I'm currently working on a powershell script to gather Power BI audit information for our BI team and export it to CSV so it can be used within Power BI. My SSO account has been assigned the role of Power BI Admin so I can make the relevant REST API calls. Most calls I'm trying to make return data as expected, but any time I try to make a group API call (e.g. api.powerbi.com/v1.0/myorg/groups/*), I get a 401 error. I also get the same error when using the "try it" button on the documentation pages, logging in with my SSO account, then providing the relevant parameters. From the "REST API Try It" page, the headers show "x-powerbi-error-info: GroupNotAccessible" when I get the 401s.
In my powershell script, I first call the "Login-PowerBI" cmdlet to set context with my user. The login window appears and I select my sso user account. After that I start making calls. This is an example call that works without error (please excuse my powershell code - I'm no expert):
# get gateways for use in subsequent calls
Write-Host "Retrieving gateways..."
$gatewayFileName = "C:\temp\gateways.csv"
[System.Collections.ArrayList]$gateways = @()
$gatewayInfo = Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/gateways" -Method Get | ConvertFrom-Json
if ($gatewayInfo) {
if ($gatewayInfo[0].value) {
foreach ($gw in $gatewayInfo[0].value) {
$gateways.Add($gw)
}
}
}
$gateways | ForEach-Object {$_}| Export-Csv -Path $gatewayFileName -NoTypeInformation
I get a list of gateways back and I create the file accordingly. Here's an example call to get the refresh history for a given dataset within a group. This gives me a very generic "One or more errors occurred" error in powershell, but if I use "Resolve-PowerBIError -Last", I can see that the error is actually a 401 (unauthorized):
Write-Host "Retrieving dataset refresh history..."
$dsRefreshHistoryFileName = "C:\temp\dataset_refresh_history.csv"
[System.Collections.ArrayList]$dsRefreshHistory = @()
foreach ($groupId in $groupDatasets.Keys)
{
foreach($gds in $groupDatasets["$groupId"])
{
$url = "https://api.powerbi.com/v1.0/myorg/groups/$($groupId)/datasets/$($gds.id)/refreshes"
$url
$histContainer = Invoke-PowerBIRestMethod -Url $url -Method Get | ConvertFrom-Json
if ($histContainer) {
if($histContainer[0].value)
{
foreach ($hist in $histContainer[0].value) {
$hist | Add-Member -NotePropertyName DatasetId -NotePropertyValue $gds.id
$dsRefreshHistory.Add($hist)
}
}
}
}
}
$dsRefreshHistory | ForEach-Object {$_} | Export-Csv -Path $dsRefreshHistoryFileName -NoTypeInformation
The $groupDatasets variable is a hashtable populated by first retrieving the groups with this API:
https://api.powerbi.com/v1.0/myorg/admin/groups?`$expand=dashboards&`$top=$topCount&`$skip=$skipCount
Then looping through each group ID and making this API call:
https://api.powerbi.com/v1.0/myorg/admin/groups/$($group.id)/datasets
This all seems to work as I get group data back from both of those calls. However I don't appear to be able to use the non-Admin group API calls without the aforementioned error. I don't think my powershell is at fault as I get the same error when using the same URL in the "REST API Try It" links from the documentation.
Is my account, with the PowerBI-Admin role, not allowed to make ALL REST API calls, or do I need to have rights to specific groups in order to pull that information? The documentation calls out the required scope (e.g. "Workspace.Read.All" or "Workspace.ReadWrite.All"), but does having the Power BI admin role not give me that access? My apologies if I've missed something fundamental here.
Thank you for your time!
