Can I update Row-level security via Rest API?

[annafan]

Can I update Row-level security via Rest API?

How can I do that?

[d_gosbell · Accepted solution]

If you mean can you add users to an RLS role you defined in the pbix file, then the answer is yes,

You can get a list of the roles in a specified report with a call like

http://localhost/reports/api/v2.0/PowerBIReports(1fe72f5d-5cce-43c2-905b-fe699ed9a46a)/DataModelRoles

You would use the /DataModelRoleAssignments endpoint

eg.

http://localhost/reports/api/v2.0/PowerBIReports(1fe72f5d-5cce-43c2-905b-fe699ed9a46a)/DataModelRoleAssignments

You would do a GET request to get the all the current users in your RLS roles, then you would post back a new array with any new users added (or remove users who should no longer have access). Note that this array will replace the entire list of users.

The following would add user1 and user2 to a specific role.

[
    {
        "GroupUserName": "user1",
        "DataModelRoles": [
            "ef5680de-2218-4c40-b308-831ce3d108b4"
        ]
    },
    {
        "GroupUserName": "user2",
        "DataModelRoles": [
            "ef5680de-2218-4c40-b308-831ce3d108b4"
        ]
    }
]

[d_gosbell · Accepted solution]

Power BI Report Server uses Windows Authentication by default. I know in PowerShell you can just use the -UseDefaultCredentials switch of the Invoke-RestMethod cmdlet to send the windows credentials. You will have to search for something like "python rest api windows authentication" in google or bing for information on how to do this in Python - it probably depends on what rest module you are using.

[d_gosbell · Accepted solution]

If you mean can you add users to an RLS role you defined in the pbix file, then the answer is yes,

You can get a list of the roles in a specified report with a call like

http://localhost/reports/api/v2.0/PowerBIReports(1fe72f5d-5cce-43c2-905b-fe699ed9a46a)/DataModelRoles

You would use the /DataModelRoleAssignments endpoint

eg.

http://localhost/reports/api/v2.0/PowerBIReports(1fe72f5d-5cce-43c2-905b-fe699ed9a46a)/DataModelRoleAssignments

You would do a GET request to get the all the current users in your RLS roles, then you would post back a new array with any new users added (or remove users who should no longer have access). Note that this array will replace the entire list of users.

The following would add user1 and user2 to a specific role.

[
    {
        "GroupUserName": "user1",
        "DataModelRoles": [
            "ef5680de-2218-4c40-b308-831ce3d108b4"
        ]
    },
    {
        "GroupUserName": "user2",
        "DataModelRoles": [
            "ef5680de-2218-4c40-b308-831ce3d108b4"
        ]
    }
]

[melanid]

Hi @d_gosbell ,

I am not able to make it work, do you know if the API was deleted? 

Thanks.

[d_gosbell]

---

@melanid wrote:

I am not able to make it work, do you know if the API was deleted? 

---

No, It's definitely still there as a documented API. What do you mean by "not able to make it work" - are you getting an error message of some sort? If so can you share more about what you are attempting to do and what error you are getting?

[melanid]

Hi,

Thanks for your response! 

I tried to use it like you describe (I want to retrieve the list of configured RLS for a specific dataset) : http://localhost/reports/api/v2.0/PowerBIReports(DATASETID)/DataModelRoles 

But in my case, we have PowerBI Pro Licences, does it only work with on-premise licences?  

Thanks

[d_gosbell]

---

@melanid wrote:

does it only work with on-premise licences?  

---

Yes, this forum is dedicated to the on-prem Report Server. 

The only way to update RLS on the service using an API is via the XMLA endpoint and you need a premium license for that.

[hpdev]

Hi d, 

What XMLA endpoint is that? I have a premium license and would like to try it. What does it look like calling it? Does that work for PowerBI online? Thanks!

[d_gosbell]

---

@hpdev wrote:

Hi d, 

What XMLA endpoint is that? I have a premium license and would like to try it. What does it look like calling it? Does that work for PowerBI online? Thanks!

---

If you have a premium capacity or premium per user workspace you would need to enable the endpoint for read/write (see Semantic model connectivity and management with the XMLA endpoint in Power BI - Power BI | Microsoft... ) and you can get the xmla endpoint address from the workspace settings under "License Info" and it's listed as the "Connection Link"

Then you can use a script similar to the following example to update a role.

Uses the XMLA endpoint to add a user to a role for a Power BI dataset (github.com)

[kshukla6]

Can we do this by using Power shell cmdlets directly without using powerbi REST API?

[annafan]

Thanks a lot.

I can use chrome to get the response.

But when I try to use python requests to get, I met 401, I guess it was unauthorized.

Do you know how can I pass my account and pwd via Rest API?

[d_gosbell · Accepted solution]

Power BI Report Server uses Windows Authentication by default. I know in PowerShell you can just use the -UseDefaultCredentials switch of the Invoke-RestMethod cmdlet to send the windows credentials. You will have to search for something like "python rest api windows authentication" in google or bing for information on how to do this in Python - it probably depends on what rest module you are using.

[hpdev]

Does this work for PowerBI online? I assume PowerBI report server is the local version correct?

[annafan · Accepted solution]

Thanks a lot.

I found the python way. I'd like to share the pkg and code with everyone.

import json

import requests

from requests_ntlm import HttpNtlmAuth

url = ''

data = []

oauth = HttpNtlmAuth('domain\\account','pwd')

r = requests.put(url, data=json.dumps(data), auth=oauth)

print (r.text)