Forum Discussion
Unable to get the embed url from Get Report API
Hi. I understand. However, have you tried the get reports in group? I mean if you don't have issues with that one, that's because you must use it like that. The Get Report working with any report is a time bomb. The doc specify: "Returns the specified report from My workspace.". Some day it will stop working for you. I would strongly suggest using get report in group.
The best way would be creating a Service Principal and add it to the workspace. That would work as a service account to manage all this without an specific AD user.
I'm currently working like that, and it retrieves the EmbedURL without doing anything else. I can get it from get reports in group (all of the reports with embed in the group) or get report in group (one by one)
I hope that helps,
Hi. The security concern shouldn't be there. The Service Principal (service account) won't have access to everything. It only has access to the resources shared with the account. It will only see the workspaces in which the account has a role. The only way to make the Service Principal manipulate the admin API is with a special concent from the tenant settings that I assume you won't have because it can only be applied to a security group.
The 403 can also be due to permissions. Be sure the registered app has Report.ReadWrite.All or Report.Read.All
I hope that helps,
Hi ibarrau ,
Actually, I'm not in the workspace, so when I tried to get the report using Workspace ID and Report ID, I encountered 403 error as you mentioned, that's true. The fact is I'm able to use this API https://docs.microsoft.com/en-us/rest/api/power-bi/reports/get-report to get the report using Report ID only, even I'm now not in the workpsace, I wasn't able to do when I didn't access the report using the shared link for the first time.
As of now, whenver I open the report via the shared link https://app.powerbi.com/groups/ae53f177-de65-4dd3-9ccd-xxxxxx/reports/c0803633-5b6e-44de-b05e-xxxxxxxx/ReportSection3974bd03db63d3000028, it redirects me to a new link https://app.powerbi.com/groups/me/reports/c0803633-5b6e-44de-b05e-xxxxxxxx/ReportSection3974bd03db63d3000028, the group changes from GUID to me, which I guess I've been added to a workspace called me, so that's why I can use the API to get the result with Report ID only.
The requirement is to get the embed url and the load them inside our web page without asking the user opens the shared link on https://app.powerbi.com/ and I would like to understand why it happens in order to think of another solution if it's not doable (I can't find any explanation or documentation for this).
Thanks,
Nam.
Hi. I understand. However, have you tried the get reports in group? I mean if you don't have issues with that one, that's because you must use it like that. The Get Report working with any report is a time bomb. The doc specify: "Returns the specified report from My workspace.". Some day it will stop working for you. I would strongly suggest using get report in group.
The best way would be creating a Service Principal and add it to the workspace. That would work as a service account to manage all this without an specific AD user.
I'm currently working like that, and it retrieves the EmbedURL without doing anything else. I can get it from get reports in group (all of the reports with embed in the group) or get report in group (one by one)
I hope that helps,
Hello again, I've tried that and it returned 403 since I have been added to the workspace. I was trying to use a service account in order to get the report in the workspace, however, there was a security concern that the service was able to access all the reports, datasets, dashboards in the workspace. From your experience, are there any solutions to limit the service account to access certain reports it is assigned to?
Hi. The security concern shouldn't be there. The Service Principal (service account) won't have access to everything. It only has access to the resources shared with the account. It will only see the workspaces in which the account has a role. The only way to make the Service Principal manipulate the admin API is with a special concent from the tenant settings that I assume you won't have because it can only be applied to a security group.
The 403 can also be due to permissions. Be sure the registered app has Report.ReadWrite.All or Report.Read.All
I hope that helps,
Thanks for this ibarrau