API authentication error on scheduled refresh

[Rabi]

I have a API feed that require API Key , Tenant and Report UUID.

Report ID goes in the base URL and API Key and Tenant in headers and this works fine in desktop but fails in service when scheduling refresh.

In service, I have set authentication to anonymous and public

let
Source = Json.Document(Web.Contents("https://api.csassurance.com/api/v2/reports/ReportUUIDHere/snapshot",

[Headers=[#"X-Api-Key"="APIHere", #"X-Tenant"="ABC"]]))

in

source

How can I resolve this ? Appreciate any help !!

Regards, 

[v-hashadapu]

Hi @Rabi , Thank you for reaching out to the Microsoft Community Forum.

Power BI Service handles Web.Contents differently than Desktop and often fails scheduled refresh when the full URL is embedded directly in the function. Keep the base domain static and move the endpoint into RelativePath, then configure the datasource in the Service as Anonymous. Your custom headers (X-Api-Key and X-Tenant) can still be passed in the Headers record.

After publishing, reconfigure the dataset credentials in the Service as Anonymous and set the privacy level to Organizational or Public. In most cases this resolves the refresh issue.

[Rabi]

Hi Everyone, 

Thanks for your suggestions I am still getting the exact same error;

I have used the following query, I also tried "https://api.csassurance.com" as a base URL.

let
    BaseUrl = "https://api.csassurance.com/",
    
    Source =
        Json.Document(
            Web.Contents(
                BaseUrl,
                [
                    RelativePath = "api/v2/reports/ReportUUIDHere/snapshot",
                    Headers = [
                        #"X-Api-Key" = "APIHere",
                        #"X-Tenant" = "ABC"
                    ]
                ]
            )
        )
in
    Source

 Thanks !

[v-hashadapu · Accepted solution]

Hi @Rabi , Your M query looks correct, so the issue is probably no longer the Web.Contents syntax itself. Since the error still occurs when creating the connection in the Service, Power BI is likely failing the datasource validation against the API endpoint rather than the refresh query.

Many APIs require the custom headers (X-Api-Key and X-Tenant) on every request, but Power BI Service test connection does not always include those headers during validation. Check whether the API root URL can be accessed without headers, if there are any firewall/IP restrictions blocking Power BI Service and whether Skip test connection can be enabled in your tenant/gateway settings. If the API only works when those headers are present, you may ultimately need a custom connector or gateway-based approach because some header-authenticated APIs do not validate cleanly with anonymous web connections in the Service.

Skip Test Connection for On-premises and Cloud Dat... - Microsoft Fabric Community

Implement test connection | Microsoft Learn

[oussamahaimoud]

Hi @Rabi,

Hope you're doing well!

Root Cause:

The issue is a known Power BI Service limitation: when using Web.Contents with hardcoded headers containing credentials, the gateway/refresh engine blocks or strips custom headers for security reasons, even with Anonymous authentication.

Solution:

Use the RelativePath + Query pattern with Web.Contents

Power BI Service requires Web.Contents to have a static base URL (evaluated at authoring time) with dynamic parts passed via RelativePath or Query. This is what allows the refresh to work correctly.

Rewrite your M query like this:

let

    BaseUrl = "https://api.csassurance.com",

    Source = Json.Document(

        Web.Contents(

            BaseUrl,

            [

                RelativePath = "api/v2/reports/ReportUUIDHere/snapshot",

                Headers = [

                    #"X-Api-Key" = "APIKeyHere",

                    #"X-Tenant" = "ABC"

                ]

            ]

        )

    )

in

    Source

Additional Steps in Power BI Service:

Go to Dataset Settings → Data Source Credentials

Set authentication to Anonymous

Set Privacy Level to None or Organizational (avoid "Private" as it can block requests)

Untick "Skip test connection" if it's ticked

If It Still Fails → Use a Custom Connector or Parameter-based approach

If headers are still being stripped, consider storing credentials in Power BI Parameters and referencing them — though for API keys the RelativePath fix above resolves it in the vast majority of cases.

Hope this helps! If OK don't forget to mark as solution and thumbs up, that's motivate me to keep helping 🙂 

[Ankit_Rai]

Hello
This happens because Power BI Service handles Web.Contents() authentication differently from Desktop.
Even though the API key is passed in headers, the Service often blocks scheduled refresh when the URL is treated as a dynamic data source.

The fix is usually to:

1. Keep the base URL static

2. Move the dynamic part into RelativePath

3. Set credentials to Anonymous

4. Avoid hardcoding changing URL segments directly in Web.Contents

Use this pattern instead:

let
    BaseUrl = "https://api.csassurance.com/",
    
    Source =
        Json.Document(
            Web.Contents(
                BaseUrl,
                [
                    RelativePath = "api/v2/reports/ReportUUIDHere/snapshot",
                    Headers = [
                        #"X-Api-Key" = "APIHere",
                        #"X-Tenant" = "ABC"
                    ]
                ]
            )
        )
in
    Source

Then in Power BI Service:

• Go to Dataset Settings

• Data source credentials

• Set authentication to:

  • Anonymous

  • Privacy level = Public (or Organizational)

This works because Power BI Service can validate a fixed root domain (https://api.csassurance.com/) during scheduled refresh. Directly embedding the full URL inside Web.Contents() often causes refresh failures in the Service even if Desktop works fine.