[BUG] TEST: Potential Bug — api with -A powerbi is throwing 401 errors (upstream #83)

[ayeshurun]

📋 Copied from microsoft/fabric-cli#83 for AI triage testing.
Expected triage outcome: Potential Bug

---

Bug Description

I can call the powerBI api to retrieve the workspace details:

fab api -A powerbi groups/9af64d7a-7f73-4945-9d9c-c33a6d51ed19

But fails with 401 when trying to retrieve the list of datasets:

fab api -A powerbi groups/9af64d7a-7f73-4945-9d9c-c33a6d51ed19/datasets

fabric-cli version

1.2.0

Python version

Python 3.12.10

Operating System

Windows

CLI Mode

Interactive mode

Authentication Method

Interactive browser login

Steps to Reproduce

Create workspace
Upload a PBIX
Try the API commands from the bug description

Expected Behavior

Execute the PowerBI API

Actual Behavior

Get 401 error

Additional Context

No response

Possible Solution

No response

[github-actions]

🅰️ Approach A (Action) — prompt-only, no codebase access

AI Assessment: Potential Bug

The report describes inconsistent authentication results when accessing Power BI REST API endpoints using the CLI: workspace retrieval succeeds, but listing datasets returns a 401 Unauthorized error. Both calls use the same fab api -A powerbi syntax, authenticated via interactive browser login, and are expected to work according to official CLI documentation.

This scenario indicates the CLI may not be handling Power BI API scopes/grant types consistently, or is failing to acquire/refresh tokens with appropriate permissions for certain endpoints. Since interactive login should grant equivalent access, endpoint-specific 401 errors are unexpected unless the CLI requests insufficient scopes or mismanages tokens. This behavior may break basic Power BI API usage for authenticated users.

Further investigation is required to confirm reproducibility, check token scopes, and validate endpoint access semantics. If confirmed, this may indicate a regression or authentication flow issue needing a code or configuration fix.

Next Steps
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	ai:bug-triage:potential bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅰️ Approach A (Action) — prompt-only, no codebase access

AI Assessment: Potential Bug

The report indicates that the fab api -A powerbi command succeeds for the workspace detail endpoint (groups/{id}), but returns a 401 Unauthorized for the datasets endpoint (groups/{id}/datasets) using the same authentication method (interactive browser login). Both endpoints should be accessible via the Power BI REST API when authenticated as a user with sufficient permissions, and the CLI documentation describes support for both endpoints via the api command.

Given that authentication works for one endpoint but not the other, this suggests a potential problem with either the CLI’s audience token scoping, permission management, or the construction of API calls for certain endpoints. There is no obvious misconfiguration or usage issue based on the provided steps and the standard auth flow.

This touches authentication and authorization logic with external APIs (Power BI REST API), which can have subtle issues at the token or scope level. A detailed team investigation is required to determine whether the issue lies within the CLI, the user's tenant permissions, or the Power BI API itself.

Next Steps

🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	ai:bug-triage:potential bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅱️ Approach B (Code Agent) — code-aware triage agent that reads the actual source code

AI Assessment: Potential Bug

The reported behavior involves successful authentication and API access for workspace metadata, but 401 Unauthorized errors for the /datasets endpoint, despite using the same authentication flow and API audience (-A powerbi). This inconsistency is not expected if the access token and scope are correctly configured, especially since interactive browser login should provide the necessary Microsoft Graph and Power BI permissions.

Given that the fab api -A powerbi groups/<id> request succeeds, but fab api -A powerbi groups/<id>/datasets fails, this suggests either a scope limitation in token acquisition, differences in endpoint security within the Power BI API, or potentially a regression in token handling or audience specification in the CLI. The code (see fab_api_client.py) correctly sets audience and scope for Power BI (https://analysis.windows.net/powerbi/api/.default), but this needs to be verified for token requests and whether the datasets endpoint requires additional or delegated permissions.

This scenario may affect users relying on interactive login for Power BI API integration. If confirmed, severity is elevated, as this impacts core CLI functionality when interacting with workspace datasets and may indicate problems with OAuth flows or scope assignments.

Next Steps

🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	Potential Bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅰️ Approach A (Action) — prompt-only, no codebase access

AI Assessment: Potential Bug

Based on the provided information, the issue is plausible as a bug. The report demonstrates that the fab api command can successfully retrieve workspace details from the Power BI API, but the same authentication context fails with a 401 Unauthorized when accessing the datasets endpoint. Since interactive browser login is used and both API calls fall under the /groups/{id} hierarchy, this suggests inconsistent access behavior possibly due to how the Fabric CLI handles Power BI API scopes or token acquisition.

The CLI should grant consistent access to both endpoints given user permissions, especially after a successful prior API call. The use of -A powerbi establishes the intended audience and aligns with documented authentication flows. Unless the user account lacks explicit dataset/list permission (not indicated), this inconsistency could be caused by insufficient token scopes or a bug in token handling for Power BI sub-resources.

This is not a clear misconfiguration or usage error, given the path and authentication method are correct and reproducible. Further investigation is required to confirm whether the CLI is failing to request the right permissions or the APIs behave unexpectedly.

Next Steps
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	ai:bug-triage:potential bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅱️ Approach B (Code Agent) — code-aware triage agent that reads the actual source code

AI Assessment: Potential Bug

The report describes a 401 Unauthorized error when retrieving datasets via the Power BI REST API through fab api -A powerbi .../datasets, but not when accessing workspace details for the same workspace. The CLI appears to handle endpoint routing and token audience correctly per codebase (API_ENDPOINT_POWER_BI, SCOPE_FABRIC_DEFAULT). Authentication is via browser login, which should provision the scopes for Power BI.

There is no indication of user misconfiguration or path syntax error; the sequence uses correct CLI flags and REST paths. The fact that some Power BI API GETs succeed but others yield 401 strongly suggests upstream token or scope issues, possibly inconsistent scoping or API permissions handled by MSAL or Azure AD. The code retrieves a token using SCOPE_FABRIC_DEFAULT for Power BI endpoints, but dataset-listing may require additional or different delegated permissions, or a bug in scope provisioning.

Given this, the issue plausibly reflects an internal authentication/authorization handling bug in the CLI or backend API, not a user error. Security/auth failures of this kind should be escalated for prompt review.

Next Steps
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	Potential Bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅰️ Approach A (Action) — prompt-only, no codebase access

AI Assessment: Potential Bug

The issue describes a discrepancy in authorization when invoking Power BI REST API endpoints via the fab api command. The user successfully retrieves workspace details but receives a 401 Unauthorized when listing datasets within the same workspace. Both calls use the same audience (-A powerbi) and interactive browser login, which should grant adequate permissions if the user owns the workspace and dataset.

This behavior suggests a possible session or token scoping issue in the CLI's handling of delegated auth, or an API permission mismatch. The fact that the workspace endpoint succeeds rules out a basic authentication failure, pointing toward either insufficient OAuth scopes, token acquisition errors, or a bug in the CLI's API proxy logic for certain Power BI endpoints. Reference: API command documentation.

This could affect users attempting advanced scenarios and calls requiring elevated Power BI permissions, including read access to datasets. Borderline security implication if token scopes are incorrectly mapped or dropped.

Next Steps
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	ai:bug-triage:potential bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