Forum Discussion

jbauti10's avatar
jbauti10
Advocate I
5 months ago

401/403 on sempy + Power BI REST API refresh endpoint when notebook is triggered via Service

Hello, I'm running a PySpark notebook in Microsoft Fabric that does two things: Syncs a semantic model's TMSL definition against a warehouse schema using the Fabric updateDefinition API Triggers ...
CICD
V-yubandi-msft's avatar
V-yubandi-msft
Community Support
5 months ago

Hi jbauti10 ,

Thank you for sharing the details. The behavior might be related to the token scope used when the notebook runs under a Service Principal, since Power BI REST APIs require a token scoped for

https://analysis.windows.net/powerbi/api. If the notebook retrieves a Fabric scoped token instead, it may result in 401/403 errors.

 

Also, you mentioned a reference link in your post. Unfortunately, I don’t seem to have access to that content from my side. If possible, could you please share the relevant details or a publicly accessible reference so we can review it further.

 

In the meantime, these Microsoft docs might be helpful.
Datasets - Refresh Dataset In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

 

If the issue persists, please let us know.

jbauti10's avatar
jbauti10
Advocate I
5 months ago

Hello V-yubandi-msft 

 

Thank you for your reply. 

 

I am indeed already using a token scoped for the Power BI API:

token = mssparkutils.credentials.getToken("https://analysis.windows.net/powerbi/api")

headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json",
}

This token is used for both Fabric REST API and Power BI REST API calls, but the 401/403 only occurs on the Power BI REST API endpoints. The Fabric REST API calls succeed with the same token.

 

Regarding the reference link: it explains that older versions of semantic-link route workspace resolution through Power BI endpoints (/groups) while using a Fabric-scoped token internally, causing the mismatch. Upgrading to semantic-link >= 0.12 resolves that specific issue.

 

I was able to work around the problem by:

  • Passing the workspace ID directly as a pipeline parameter using @pipeline().DataFactory instead of resolving it via sempy.
  • Removing the refresh call from the notebook entirely and replacing it with a Semantic Model Refresh Activity in the pipeline after the schema sync step taken place in the notebook.

Both workarounds avoid the problematic Power BI REST API call from within the notebook context.

 

That said, I'm still curious why a token explicitly scoped to https://analysis.windows.net/powerbi/api — acquired via mssparkutils.credentials.getToken — fails on Power BI endpoints when the notebook submitter is a Service Principal. Any insights on why this is happening would be very helpful.

 

Thanks!