Embed Token - Datasets GenerateTokenInGroup

Generates an embed token to Embed Q&A based on the specified dataset from the specified workspace.

This API is relevant only to 'App owns data' embed scenario. For more information about using this API, see Considerations when generating an embed token.

Required scope: Dataset.ReadWrite.All or Dataset.Read.All
To set the permissions scope, see Register an app.
When using service principal for authentication, refer to Service Principal with Power BI document along with considerations and limitations section.

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/GenerateToken

URI Parameters

Name In Required Type Description
datasetId
path True
  • string

The dataset id

groupId
path True
  • string
uuid

The workspace id

Request Body

Name Type Description
accessLevel

Required access level for EmbedToken generation

allowSaveAs
  • boolean

Indicates an embedded report can be saved as a new report. Default value is 'false'. Only applies when generating EmbedToken for report embedding.

datasetId
  • string

Dataset id for report creation. Only applies when generating EmbedToken for report creation.

identities

List of identities to use for RLS rules.

Responses

Name Type Description
200 OK

OK

Examples

example

Sample Request

POST https://api.powerbi.com/v1.0/myorg/groups/f089354e-8366-4e18-aea3-4cb4a3a50b48/datasets/cfafbeb1-8037-4d0c-896e-a46fb27ff229/GenerateToken
{
  "accessLevel": "View"
}

Sample Response

{
  "token": "H4sI....AAA=",
  "tokenId": "49ae3742-54c0-4c29-af52-619ff93b5c80",
  "expiration": "2018-07-29T17:58:19Z"
}

Definitions

EffectiveIdentity

Defines the user identity and roles, for more details see this article

EmbedToken

Power BI embed token

GenerateTokenRequest

Power BI Generate Token Request

IdentityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

TokenAccessLevel

Required access level for EmbedToken generation

EffectiveIdentity

Defines the user identity and roles, for more details see this article

Name Type Description
customData
  • string

The value of customdata to be used for applying RLS rules. Only supported for live connections to Azure Analysis Services.

datasets
  • string[]

An array of datasets for which this identity applies

identityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

reports
  • string[]

An array of reports for which this identity applies, Only supported for paginated reports

roles
  • string[]

An array of RLS roles reflected by a token when applying RLS rules (identity can contain up to 50 roles, role can be composed of any character besides ',' and must be up to 50 characters)

username
  • string

The effective username reflected by a token for applying RLS rules (For OnPrem model, username can be composed of alpha-numerical characters or any of the following characters '.', '-', '_', '!', '#', '^', '~', '\', '@', also username cannot contain spaces. For Cloud model, username can be composed of all ASCII characters. username must be up to 256 characters)

EmbedToken

Power BI embed token

Name Type Description
expiration
  • string

Expiration time of token. In UTC.

token
  • string

Embed token

tokenId
  • string

Unique token Id. Can be used to correlate operations that use this token with the generate operation through audit logs.

GenerateTokenRequest

Power BI Generate Token Request

Name Type Description
accessLevel

Required access level for EmbedToken generation

allowSaveAs
  • boolean

Indicates an embedded report can be saved as a new report. Default value is 'false'. Only applies when generating EmbedToken for report embedding.

datasetId
  • string

Dataset id for report creation. Only applies when generating EmbedToken for report creation.

identities

List of identities to use for RLS rules.

IdentityBlob

A blob for specifying the identity. Only supported for datasets with Direct Query connection to SQL Azure

Name Type Description
value
  • string

OAuth2 access token for SQL Azure

TokenAccessLevel

Required access level for EmbedToken generation

Name Type Description
Create
  • string

Indicates that the generated EmbedToken should grant Creation permissions, only applies when generating EmbedToken for report creation

Edit
  • string

Indicates that the generated EmbedToken should grant Viewing and Editing permissions, only applies when generating EmbedToken for report embedding

View
  • string

Indicates that the generated EmbedToken should grant only Viewing permissions