 1,
"value": "You cannot query the dataset '{{dataset-id}}' by using the REST API because the dataset was not found or you do not have the required permissions. Please contact a workspace admin or a dataset owner to grant you the required permissions. See https://go.microsoft.com/fwlink/?linkid=2190204 for more info on required permissions."
}
}
]
}
}
}
We've tried adding an impersonatedUserName to the body as well, without success.
If we remove the user from the role, but leave the rest as is, then the endpoint will again return all data in the table above, so as far as we know the scopes have been set correctly (this is also seen in the token, since Dataset.Read.All is present under scp).
The documentation on this subject:
https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/execute-queries
https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/execute-queries-in-group
https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-manage-access-permissions
https://learn.microsoft.com/en-us/power-bi/developer/embedded/datasets-permissions#row-level-securit...
Indicates that enabling RLS in the API should be possible. According to the semantic model settings of the semantic model where MONTHLYDATA is part of, the user in question has Workspace Viewer access.
Our question is now: what are we missing? And is it even possible to enable RLS via the API?
Many thanks in advance.
