Forum Discussion

aykhandelwal's avatar
aykhandelwal
Microsoft Employee
9 months ago
Solved

created a custom connector to call a API using oauth: received 403 as response.

Hi Team, 

I want to call an API hosted azure from my powerBI workspace since that data is needed in our dashboards, we need an auth token to call the API, a curl to that API would look like this

 

`curl -X GET "tempurlfORAPI" -H "Accept: application/json" -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6InlFVXdtW...."`

 

can you please suggest what are the ways we can implement this in powerBI. 

  • Hi aykhandelwal,

    Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to vojtechsima, for his inputs on this thread.

    From your description, it looks like you are trying to call an Azure-hosted API from Power BI using OAuth authentication. Since you’re getting a 403 (Forbidden) response, it typically indicates that the token being used doesn’t have the right permissions or configuration to access the API.

    To resolve this, you will need to ensure your Azure AD app registrations and Power BI connector are correctly set up for OAuth2. Here are the steps might be helpful

    Expose your API in Azure AD: In the Azure Portal, go to App registrations → your API app → Expose an API. Define an App ID URI (e.g., api://<your-api-client-id>) and add a scope (for example, api.read).
    https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis

    Register your Power BI client app: Create (or use an existing) App registration for Power BI. Under API Permissions, add delegated permission to your API (e.g., api.read). Grant admin consent so that Power BI can use this token to access your API.
    https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis

    In your custom connector, configure OAuth2 using:

    authorization_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize"
    token_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token"
    scope = "api://<your-api-client-id>/.default"
    


    This ensures Power BI requests a valid token from Azure AD and sends it automatically in the Authorization header.

    Reconnect to your API from Power BI Desktop, sign in using your Azure AD credentials, and try refreshing the data.

    Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.

    Thank you for using the Microsoft Fabric Community Forum.

10 Replies

  • Hey, aykhandelwal ,

    of course, allow me to citate my blog where I covered this:
    https://www.vojtechsima.com/post/api-authentication-in-power-query

     

    let
        // Build the request body as a record with necessary parameters for the token request
        requestBodyQuery = [
            grant_type = "<grant_type>", 
            // The type of grant being requested (e.g., client_credentials)
    
            client_id = "<client_id>",
            // Your application's client ID
    
            client_secret = "<client_secret>", 
            // Your application's client secret
    
            scope = "<scope>"                   
            // The scope of access you're requesting
        ],
        
        // Convert the request body to a URL-encoded string required for the POST request
        requestBodyContent = Text.ToBinary(Uri.BuildQueryString(requestBodyQuery)),
        
        // Make the HTTP POST request to the token endpoint
        request = Json.Document(
            Web.Contents(
                "url", // Replace with the base URL of the token endpoint
                [
                    RelativePath = "relativePath", // Replace with the specific path for the token endpoint
                    Headers = [
                        #"Content-Type" = "application/x-www-form-urlencoded" // Specify the content type for URL-encoded data
                    ],
                    Content = requestBodyContent // Include the URL-encoded body in the request
                ]
            )
        ),
        
        accessToken = request[access_token] // Retrieves the "access_token" field from the JSON response
    in
        accessToken

     

    This is a template for your OAuth2, once you retrieve the Bearer token, you can do this:

    let
        request = Json.Document(
            Web.Contents(
                "url",
                [
                    RelativePath = "relativePath",
                    Headers = [
                        Authorization = "Bearer acess_token"
                    ]
                ]
            )
        )
    in
        request

    In your case it can look like this:

    let
        request = Json.Document(
            Web.Contents(
                "https://onefleetapi.azurewebsites.net",
                [
                    RelativePath = "api/v2/labs",
                    Headers = [
                        Authorization = "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6InlFVXdtW....",
                        Accept = "application/json"
                    ]
                ]
            )
        )
    in
        request



    you changed the manuaal Bearer Token to the response from OAtuh2 access token field.

  • aykhandelwal's avatar
    aykhandelwal
    Microsoft Employee

    I tried to follow the above, i haven't used the client secret tough since i am using the Microsoft's official Power BI client ID that's pre-registered in Azure AD.

    rest everything is almost same. and added above the response received from the API call.

    • vojtechsima's avatar
      vojtechsima
      Super User

      Well, aykhandelwal ,
      I am not sure how else you get access to it without creating a registered app (service principal).

      In Power BI you also have to set up the Connection to use Anonymous credentials.

      • aykhandelwal's avatar
        aykhandelwal
        Microsoft Employee

        hey, the API i want to call is already registered in Azure, do i have to crearte a new app in Azure for powerBI to use that as a client for calling that API?

  • Hi aykhandelwal,

    Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to vojtechsima, for his inputs on this thread.

    From your description, it looks like you are trying to call an Azure-hosted API from Power BI using OAuth authentication. Since you’re getting a 403 (Forbidden) response, it typically indicates that the token being used doesn’t have the right permissions or configuration to access the API.

    To resolve this, you will need to ensure your Azure AD app registrations and Power BI connector are correctly set up for OAuth2. Here are the steps might be helpful

    Expose your API in Azure AD: In the Azure Portal, go to App registrations → your API app → Expose an API. Define an App ID URI (e.g., api://<your-api-client-id>) and add a scope (for example, api.read).
    https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis

    Register your Power BI client app: Create (or use an existing) App registration for Power BI. Under API Permissions, add delegated permission to your API (e.g., api.read). Grant admin consent so that Power BI can use this token to access your API.
    https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis

    In your custom connector, configure OAuth2 using:

    authorization_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize"
    token_uri = "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token"
    scope = "api://<your-api-client-id>/.default"
    


    This ensures Power BI requests a valid token from Azure AD and sends it automatically in the Authorization header.

    Reconnect to your API from Power BI Desktop, sign in using your Azure AD credentials, and try refreshing the data.

    Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.

    Thank you for using the Microsoft Fabric Community Forum.

    • aykhandelwal's avatar
      aykhandelwal
      Microsoft Employee

      hey v-kpoloju-msft , i was able to make the connector work in my local, now i want to publish the connector so that it's available within my teams workspace. how can i do it? any recommendations?

      • v-kpoloju-msft's avatar
        v-kpoloju-msft
        Community Support

        Hi aykhandelwal,
        Thank you for the follow-up question.

        Glad to hear you got the connector working locally. To make the custom connector available for others in your team or workspace, you will need to certify or deploy it through your organization’s Power BI environment. If your goal is for all team members to use it within Power BI Service, the connector must be deployed as an organizational data connector via a gateway.

        You can copy the .mez file (custom connector) to your On-premises data gateway’s custom connectors folder, enable it in the Power BI Service, and make sure “Allow user-defined connectors” is turned on in the gateway settings.

        For a wider rollout, your admin can also certify and distribute the connector across the tenant through Power BI Desktop or Fabric integration. This ensures other users can easily connect without manually configuring credentials.

        You can review the setup guidance in the following docs for step-by-step instructions: 
        1. https://learn.microsoft.com/en-gb/power-bi/connect-data/service-gateway-custom-connectors 
        2. https://learn.microsoft.com/en-gb/power-query/handling-authentication#custom-connectors 

        Thank you for using the Microsoft Fabric Community Forum.