Error 401 When Using Update Report Content REST API Download This File Option Greyed Out

[VanThuan]

Hello,

I have a Power BI Service report where the "Download this file" option is greyed out. We have investigated this issue thoroughly and reviewed all known limitations, but none seem to apply in our case.

As an alternative, I attempted to use the Update Report Content REST API to copy the report to an empty one with the same dataset, located in the same workspace. However, this attempt resulted in a 401 error.

For your reference, this code works correctly when both the source and target reports have the download option enabled.

Could you please assist us in understanding why the Python code below doesn't work if one of the reports is non-downloadable and how to resolve the 401 error with the API?

Licence : PPU

Workspace: PPU

permission of our principal service:

Error:

401 {"error":{"code":"PowerBINotAuthorizedException","pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}}}

 

Code:

import requests
 
# === CONFIG ===
CLIENT_ID = ""
CLIENT_SECRET = ""
TENANT_ID= ""
 
# Power BI resource scope
SCOPE = "https://analysis.windows.net/powerbi/api/.default"
 
# Example: Update report content API
GROUP_ID = ""
REPORT_ID = ""
 
# === 1. Get access token ===
token_url = f"https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token"
 
payload = {
    "grant_type": "client_credentials",
    "client_id": CLIENT_ID,
    "client_secret": CLIENT_SECRET,
    "scope": SCOPE
}
 
resp = requests.post(token_url, data=payload)
resp.raise_for_status()
access_token = resp.json()["access_token"]
print("Authenticated")
 
# === 2. Define request body ===
body = {
  "sourceReport": {
    "sourceReportId": "",
    "sourceWorkspaceId": ""
  },
  "sourceType": "ExistingReport"
}
 
# === 3. Make POST request ===
url = f"https://api.powerbi.com/v1.0/myorg/groups/{GROUP_ID}/reports/{REPORT_ID}/UpdateReportContent"
 
headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type": "application/json"
}
 
r = requests.post(url, headers=headers, json=body)
print(r.status_code, r.text)

[Anonymous]

Hi @VanThuan,

Thanks for reaching out to the Microsoft fabric community forum. The 401 isn’t related to the Download this file setting. You’re calling the API with the client credentials flow (service principal), but in your app registration the Power BI Service permissions shown are Delegated (e.g., Report.ReadWrite.All, Dataset.ReadWrite.All, Content.Create). Delegated permissions aren’t used with client credentials, so the token doesn’t carry the app roles required by UpdateReportContent, and Power BI returns PowerBINotAuthorizedException. As @ibarrau and @vojtechsima both responded to your query, kindly confirm if you got the chance to look into their responses and check if your issue can be resolved.

I would also take a moment to thank @ibarrau and @vojtechsima, for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.

If I misunderstand your needs or you still have problems on it, please feel free to let us know.  

Best Regards,
Hammad.

[Anonymous]

Hi @VanThuan,

As we haven’t heard back from you, so just following up to our previous message. I'd like to confirm if you've successfully resolved this issue or if you need further help.

If yes, you are welcome to share your workaround so that other users can benefit as well.  And if you're still looking for guidance, feel free to give us an update, we’re here for you.

Best Regards,

Hammad.

[vojtechsima]

Hey, @VanThuan ,

Make sure you have the security group with your registrated app in Allowed users to run APIs in Admin Portals, also, to avoid conflicts, you can remove the other permissions, since you already have Tenant.ReadWriteAll which allows you to do literally everything.

Admin portal settings, similar to this, either your security group or the principal itself:

[VanThuan]

thank you, I'll try and keep you informed

[ibarrau]

Hi. I don't think there is a limitation for that request related to not being able to download it. Something to take a look is access. Usually a 401 in Power Bi Rest API means that the Service Principal doesn't have permission at the Workspace of the report. Make sure the App Registered for this is a member of the workspace of the report you want to update.

I hope that helps,

[VanThuan]

Thank you very much. my code works fine now. The Service Principal should be member of those workspaces

[VanThuan · Accepted solution]

I checked this. The service principal is correctly assigned the Contributor role on the workspace, and the code works fine for other reports in the same workspace. That suggests the non-downloadable Power BI report is somehow restricting access to this specific report. It’s odd.

[ibarrau]

Ok. You can try using simplepbi library or MSAL for auth with microsoft library. It could be an issue with the token too.

When I have developed the library I wrote something different for the auth.

POWER_BI_RESOURCE_ENDPOINT = "https://analysis.windows.net/powerbi/api"
MICROSOFT_OAUTH2_API_ENDPOINT = "https://login.microsoftonline.com/" + tenant_id + "/oauth2/token/"
try:
    url = MICROSOFT_OAUTH2_API_ENDPOINT #is this different?
    body = {
        "grant_type":"client_credentials",
        "client_id":power_bi_client_id,
        "client_secret":power_bi_secret,
        "resource":POWER_BI_RESOURCE_ENDPOINT            
    }
    headers = {
        "Content-Type": "application/x-www-form-urlencoded"
    }
    r = requests.post(url = url, data = body, headers = headers)
    access_token = r.json().get('access_token')
    self.token = access_token
except requests.exceptions.HTTPError as ex:
    print(ex)

There is a header for the auth to get the token and the body doesn't need scope.

I hope that helps,

[VanThuan]

Thank you. I'll try it and keep you informed