Admin account can't refresh datasource by API in tableau

Question

I actively use tableau server to manage our data and report. I'm currently working on a project to automate the data refresh process, based on datasource id. Our datasource is based on extract, not live connection, from impala connection. Below is the code I'm using to refresh the datasource.

import tableauserverclient as TSC

tableau_auth = TSC.TableauAuth(
    "ADMIN_ID", 
    "ADMIN_PASSWORD!", 
    site_id=""
)
server = TSC.Server("https://data-tableau.my.domain",  use_server_version=True)
server.auth.sign_in(tableau_auth)

luid = "my-data-source-luid"
resource = server.datasources.get_by_id(datasource_luid)
job = server.datasources.refresh(resource)

Got an permission error:

ServerResponseError                       Traceback (most recent call last)
<ipython-input-123-6746ce67fcf0> in <module>
     18     resource = server.datasources.get_by_id(luid)
---> 19     job = server.datasources.refresh(resource)
     20     0/0
     21 

~/.local/lib/python3.6/site-packages/tableauserverclient/server/endpoint/endpoint.py in wrapper(self, *args, **kwargs)
    175         def wrapper(self, *args, **kwargs):
    176             self.parent_srv.assert_at_least_version(version)
--> 177             return func(self, *args, **kwargs)
    178 
    179         return wrapper

~/.local/lib/python3.6/site-packages/tableauserverclient/server/endpoint/datasources_endpoint.py in refresh(self, datasource_item)
    161         url = "{0}/{1}/refresh".format(self.baseurl, id_)
    162         empty_req = RequestFactory.Empty.empty_req()
--> 163         server_response = self.post_request(url, empty_req)
    164         new_job = JobItem.from_response(server_response.content, self.parent_srv.namespace)[0]
    165         return new_job

~/.local/lib/python3.6/site-packages/tableauserverclient/server/endpoint/endpoint.py in post_request(self, url, xml_request, content_type, parameters)
    138             auth_token=self.parent_srv.auth_token,
    139             content_type=content_type,
--> 140             parameters=parameters,
    141         )
    142 

~/.local/lib/python3.6/site-packages/tableauserverclient/server/endpoint/endpoint.py in _make_request(self, method, url, content, auth_token, content_type, parameters)
     69         server_response = method(url, **parameters)
     70         self.parent_srv._namespace.detect(server_response.content)
---> 71         self._check_status(server_response)
     72 
     73         # This check is to determine if the response is a text response (xml or otherwise)

~/.local/lib/python3.6/site-packages/tableauserverclient/server/endpoint/endpoint.py in _check_status(self, server_response)
     86         elif server_response.status_code not in Success_codes:
     87             try:
---> 88                 raise ServerResponseError.from_response(server_response.content, self.parent_srv.namespace)
     89             except ParseError:
     90                 # This will happen if we get a non-success HTTP code that

ServerResponseError: 

    409090: Bad Request
        Extract operation for the datasource 'XXXXXXX-9f12-4236-a68e-785f63a29e57' is not allowed.

Seems strage because,

1. The account used is super admin
2. I tested on all datasources we have, around 3000 datasources, it raised the same error
3. When I implement it based on workbook, it works fine.

luid = "my-workbook-luid"
resource = server.workbooks.get_by_id(luid)     
job = server.workbooks.refresh(resource)

What I've tried to debug it:

from tableauserverclient.server.endpoint.datasources_endpoint import Datasources
from tableauserverclient.server.endpoint.workbooks_endpoint import Workbooks

luid = "my-data-source-luid"
resource = server.datasources.get_by_id(luid)
ds = Datasources(server)
ds._permissions._get_permissions(resource)
>> []


luid = "my-workbook-luid"
resource = server.workbooks.get_by_id(luid)     

wb = Workbooks(server)

print(wb._permissions._get_permissions(resource))
permission_rule = wb._permissions._get_permissions(resource)[0]
permission_rule.capabilities

>> {'CreateRefreshMetrics': 'Allow',
 'ViewUnderlyingData': 'Allow',
 'AddComment': 'Allow',
 'Write': 'Allow',
 'ExportData': 'Allow',
 'ShareView': 'Allow',
 'ViewComments': 'Allow',
 'Filter': 'Allow',
 'ExportImage': 'Allow',
 'Read': 'Allow'}

I don't see why the permission is empty for the datasource here. Did I missed something?