Am currently battling error 403 forbidden
in my partner center API requests and am unable to know what i might be missing or doing wrong.
I have followed Microsoft documentation but still same issue.
My End Goal
To be able to retrieve customers and view users in customer tenants that i manage and export the results into a csv file(same information visible in partner center under customer workspace)
using partner center APIs. I'm using PowerShell to achieve this. Below is the endpoint URLs that is documented to call.
GET https://api.partnercenter.microsoft.com/v{version}/customers
to list customers from partner center
GET https://api.partnercenter.microsoft.com/v1/customers/<customer-tenant-id>
to list users in customer tenant from partner center
What i have done in my environment.
My partner center type is CSP, indirect provider - cloud reseller
.
My account in partner center has Global admin, admin agents, sales agent roles(infact all available roles assigned)
I created an app registration of type Accounts in this organizational directory only (myorgname - Single tenant)
and Redirect URI set to web
I associated the app registration i created above inside partner center and assigned it Owner plus manager role
ms doc
Am able to successfully authenticate to my partner center API thanks to support here, that is i can successfully get a refresh token, connect to partner center
using the refresh token and even use the refresh token to generate a new access token(valid 90 days)
, which i can use as Bearer for REST API call
I can view my customers from the customers workspace in partner center using GUI.
Issue
When i run an API request to either of this endpoints GET https://api.partnercenter.microsoft.com/v1/customers
or GET https://api.partnercenter.microsoft.com/v1/customers/<customer-tenant-id>
, either using REST API flow
or PowerShell SDK
i get 403 forbidden.
$mynewtoken = "new token requested using refresh token"
$url = "https://api.partnercenter.microsoft.com/v1/customers"
$headers = @{
"Authorization" = "Bearer $mynewtoken"
"Accept" = "application/json"
}
$response = Invoke-RestMethod -Method Get -Uri $url -Headers $headers
$response
or
$customers = Get-PartnerCustomer
$customers | ForEach-Object {
Write-Output "Customer ID: $($_.CustomerId), Company Name: $($_.CompanyProfile.CompanyName)"
}
Posting the answer to help community, to resolve the error execute the PowerShell script as a normal user and set the execution policy as unrestricted:
Set-ExecutionPolicy Unrestricted -Scope CurrentUser
I am able to execute the script successfully:
$appId = "AppID"
$appSecret = ConvertTo-SecureString -String "Secret" -AsPlainText -Force
$tenantId = "TenantID"
$credential = [PSCredential]::new($appId, $appSecret)
$tokenSplat = @{
ApplicationId = $appId
Credential = $credential
Scopes = "https://api.partnercenter.microsoft.com/user_impersonation"
ServicePrincipal = $true
TenantId = $tenantId
UseAuthorizationCode = $true
}
$token = New-PartnerAccessToken @tokenSplat
$token.RefreshToken
$connectSplat = @{
ApplicationId = $appId
Credential = $credential
RefreshToken = $token.RefreshToken
}
Connect-PartnerCenter @connectSplat
Get-PartnerRole