for executive PowerShell script to call Fabric API i am getting the error

Question

for executive PowerShell script to call Fabric API i am getting the error

Kakade, Dipali 0

2026-10-19T14:41:56.0496759Z SPN Login Successful
2026-10-19T14:41:56.3618670Z Token type returned: System.Security.SecureString
2026-10-19T14:41:56.3692266Z Fabric Token Acquired (valid JWT format)
2026-10-19T14:42:02.8913977Z Git status call failed: The remote server returned an error: (401) Unauthorized.
2026-10-19T14:42:02.9781662Z Invoke-RestMethod : The remote server returned an error: (401) Unauthorized.
2026-10-19T14:42:02.9783210Z At D:\a\_temp\434305ee-e33f-48b6-afdf-042bb20b8937.ps1:101 char:18
2026-10-19T14:42:02.9784384Z +     $gitStatus = Invoke-RestMethod -Method GET `
2026-10-19T14:42:02.9785453Z +                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2026-10-19T14:42:02.9786720Z     + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc 
2026-10-19T14:42:02.9790320Z    eption
2026-10-19T14:42:02.9791535Z     + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand
2026-10-19T14:42:02.9798752Z  
2026-10-19T14:42:03.2099790Z ##[error]PowerShell exited with code '1'.
2026-10-19T14:42:03.2385953Z ##[section]Finishing: PowerShell Script

REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T11:13:52.13+00:00

Hello @Kakade, Dipali ,

Thank you for sharing the error details. I understand that the PowerShell script successfully obtains a token, but the Microsoft Fabric Git Status API request is returning 401 Unauthorized.

To help us investigate further, could you please share the API endpoint being called and the relevant portion of the PowerShell script, with any credentials, secrets, tokens, tenant IDs, or other sensitive information removed?

This will help us review how the token is being used in the API request and determine the appropriate next steps.
Kakade, Dipali 0 Reputation points

2026-10-22T12:29:58.6733333+00:00

No nothing is removed all the variables are at place token is generating using SPN and ENtra ID with JWT format
REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T12:46:13.95+00:00

Hello @Kakade, Dipali
Thank you for the clarification. I understand that the token is being generated successfully using the Service Principal (SPN) and Microsoft Entra ID in JWT format.

Since the Git Status API call is still returning 401** **Unauthorized, could you please share the exact API endpoint being called and the relevant portion of the PowerShell Invoke-RestMethod request, including how the generated token is being passed in the Authorization header?

Also, please confirm that the Service Principal has the required access to the Fabric workspace and that the Git credentials are configured for the workspace.

Please mask any access tokens, client secrets, credentials, tenant IDs, or other sensitive information before sharing.

This information will help us further isolate the cause of the authorization failure.

Kakade, Dipali 0

# GIT STATUS
# ==========================================
$statusUrl = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/status"

Write-Host ""
Write-Host "Getting Git Status..."
Write-Host $statusUrl

try
{
    $statusResponse = Invoke-RestMethod `
        -Uri $statusUrl `
        -Method GET `
        -Headers $headers

    Write-Host "Git Status Response:"
    $statusResponse | ConvertTo-Json -Depth 20

    $workspaceHead = $statusResponse.workspaceHead
    $remoteCommitHash = $statusResponse.remoteCommitHash

    Write-Host "WorkspaceHead: $workspaceHead"
    Write-Host "RemoteCommitHash: $remoteCommitHash"
}
catch
{
    Write-Host "Git Status API Failed"

    if ($_.Exception.Response)
    {
        $reader = New-Object System.IO.StreamReader(
            $_.Exception.Response.GetResponseStream()
        )

        $responseBody = $reader.ReadToEnd()

        Write-Host $responseBody
    }

    throw
}

Kakade, Dipali 0 Reputation points

2026-10-22T13:26:16.79+00:00

i am using this script, SPN has all the required access
REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T14:00:33.9933333+00:00

Hello @Kakade, Dipali

Thank you for confirming that the Service Principal has the required access.

In the code shared earlier, the Git Status API request uses $headers, but the portion where $headers is constructed is not included. Could you please share the relevant sanitized section of the script showing how the access token is added to the Authorization header?

Please mask the actual access token, client secret, tenant ID, and any other sensitive information before sharing. This will help us verify how the token is being passed with the API request and continue investigating the 401 Unauthorized response.

Kakade, Dipali 0

# ==========================================
# FABRIC TOKEN
# ==========================================
$tokenResponse = Get-AzAccessToken `
    -ResourceUrl "https://api.fabric.microsoft.com"

$token = $tokenResponse.Token

if ($token -is [System.Security.SecureString])
{
    $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($token)
    $token = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
}

$headers = @{
    Authorization = "Bearer $token"
    "Content-Type" = "application/json"
}

Write-Host "Fabric Token Acquired"

2 answers

Your answer

REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T11:13:52.13+00:00

Hello @Kakade, Dipali ,

Thank you for sharing the error details. I understand that the PowerShell script successfully obtains a token, but the Microsoft Fabric Git Status API request is returning 401 Unauthorized.

To help us investigate further, could you please share the API endpoint being called and the relevant portion of the PowerShell script, with any credentials, secrets, tokens, tenant IDs, or other sensitive information removed?

This will help us review how the token is being used in the API request and determine the appropriate next steps.
Kakade, Dipali 0 Reputation points

2026-10-22T12:29:58.6733333+00:00

No nothing is removed all the variables are at place token is generating using SPN and ENtra ID with JWT format
REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T12:46:13.95+00:00

Hello @Kakade, Dipali
Thank you for the clarification. I understand that the token is being generated successfully using the Service Principal (SPN) and Microsoft Entra ID in JWT format.

