Azure API: List Invoices works, but downloading gives `AuthorizationFailed`.

Question

I'm trying to download an invoice via

GET https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{BillingAccountID}/invoices/{InvoiceID}/download?downloadToken={DRSToken}&api-version=2020-05-01

but it always results in a 403 "AuthorizationFailed" error.

The interesting thing is, listing all invoices via

GET https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{BillingAccountId}/invoices

work flawlessly, and this is also where I get the download URL from it's response.

Does it makes any sense, that I have access to the list of invoices, but not to the invoice download?

For accessing the API, I registered an app and use the secret to create an authentication token. The app is also enabled in the Billing Account as Billing Reader.

Answer 1

Indeed, there was an error in my code with the HTTP methods!

The following now works

GET https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{billingaccount_id}/invoices

Then I get a response 200, with the field value -> documents -> URL for a download link. Using this link in a POST yields

POST https://management.azure.com/providers/Microsoft.Billing/billingAccounts/<billingaccount_id>/invoices/<invoice_id>/download?downloadToken=<download_token>&api-version=2020-05-01

results in a 202, with a header containing Location. A GET on this location, downloads the PDF

GET https://management.azure.com/providers/Microsoft.Billing/billingAccounts/<billingaccount_id>/invoices/<invoice_id>/operationResults/invoiceDownload_<...>?api-version=2020-05-01&t=<very_long_token> 

Thanks for the quick help!

Answer 2

Jürgen Drachta, thank you for posting this question on Microsoft Q&A.

I understand that you are trying to download Invoice using the API mentioned here - Invoices - Download Invoice

Note that this API uses HTTP POST method and not GET. Please try using the POST method with the URL and see if you are still this issue.

In case you are still facing this issue, can you please share the following additional details:

1. API Document which contains information about using these APIs.
2. Sample request/response (after removing the sensitive information and Auth tokens)

Hope this helps. Please let us know if you have any questions.