How to get model (not Dataset) ID - Part of getting RLS Roles and Role Members via Power BI REST API

[JZT]

Hello,

I was searching for a way to retrieve the RLS Roles and Role Members for Datasets using the Power BI REST API for Datasets located in the cloud service. The documentation doesn't have any option for this currently, and I've tried multiple different calls hoping it was buried in there via $expand but no luck (GetDatasetUsersAsAdmin, GetGroupUsersAsAdmin, most other calls to anything with "Dataset", "Group", or "User" in it's name, etc.) and the closest I found was this post, which is unusable as it's for the report server not cloud service: https://community.powerbi.com/t5/Report-Server/Can-I-update-Row-level-security-via-Rest-API/m-p/1146...

Some more digging and I found that calling a GET on one of the analysis.windows.net endpoints retrieved everything I needed, however it is in the form: analysis.windows.net/metadata/model/{modelId}/rlsmembership. The {modelId} is not the GUID for the Dataset ID, but rather appears to be an Integer. My test case has 7 digits. However, I have no idea how to get this programatically after searching for quite a while.

You can view the IDs from the Power BI service by going to the "Security" page for any RLS enabled Dataset, it will be in the URL.

My questions are: Is there a way to retrieve this ID using an API and if so, which one and how? Or, is there a way using the standard REST API to get the RLS Roles and Role Members for a Dataset?

Thanks in advance.

[Ehjalmar]

Very late reply, but maybe useful for someone else finding this old thread... I had the same problem and was trying to find a why to get hold of the model ID via REST APIs. They way I did it was by using another unofficial API, 

analysis.windows.net/metadata/gallery/SharedDatasets. A GET request to that and find the dataset in teh result by searching for it´s ID and Workspace name. In that object the modelId can be found and then used to call the /rlsmembership endpoint.

[AlexeyP]

Hi, do you know how to programmatically authorize to get Bearer token and to have access to analysis.windows.net/metadata/gallery/SharedDatasets?

Thanks

[Ehjalmar]

No, unfortunately not. I was using tokens manually copied from the browser while testing these endpoints then I got stuck when I realized I couldn´t generate a valid token programmatically.

[v-shex-msft]

HI @JZT,

AFAIK, power bi REST API hasn't provided these types of features. In fact, power bi service already includes the feature to view and checking the dataset related RLS settings which not include in REST API.
For this scenario, you may need to manually trace power bi service operation and collect corresponding information(e.g. token, key, values, and request configurations...) to use programing language to manually invoke them.

Regards,
Xiaoxin Sheng

[JZT]

Thanks for the reply.

Correct, Power BI REST API does not have this feature. There are many features I would love the API to one day have 🙂

Yes, tracing current operations is how I found the endpoint in my post. Unfortunately I have not been able to trace any calls to return the code I'm looking for.

Thanks

[lbendlin · Accepted solution]

Why not pull this via DMV queries from the XMLA endpoint?

select * from $SYSTEM.TMSCHEMA_ROLES

[JZT]

Thanks for your reply. I have tried querying DMVs, and yes that is one way to accomplish the goal. However:

• I understand from the documentation that the account requires admin rights to query system DMVs which I very much want to avoid. The Web API can be scoped to read-only permissions.
• I require 2 seperate calls (roles and members) since no joins are allowed where the Web API returns everything I need in a single call.
• The Web API is orders of magnitude quicker from my testing with the rest of my solution currently being in PowerShell.

Hopefully the Power BI REST API will be updated, I may create an Idea, but for now DMVs are not an ideal solution.

If this ends up being the only way forward, I will gladly mark your reply as the solution.

Thanks