Unable to access any Power BI API using VSCode Rest Client without getting a 403 error

[IainColledge]

Hi,

I would be greatful for any help on a problem we have, we're wanting to use Power BI Embedded but to prototype the calls we're using the Rest Client extension in VSCode. 

We have a service principle set up, this successful calls the APIs under graph.microsoft.com and management.azure.com by getting an azure AD V2 token.

This service principle will not be using delegated authorisation. It's been set up in a security group (PowerBiGroup) as per instructions.

Under Power BI we have a PPU user as an admin user and in the Power BI admin portal they have enabled:

• Tenant settings -> Developer -> Embed content in apps -> PowerBiGroup
• Tenant settings -> Developer -> Service principles can use Fabric APIs -> PowerBiGroup
• Tenant settings -> Developer -> Allow service principals to create and use profiles -> PowerBiGroup
• Tenant settings -> Admin API settings -> Service principals can access read-only admin APIs -> PowerBiGroup

There is a workspace and the PowerBiGroup have been added as an admin.

Despite these settings I can auth fine, get a bearer token but every API call I make fails with a 403, I've tried:

• GET https://api.powerbi.com/v1.0/myorg/groups
• GET https://api.powerbi.com/v1.0/myorg/admin/groups?$expand=dashboards&$top=100
• POST https://api.powerbi.com/v1.0/myorg/RefreshUserPermissions
• GET https://api.powerbi.com/v1.0/myorg/profiles
• GET https://api.powerbi.com/v1.0/myorg/reports
• GET https://api.powerbi.com/v1.0/myorg/availableFeatures
• POST https://api.powerbi.com/v1.0/myorg/profiles

Using the format:

GET https://api.powerbi.com/v1.0/myorg/groups
Authorization: bearer {{$aadV2Token appOnly}}

Apart from the MS documentation and various posts out there I've also watched this tutorial https://www.youtube.com/watch?v=3RidKdK2KOM as well as cloned the github repo to show various calls.

Please can anoyone help as this is very frustrating as we eventually want to use Power BI embedded for customers but have spent a long time trying to get service principles to work in any capacity.

[IainColledge · Accepted solution]

Found the problem:

GET https://api.powerbi.com/v1.0/myorg/groups
Authorization: bearer {{$aadV2Token appOnly}}

Should be:

GET https://api.powerbi.com/v1.0/myorg/groups
Authorization: Bearer {{$aadV2Token appOnly}}

The other Azure REST APIs don't complain with using "bearer", the Power BI APIs fail without "Bearer".

[IainColledge]

Power BI studio works with a local Power BI user.

Delegated API calls work as well.

[lbendlin]

Have you considered using ready made tools?

Release of Power BI Studio v2.0 (VSCode extension) – Gerhard Brueckl on BI & Data

[IainColledge]

Thank you, that is something to look at, even just to see APIs are accessible.

This is more about how to learn the API behavior so we can automate later in an app etc.