403 error - Rest APIs - Registered App

[Anonymous]

Hello Community,

I need guidance with the following as I've tried multiple avenues and I keep hitting a brick wall.

IT helpdesk within my organiastion have created an Azure AD App with the purposes of me using rest APIs. I have added the necessary permissions to the App for the end points I've tried to access. Added the service principal account to the workspace I'm testing the app through.

I am using postman to test the rest APIs, I'm able to generate an auth token but I am getting 403 error when trying to access the REST APis.

Please help!

[lbendlin]

use jwt.io to check the scope of your token.  Most likely the required permissions are not in the token.

[Anonymous]

Thank you for your response.

I've used 0jwt.io as advised. After checking documentation on https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference. it appears there was no line for 'scp' which I understand to be the scope you're referring to.

I've double checked with helpdesk on which permissions the app currently has:

User.Read
Dashboard.Read.All
Dataset.Read.All
Report.Read.All
Report.ReadWrite.All
Tenant.Read.All
Workspace.Read.All

The rest api I'm trying to access is https://api.powerbi.com/v1.0/myorg/groups/[MyworkspacEnteredHere]

and needs Report.ReadWrite.All or Report.Read.All

Is this enough information to advise where the fault lies?

[lbendlin]

The app registration seems to have been done incorrectly. You need to see the requested permissions in the "scp" section. Ask them to try again.