Embed Token - Datasets GenerateTokenInGroup

Generates an embed token based on the specified dataset from the specified workspace.

Note

An embed token can be used to embed Q&A within your application.

Important

This API is only relevant to the embed for your customers scenario. To learn more about using this API, see Considerations when generating an embed token.

Permissions

When using a service principal for authentication, refer to Embed Power BI content with service principal and Considerations and limitations.

Required scope

Dataset.ReadWrite.All or Dataset.Read.All

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/GenerateToken

URI Parameters

Name In Required Type Description
datasetId
path True
  • string

The dataset ID

groupId
path True
  • string
uuid

The workspace ID

Request Body

Name Type Description
accessLevel

Required access level for EmbedToken generation

allowSaveAs
  • boolean

Indicates an embedded report can be saved as a new report. Default value is 'false'. Only applies when generating EmbedToken for report embedding.

datasetId
  • string

The dataset ID used for report creation. Only applies when generating an EmbedToken for report creation.

identities

List of identities to use for RLS rules.

lifetimeInMinutes
  • integer

The maximum lifetime of the token in minutes, starting from the time it was generated. Can be used to shorten the token’s expiration time, but not to extend it. The value must be a positive integer. Zero (0) is equivalent to null and will be ignored, resulting in the default expiration time.

Responses

Name Type Description
200 OK

OK

Examples

example

Sample Request

POST https://api.powerbi.com/v1.0/myorg/groups/f089354e-8366-4e18-aea3-4cb4a3a50b48/datasets/cfafbeb1-8037-4d0c-896e-a46fb27ff229/GenerateToken
{
  "accessLevel": "View"
}

Sample Response

{
  "token": "H4sI....AAA=",
  "tokenId": "49ae3742-54c0-4c29-af52-619ff93b5c80",
  "expiration": "2018-07-29T17:58:19Z"
}

Definitions

EffectiveIdentity

Defines the user identity and roles, for more details see this article

EmbedToken

Power BI embed token

GenerateTokenRequest

Power BI Generate Token Request

IdentityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

TokenAccessLevel

Required access level for EmbedToken generation

EffectiveIdentity

Defines the user identity and roles, for more details see this article

Name Type Description
customData
  • string

The value of customdata to be used for applying RLS rules. Only supported for live connections to Azure Analysis Services.

datasets
  • string[]

An array of datasets for which this identity applies

identityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

reports
  • string[]

An array of reports for which this identity applies, Only supported for paginated reports

roles
  • string[]

An array of RLS roles reflected by a token when applying RLS rules (identity can contain up to 50 roles, role can be composed of any character besides ',' and must be up to 50 characters)

username
  • string

The effective username reflected by a token for applying RLS rules (For OnPrem model, username can be composed of alpha-numerical characters or any of the following characters '.', '-', '_', '!', '#', '^', '~', '\', '@', also username cannot contain spaces. For Cloud model, username can be composed of all ASCII characters. username must be up to 256 characters)

EmbedToken

Power BI embed token

Name Type Description
expiration
  • string

Expiration time of token. In UTC.

token
  • string

Embed token

tokenId
  • string

The unique token ID, which can be used to correlate operations that use this token with the generate operation through audit logs

GenerateTokenRequest

Power BI Generate Token Request

Name Type Description
accessLevel

Required access level for EmbedToken generation

allowSaveAs
  • boolean

Indicates an embedded report can be saved as a new report. Default value is 'false'. Only applies when generating EmbedToken for report embedding.

datasetId
  • string

The dataset ID used for report creation. Only applies when generating an EmbedToken for report creation.

identities

List of identities to use for RLS rules.

lifetimeInMinutes
  • integer

The maximum lifetime of the token in minutes, starting from the time it was generated. Can be used to shorten the token’s expiration time, but not to extend it. The value must be a positive integer. Zero (0) is equivalent to null and will be ignored, resulting in the default expiration time.

IdentityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

Name Type Description
value
  • string

OAuth2 access token for SQL Azure

TokenAccessLevel

Required access level for EmbedToken generation

Name Type Description
Create
  • string

Indicates that the generated EmbedToken should grant Creation permissions, only applies when generating EmbedToken for report creation

Edit
  • string

Indicates that the generated EmbedToken should grant Viewing and Editing permissions, only applies when generating EmbedToken for report embedding

View
  • string

Indicates that the generated EmbedToken should grant only Viewing permissions