PowerBIRestAPI Connector(MEZ) : failing with Invalid Credential

[RajCZ]

I have two Semantic models(both using PowerBIRESP API via MEZ file) , Connector(MEZ file) is setup on Gateway server..

one model needs admin permission on PowerBI API and another model doesn't need. both are setup 100% same way, only difference is one pulling Power BI metadata that needs admin permission.

while refreshing, "admin" one failing with "Invalid Credential"

Connector(MEZ file) is setup on Gateway server.

Now different credentials are here

1. Service principal and client secret are saved inside connector to be used by M Code.
2. We have added credentials on Power Bi Gateway connection while creating a gateway connection that is used by Semantic models to use gateway.
3. User’s credentials who manually logged to Power bi and hit model refresh button.
4. Power BI Service/user account used to login on gateway

IF Model returns “Invalid credentials", then what credentials are invalid. What is role of each credential. if Power bi query needs admin permission, which one out of four should have admin permission.

[SaiTejaTalasila]

Hi @RajCZ ,

Please share more details -You can't connect directly to rest API endpoint without using connector?

What is your data source?

Thanks,

Sai Teja 

[rajendraongole1]

Hi @RajCZ -In this setup with multiple layers of credentials, understanding the role of each credential is key to resolving the "Invalid Credential" error. Here's how each credential is typically used and which one requires admin permissions:

Service Principal and Client Secret in Connector (MEZ file):

These credentials are used by the PowerBIREST API to authenticate requests made by the M code in Power BI. This is where the admin permissions are likely required, especially if one of the models is retrieving Power BI metadata that needs elevated access.
If you encounter an "Invalid Credential" error specifically on a model that pulls metadata, check that the Service Principal has the necessary API permissions in the Azure portal. You may need to assign the Service Principal admin permissions on the Power BI Service, particularly for read access to metadata through the API.
Credentials in Power BI Gateway Connection:

These credentials are associated with the Gateway connection in the Power BI Service. They allow Power BI to communicate with the Gateway server to access on-premises data sources.
While these credentials typically don’t need admin permissions on the Power BI API, they must have sufficient permissions to access the resources the Gateway is configured to reach. This credential layer should be correctly set up on the Gateway but doesn’t typically control API-specific permissions.
User’s Credentials Used for Manual Refresh:

When a user manually triggers a refresh in Power BI, their credentials are used to authenticate the refresh operation. If they don't have access to specific resources (like restricted Power BI API calls), the refresh can fail.
The user account may need admin privileges if they are refreshing data from an API that requires admin access.
Power BI Service Account Used to Log In to the Gateway:

This account is generally used only for logging into the Gateway interface and configuring it within the Power BI Service. It does not affect the refresh credentials or the permissions for data access directly.

Ref Links:

How to use a service principal in Power BI Admin REST APIs in Power Automate - Forward Forever

Admin - Get Capacities As Admin - REST API (Power BI Power BI REST APIs) | Microsoft Learn