System.AuraHandledException: Script-thrown exception while calling the Power BI REST API from apex

A 401 Unauthorized from the Power BI REST API almost always indicates that the access token is either invalid for the endpoint or doesn't contain the required permissions.

A few things to verify:

1. Endpoint
   The POST https://api.powerbi.com/v1.0/myorg/GenerateToken endpoint is not the standard endpoint for embedding reports. The endpoint depends on what you're trying to generate a token for.

   For a report, the typical endpoint is:

   POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId}/GenerateToken

   If you're using the top-level /GenerateToken endpoint, confirm that it matches your embedding scenario and API version.

2. Validate the access token
   Decode the Microsoft Entra ID access token (for example, using jwt.ms) and verify:

   • aud = https://analysis.windows.net/powerbi/api

   • The token hasn't expired.

   • The token contains the required delegated scopes or application roles.

3. API permissions
   Ensure your Microsoft Entra application has the appropriate Power BI API permissions (such as Report.Read.All, Dataset.Read.All, or Report.ReadWrite.All, depending on your scenario), and that admin consent has been granted where required.

4. Embedding prerequisites
   Verify that:

   • The report exists.

   • The workspace ID and report ID are correct.

   • The authenticated user or service principal has access to the workspace.

   • If using a service principal, ensure "Allow service principals to use Power BI APIs" is enabled in the Power BI Admin Portal and that the service principal has been granted access to the workspace.

5. Capture the full response
   Even if response.getBody() is null in Apex, log:

   • Response headers

   • WWW-Authenticate header (if present)

   • Response status

   • Correlation/Request IDs (ActivityId or RequestId)

   These are extremely useful for diagnosing authentication failures with Microsoft support.

If you can share:

• Whether you're using a delegated user or a service principal,

• The exact endpoint you're calling,

• And how you're acquiring the Entra ID token,

it will be much easier to pinpoint the root cause.