Forum Discussion
created a custom connector to call a API using oauth: received 403 as response.
Hi Team,
I want to call an API hosted azure from my powerBI workspace since that data is needed in our dashboards, we need an auth token to call the API, a curl to that API would look like this
`curl -X GET "tempurlfORAPI" -H "Accept: application/json" -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6InlFVXdtW...."`
can you please suggest what are the ways we can implement this in powerBI.
Hi aykhandelwal,
Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to vojtechsima, for his inputs on this thread.
From your description, it looks like you are trying to call an Azure-hosted API from Power BI using OAuth authentication. Since you’re getting a 403 (Forbidden) response, it typically indicates that the token being used doesn’t have the right permissions or configuration to access the API.
To resolve this, you will need to ensure your Azure AD app registrations and Power BI connector are correctly set up for OAuth2. Here are the steps might be helpfulExpose your API in Azure AD: In the Azure Portal, go to App registrations → your API app → Expose an API. Define an App ID URI (e.g., api://<your-api-client-id>) and add a scope (for example, api.read).
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apisRegister your Power BI client app: Create (or use an existing) App registration for Power BI. Under API Permissions, add delegated permission to your API (e.g., api.read). Grant admin consent so that Power BI can use this token to access your API.
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apisIn your custom connector, configure OAuth2 using:
authorization_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize" token_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token" scope = "api://<your-api-client-id>/.default"
This ensures Power BI requests a valid token from Azure AD and sends it automatically in the Authorization header.Reconnect to your API from Power BI Desktop, sign in using your Azure AD credentials, and try refreshing the data.
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.Thank you for using the Microsoft Fabric Community Forum.
10 Replies
- vojtechsimaSuper User
Hey, aykhandelwal ,
of course, allow me to citate my blog where I covered this:
https://www.vojtechsima.com/post/api-authentication-in-power-querylet // Build the request body as a record with necessary parameters for the token request requestBodyQuery = [ grant_type = "<grant_type>", // The type of grant being requested (e.g., client_credentials) client_id = "<client_id>", // Your application's client ID client_secret = "<client_secret>", // Your application's client secret scope = "<scope>" // The scope of access you're requesting ], // Convert the request body to a URL-encoded string required for the POST request requestBodyContent = Text.ToBinary(Uri.BuildQueryString(requestBodyQuery)), // Make the HTTP POST request to the token endpoint request = Json.Document( Web.Contents( "url", // Replace with the base URL of the token endpoint [ RelativePath = "relativePath", // Replace with the specific path for the token endpoint Headers = [ #"Content-Type" = "application/x-www-form-urlencoded" // Specify the content type for URL-encoded data ], Content = requestBodyContent // Include the URL-encoded body in the request ] ) ), accessToken = request[access_token] // Retrieves the "access_token" field from the JSON response in accessTokenThis is a template for your OAuth2, once you retrieve the Bearer token, you can do this:
let request = Json.Document( Web.Contents( "url", [ RelativePath = "relativePath", Headers = [ Authorization = "Bearer acess_token" ] ] ) ) in requestIn your case it can look like this:
let request = Json.Document( Web.Contents( "https://onefleetapi.azurewebsites.net", [ RelativePath = "api/v2/labs", Headers = [ Authorization = "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6InlFVXdtW....", Accept = "application/json" ] ] ) ) in request
you changed the manuaal Bearer Token to the response from OAtuh2 access token field. - aykhandelwalMicrosoft Employee
I tried to follow the above, i haven't used the client secret tough since i am using the Microsoft's official Power BI client ID that's pre-registered in Azure AD.
rest everything is almost same. and added above the response received from the API call.
- vojtechsimaSuper User
Well, aykhandelwal ,
I am not sure how else you get access to it without creating a registered app (service principal).In Power BI you also have to set up the Connection to use Anonymous credentials.
- aykhandelwalMicrosoft Employee
hey, the API i want to call is already registered in Azure, do i have to crearte a new app in Azure for powerBI to use that as a client for calling that API?
- v-kpoloju-msftCommunity Support
Hi aykhandelwal,
Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to vojtechsima, for his inputs on this thread.
From your description, it looks like you are trying to call an Azure-hosted API from Power BI using OAuth authentication. Since you’re getting a 403 (Forbidden) response, it typically indicates that the token being used doesn’t have the right permissions or configuration to access the API.
To resolve this, you will need to ensure your Azure AD app registrations and Power BI connector are correctly set up for OAuth2. Here are the steps might be helpfulExpose your API in Azure AD: In the Azure Portal, go to App registrations → your API app → Expose an API. Define an App ID URI (e.g., api://<your-api-client-id>) and add a scope (for example, api.read).
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apisRegister your Power BI client app: Create (or use an existing) App registration for Power BI. Under API Permissions, add delegated permission to your API (e.g., api.read). Grant admin consent so that Power BI can use this token to access your API.
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apisIn your custom connector, configure OAuth2 using:
authorization_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize" token_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token" scope = "api://<your-api-client-id>/.default"
This ensures Power BI requests a valid token from Azure AD and sends it automatically in the Authorization header.Reconnect to your API from Power BI Desktop, sign in using your Azure AD credentials, and try refreshing the data.
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.Thank you for using the Microsoft Fabric Community Forum.
- aykhandelwalMicrosoft Employee
hey v-kpoloju-msft , i was able to make the connector work in my local, now i want to publish the connector so that it's available within my teams workspace. how can i do it? any recommendations?
- v-kpoloju-msftCommunity Support
Hi aykhandelwal,
Thank you for the follow-up question.Glad to hear you got the connector working locally. To make the custom connector available for others in your team or workspace, you will need to certify or deploy it through your organization’s Power BI environment. If your goal is for all team members to use it within Power BI Service, the connector must be deployed as an organizational data connector via a gateway.
You can copy the .mez file (custom connector) to your On-premises data gateway’s custom connectors folder, enable it in the Power BI Service, and make sure “Allow user-defined connectors” is turned on in the gateway settings.
For a wider rollout, your admin can also certify and distribute the connector across the tenant through Power BI Desktop or Fabric integration. This ensures other users can easily connect without manually configuring credentials.You can review the setup guidance in the following docs for step-by-step instructions:
1. https://learn.microsoft.com/en-gb/power-bi/connect-data/service-gateway-custom-connectors
2. https://learn.microsoft.com/en-gb/power-query/handling-authentication#custom-connectorsThank you for using the Microsoft Fabric Community Forum.