System.AuraHandledException: Script-thrown exception while calling the Power BI REST API from apex

[YashMoroliya]

Hello Team,

I am integrating Salesforce with the Power BI REST API.

I have an Apex method named getPowerBiReportToken that receives a Microsoft Entra ID access token and uses it to call the following Power BI REST API endpoint:

POST https://api.powerbi.com/v1.0/myorg/GenerateToken

I am setting the Authorization header with the Bearer access token.

However, when the API is invoked:

• The HTTP status code returned is 401 (Unauthorized).

• The response body is null.

• The exception surfaced in Apex is:
  System.AuraHandledException: Script-thrown exception

Has anyone encountered this issue before?

Could you please help me understand:

• Is the endpoint I am using correct for generating a Power BI report token?

• What could cause a 401 Unauthorized response with a null response body?

• Are there any prerequisites or permissions that I should verify?

Any guidance would be greatly appreciated.

Thank you.

[v-csrikanth]

Hi @YashMoroliya 

We would like to inquire whether have you got the chance to check the solutions provided by @Prince0011  in commiunity to resolve the issue. We hope the information provided helps to clear the query. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Thank you.

[v-csrikanth]

Hi @YashMoroliya 

We wanted to follow up and check whether you've had a chance to review the solutions shared by @Prince0011 regarding your issue. We hope the information provided helps address your query.

Should you have any further questions, please feel free to reach out to the Microsoft Fabric Community we're always happy to help.

Best regards,
Srikanth Cheri
CST team.

[Prince0011 · Accepted solution]

A 401 Unauthorized from the Power BI REST API almost always indicates that the access token is either invalid for the endpoint or doesn't contain the required permissions.

A few things to verify:

1. Endpoint
   The POST https://api.powerbi.com/v1.0/myorg/GenerateToken endpoint is not the standard endpoint for embedding reports. The endpoint depends on what you're trying to generate a token for.

   For a report, the typical endpoint is:

   POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId}/GenerateToken

   If you're using the top-level /GenerateToken endpoint, confirm that it matches your embedding scenario and API version.

2. Validate the access token
   Decode the Microsoft Entra ID access token (for example, using jwt.ms) and verify:

   • aud = https://analysis.windows.net/powerbi/api

   • The token hasn't expired.

   • The token contains the required delegated scopes or application roles.

3. API permissions
   Ensure your Microsoft Entra application has the appropriate Power BI API permissions (such as Report.Read.All, Dataset.Read.All, or Report.ReadWrite.All, depending on your scenario), and that admin consent has been granted where required.

4. Embedding prerequisites
   Verify that:

   • The report exists.

   • The workspace ID and report ID are correct.

   • The authenticated user or service principal has access to the workspace.

   • If using a service principal, ensure "Allow service principals to use Power BI APIs" is enabled in the Power BI Admin Portal and that the service principal has been granted access to the workspace.

5. Capture the full response
   Even if response.getBody() is null in Apex, log:

   • Response headers

   • WWW-Authenticate header (if present)

   • Response status

   • Correlation/Request IDs (ActivityId or RequestId)

   These are extremely useful for diagnosing authentication failures with Microsoft support.

If you can share:

• Whether you're using a delegated user or a service principal,

• The exact endpoint you're calling,

• And how you're acquiring the Entra ID token,

it will be much easier to pinpoint the root cause.