Power BI API export returns 403 for semantic models while dataflow backup succeeds

[Tejashvi_Singh]

Hello Microsoft Support Team,

I need help investigating a Power BI API behavior in our backup automation.

Summary

• We can successfully authenticate and list workspace inventory.
• Dataflow backup succeeds across multiple workspaces.
• Semantic model PBIX export fails with HTTP 403 in the same workspaces.

Observed behavior

• Endpoint used for semantic model export:
  /v1.0/myorg/groups/{workspaceId}/reports/{reportId}/Export?downloadType=IncludeModel&preferClientRouting=true
• Response for semantic model exports:
  HTTP 403 (consistently)
• Dataflows in the same workspace are downloaded successfully using:
  /v1.0/myorg/groups/{workspaceId}/dataflows and /dataflows/{id}

Example run evidence

• Workspace count processed: 29
• Example workspace:
  Hofu City Hall
  workspaceId: 15be756d-47e9-42e8-842e-1f0cb65fd441
• Result:
  dataflows found/downloaded successfully
  semantic models all failed with HTTP 403
• Another workspace also had a transient timeout on dataflow listing, but the persistent blocker is semantic model export 403.

What we already validated

• Token refresh and authentication are working.
• Workspace and report discovery are working.
• Dataflows can be listed and exported successfully.
• We added retry logic for transient network/API errors.
• Semantic model export still returns 403 consistently.

Request
Please help confirm:

1. Required tenant settings for PBIX export via report Export API with IncludeModel.
2. Required licensing/capacity/workspace configuration for this export path.
3. Required permission scopes/roles for delegated token use.
4. Whether this endpoint is restricted for certain semantic model/report configurations.

If needed, I can provide:

• Full request/response headers (sanitized)
• Correlation IDs / Request IDs from failed responses
• Workspace IDs list used in this run
• Timestamped logs and status CSV outputs

Thank you.

[ibarrau]

Hi. 403 is usually refering to the api permission scope delegation. I know you said you have reviewed this, but there is a small thing I have seen before that can make a mistake.

You need both report and dataset permission:

And I say again Dataset, because you will see semantic model settings and that's not the same api. Report.ReadWrite.All or both Report.Read.All and Dataset.Read.All

Validate using get reports in group and get datasets in group. If both requests work, then the scope is ok.

In addition, remember that for .pbix reports, exporting a report is subject to the same limitation as downloading a report .pbix file.

As an alternative, you can download as project TMDL using simplepbi library. It uses semantic model and report permission delegation api instead of that one.

https://blog.ladataweb.com.ar/descargar-reporte-o-modelo-semantico-via-api-como-proyecto-tmdl/

I hope that helps