calling powerbi api in postman fails

Question

I'm trying to call the powerbi api for a specific dataset, just to prove to myself that i have security set up correctly.

Ultimately, I will need to make a DAX query from code but to start, i'm using postman to make some basic request to ensure I've set things up correctly.

What Works

In the online app (app.powerbi.com), I can do the following (using my user credentials - aka I log in):

https://app.powerbi.com/groups/{groupid}/datasets/{datasetid}/details?experience=power-bi

This renders my table with all the columns / data.

What doesn't work

In postman, i'm trying to retrieve the data from the api like this:

https://api.powerbi.com/v1.0/myorg/groups/{groupid}/datasets/{datasetid}

But when I do, I get the following error:

{
    "error": {
        "code": "PowerBINotAuthorizedException",
        "pbi.error": {
            "code": "PowerBINotAuthorizedException",
            "parameters": {},
            "details": [],
            "exceptionCulprit": 1
        }
    }
}

I also tried to do a POST with a DAX query like this:

https://api.powerbi.com/v1.0/myorg/datasets/{datasetid}/executeQueries

with a body:

{  
  "queries": [  
    {  
      "query": "EVALUATE VALUES('Test Table')"
    }  
  ]  
}  

But I get the error:

{ "error": { "code": "PowerBIEntityNotFound", "pbi.error": { "code": "PowerBIEntityNotFound", "parameters": {}, "details": [], "exceptionCulprit": 1 } } }

Setup

I have created an application registration in azure called powerbi with the following permissions:

And then on the actual dataset, i have the following under "sharing"

What I've tried so far

I've searched here on stack and found another post saying that I should decode the JWT token created for my app registration and make sure there's no roles embedded. I didn't see any field called role(s).

I also tried this request to the api: https://api.powerbi.com/v1.0/myorg/datasets/{datasetid}/refreshes

{
    "Message": "API is not accessible for application"
}

and the error I get there is:

Questions

In addition to the obvious question of why my calls to the API are failing, I'd like to doublecheck whether or not i need to include "myorg" in the Uris? Is it supposed to be a literal? or am i supposed to substitute it with another id? (like group id?).
According to MS's documentation, it seems to be a literal. Usually, for variables, they use the "{}" syntax to indicate.

What am I missing? Please and thanks.

Answer 1

The error occurs if you are using token generated with client credentials flow but missed enabling service principal to access your Power BI workspace.

I registered one Entra ID application and granted same API permissions as below:

In my Power BI workspace, I have dataset named SalesMarketing like this:

Now, I generated access token using client credentials flow via Postman with below parameters:

POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token
grant_type:client_credentials
client_id: appId
client_secret: secret 
scope: https://analysis.windows.net/powerbi/api/.default

Response:

When I used this token to make below calls, I too got same errors as you like this:

GET https://api.powerbi.com/v1.0/myorg/groups/{groupid}/datasets/{datasetid}/

Response:

GET https://api.powerbi.com/v1.0/myorg/datasets/{datasetid}/refreshes

Response:

To resolve the error, make sure to add your Entra ID app registration to Power BI workspace with Admin or Contributor access.

Go to Power BI Portal -> Your Workspace -> Click on ... -> Manage access -> +Add people or groups -> Search for Service Principal with name -> Admin

In addition to that, you have to allow access for service principals to call Power BI API by enabling below option in Admin Portal:

Now, generate the token again and call below API's where I got response successfully like this:

GET https://api.powerbi.com/v1.0/myorg/groups/{groupid}/datasets/{datasetid}/

Response:

Note that, service principal authentication is not supported for accessing My workspace (myorg).

In such cases, you need to either change your authentication method to delegated flow or use different API calls like this:

GET https://api.powerbi.com/v1.0/myorg/groups/{groupid}/datasets/{datasetid}/refreshes

Response:

You need to include myorg in all URIs and it is a literal that refers to My Workspace of your Power BI tenant.

Reference: PowerBI API error updating Dataset using Service Principal - Stack Overflow by Neil P and Andrey Nikolov