Forum Discussion
URL, Scope and Grant_type to use when creating a PBI REST API access_token?
Hi ericOnline ,
Please refer to this thread:
Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thanks for the response, however the Service Principal is listed as "Admin" in both the Workspace and Dataset. What I need is: Which token URL, Grant_type and Scope to use when requesting a token based on Client_id and Client_secret.
Please advise.
- KarenL73 years agoAdvocate V
Hi ericOnline
Was your issue ever resolved?
V-lianl-msft I have very similar issue I have successfully brought back the token correctly now using a script provided by one of your team but I am now getting
The only thing I am missing in my script is "Scope" as I am unsure what to use?
This is the post for reference
https://community.powerbi.com/t5/Desktop/Refreshable-Token-for-Admin-Rest-API/m-p/3152512#M1065083
This is the script I used from the above post
let //get token url = "https://login.microsoftonline.com/xxxxxxx/oauth2/token", GetJson = Web.Contents( url, [ Headers = [ Accept = "application/json", ContentType = "application/x-www-form-urlencoded" ], Content = Text.ToBinary( "grant_type=client_credentials& client_id=xxxxxxx& client_secret=xxxxxxx& scope=xxxxxx" ) ] ), token = Json.Document(GetJson)[access_token], //other api usage wiht above token Result = Web.Contents( "https://xxxxx.xxx.com", [ Headers = [ #"Content-Type" = "application/json", Authorization = "Bearer " + token, RelativePath = "/xxxxx/xxxxx" ] ] ) in Result
Do I need to add anything else to the script apart from the scope?
Thanks
Karen
- bcoderra3 years agoNew Member
I struggled for a few days with the forbidden (403) error and it turned out that I had the App registration correct. What I needed to do was to call the scope correctly in get_token. I was passing ".default" and then I read a thread where it recommended to change it to
"https://analysis.windows.net/powerbi/api/.default". In one application what I wanted Dataset.ReadWrite.All, I sent the required scope as"https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All". Apparently when you just send ".default" as scope Azure AD just looks for those scopes within Graph API. When you send the whole URL it gets you the right scope and my Forbidden error went away.Hope this helps!