Permissions required for OData access projects

[Frede]

I am using OData to connect to Azure DevOps projects to retrieve work items and related items. I am unable to use the Analytical views as that do not allow me to get link types such as successor/predecessor which I need for my report. 

A general working query looks like this:

= OData.Feed("https://servername/{organization}/{project}/_odata/v4.0-preview/WorkItems?" & "$filter=(Project/ProjectName eq 'project name')" & "&$select=WorkItemId,Title,WorkItemType,State,TagNames" & "&$expand=Links(" & "$select=LinkTypeName;" & "$expand=TargetWorkItem($select=WorkItemType,WorkItemId,Title,State)" & ")", null, [Implementation="2.0", OmitValues=ODataOmitValues.Nulls, ODataVersion=4])

Howevery I want to access several projects in my reports so I omit the project parameter from the query like this. This is the exact query as above but is excluding {project} from the query:

= OData.Feed("https://servername/{organization}/_odata/v4.0-preview/WorkItems?" & "$filter=(Project/ProjectName eq 'project name')" & "&$select=WorkItemId,Title,WorkItemType,State,TagNames" & "&$expand=Links(" & "$select=LinkTypeName;" & "$expand=TargetWorkItem($select=WorkItemType,WorkItemId,Title,State)" & ")", null, [Implementation="2.0", OmitValues=ODataOmitValues.Nulls, ODataVersion=4])

For whatever reason this is not working against any organization where I am not an organization admin. If I am not an admin I get

a yellow exclamation mark and the error "Expression.Error: Access to the resource is forbidden." in Power Query Editor. I have tried this with both on-premise and power bi service.

However I created an .onmicrosoft account (making me the owner and admin of the organization) and quickly setup a board and then the above query was working fine, of course with modified servername/organization parameters. 

The issue seem to be with expanding the links section as the following query that targets multiple projects work fine even when I am not an admin

= OData.Feed("https://servername/{organization}/_odata/v4.0-preview/WorkItems?" & "$filter=(Project/ProjectName eq 'project name')" & "&$select=WorkItemId,Title,WorkItemType,State,TagNames", null, [Implementation="2.0", OmitValues=ODataOmitValues.Nulls, ODataVersion=4])

I am also able to expand e.g. AreaPath when querying multiple projects (also without being an admin). It does not matter if I filter for projects that i am 100% sure I have access to or all projects in the filter section, the same error occurs if I am not admin

It's  weird that I am able to list work items across projects without being an admin bit it's not possible to expand links. Why is that? 

Can you give som guidance on exactly what permissions that I need to have at the organization level to be able to successfully query multiple projects like the example above. It cannot be required to be an admin of a project just to extract work item data, right?

[Frede]

Thanks a lot for your reply, I was able to get things working after filtering for project in the expand clauses as well

My OData.Feed query now looks like this.*

= OData.Feed ("https://{organization}/_odata/v3.0-preview/WorkItems?"        
        &"$filter=(Project/ProjectName eq 'Project1' OR Project/ProjectName eq 'Project2')"  
        &"&$select=WorkItemId,Title,WorkItemType,State,TagNames "
        &"&$expand=Area($select=AreaPath), "
                &"Links( "
                    &"$select=LinkTypeName; "
                    &"$expand=TargetWorkItem($select=WorkItemType,WorkItemId,Title,State;$filter=Project/ProjectName eq 'Project1' OR Project/ProjectName eq 'Project2') "
                &") "
    ,null, [Implementation="2.0",ODataVersion = 4])

So now I am querying all project, but filtering for specific projects in the 2 expand sections. Ensure that you have permission to the projects that are included in the filter.

[Frede]

I forgot to mention that I do have permissions to all projects that I include in my filter statement and they do not have links to projects to which I do not have access. If there was a permission issue I would expect to have issues when including the projectname in the OData query like this, but there is not and that works OK, it's just when omitting the project name that it does not work. 

= OData.Feed("https://servername/{organization}/{project}/_odata/v4.0-preview/WorkItems?" &

[v-cgao-msft · Accepted solution]

Hi @Frede ,

If you are querying multiple projects, you should limit the query to the projects you have access to. Also, specify the project filter in the $expand clause if your expansion could include data in other, potentially inaccessible projects.
OData Analytics query guidelines - Azure DevOps | Microsoft Learn

It’s crucial to ensure that the appropriate permissions are set correctly to maintain the security and integrity of your data. Always follow your organization’s guidelines when requesting additional permissions.

About permissions and security groups - Azure DevOps | Microsoft Learn

Best Regards,
Gao
Community Support Team

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

How to get your questions answered quickly --  How to provide sample data in the Power BI Forum -- China Power BI User Group