Since the Git Status API call is still returning 401** **Unauthorized, could you please share the exact API endpoint being called and the relevant portion of the PowerShell Invoke-RestMethod request, including how the generated token is being passed in the Authorization header?

Also, please confirm that the Service Principal has the required access to the Fabric workspace and that the Git credentials are configured for the workspace.

Please mask any access tokens, client secrets, credentials, tenant IDs, or other sensitive information before sharing.

This information will help us further isolate the cause of the authorization failure.
Kakade, Dipali 0 Reputation points

2026-10-22T13:25:11.99+00:00

# GIT STATUS # ========================================== $statusUrl = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/status" Write-Host "" Write-Host "Getting Git Status..." Write-Host $statusUrl try { $statusResponse = Invoke-RestMethod ` -Uri $statusUrl ` -Method GET ` -Headers $headers Write-Host "Git Status Response:" $statusResponse | ConvertTo-Json -Depth 20 $workspaceHead = $statusResponse.workspaceHead $remoteCommitHash = $statusResponse.remoteCommitHash Write-Host "WorkspaceHead: $workspaceHead" Write-Host "RemoteCommitHash: $remoteCommitHash" } catch { Write-Host "Git Status API Failed" if ($_.Exception.Response) { $reader = New-Object System.IO.StreamReader( $_.Exception.Response.GetResponseStream() ) $responseBody = $reader.ReadToEnd() Write-Host $responseBody } throw }
Kakade, Dipali 0 Reputation points

2026-10-22T13:26:16.79+00:00

i am using this script, SPN has all the required access
REDDIMALLA VENKATESH 0 Reputation points Microsoft External Staff

2026-10-22T14:00:33.9933333+00:00

Hello @Kakade, Dipali

Thank you for confirming that the Service Principal has the required access.

In the code shared earlier, the Git Status API request uses $headers, but the portion where $headers is constructed is not included. Could you please share the relevant sanitized section of the script showing how the access token is added to the Authorization header?

Please mask the actual access token, client secret, tenant ID, and any other sensitive information before sharing. This will help us verify how the token is being passed with the API request and continue investigating the 401 Unauthorized response.
Kakade, Dipali 0 Reputation points

2026-10-22T14:03:36.6133333+00:00

# ========================================== # FABRIC TOKEN # ========================================== $tokenResponse = Get-AzAccessToken ` -ResourceUrl "https://api.fabric.microsoft.com" $token = $tokenResponse.Token if ($token -is [System.Security.SecureString]) { $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($token) $token = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr) } $headers = @{ Authorization = "Bearer $token" "Content-Type" = "application/json" } Write-Host "Fabric Token Acquired"

Answer 1

Capture the Fabric response body and errorCode first, because a 401 means token authentication or validation failed; missing workspace privileges normally produces 403, so reconfiguring Git permissions before validating the token may not address this failure.^1^

1. Capture the actual Fabric error

Replace the current Git status call temporarily with:

$uri = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/status"

try {
    $gitStatus = Invoke-RestMethod -Method Get -Uri $uri `
        -Headers $headers -ErrorAction Stop
}
catch {
    $response = $_.Exception.Response
    $requestId = $response.Headers["requestId"]

    $reader = [IO.StreamReader]::new($response.GetResponseStream())
    $body = $reader.ReadToEnd()

    Write-Error "Fabric request failed. RequestId=$requestId Body=$body"
    throw
}

Fabric returns a structured error containing errorCode, message, and requestId. Preserve the requestId for support escalation.^1^

Act on the returned code:

TokenExpired: acquire a fresh token immediately before the API call.
InsufficientScopes: verify that the token was requested for the Fabric API.
Another code: use that code rather than the changing human-readable message to select the next action.

2. Validate the token claims without printing the token

A JWT-shaped value only confirms its format. Check its audience, tenant, expiry, and calling application:

$payload = $token.Split('.')[1].Replace('-', '+').Replace('_', '/')
$payload += '=' * ((4 - $payload.Length % 4) % 4)

$claims = [Text.Encoding]::UTF8.GetString(
    [Convert]::FromBase64String($payload)
) | ConvertFrom-Json

[pscustomobject]@{
    Audience = $claims.aud
    Tenant   = $claims.tid
    AppId    = if ($claims.azp) { $claims.azp } else { $claims.appid }
    Expires  = [DateTimeOffset]::FromUnixTimeSeconds($claims.exp).UtcDateTime
}

Confirm that:

Audience is the Fabric API audience.
Tenant is the tenant containing the target Fabric workspace.
AppId is the service principal used by the Azure DevOps pipeline.
Expires is later than the API-call time.

The documented app-only request uses scope=https://api.fabric.microsoft.com/.default.^2^ Your Get-AzAccessToken -ResourceUrl "https://api.fabric.microsoft.com" pattern is also the documented Fabric PowerShell pattern, provided the active Az context is the intended service principal and tenant.^3^

For direct service-principal access, delegated scopes such as Workspace.GitUpdate.All are not the governing authorization mechanism; service principals are controlled through Fabric tenant controls and Fabric resource permissions.^4^

3. After token authentication succeeds, configure this SPN as the Git caller

The Git status endpoint supports service principals, but the caller must have Contributor or higher workspace access and must have its own Git credentials configured.^5^

For a workspace already connected to Azure DevOps under a user identity:

A workspace Admin adds the SPN to the workspace. The documented existing-workspace setup uses the Admin role.
The Azure DevOps cloud-connection owner shares that connection with the SPN through Manage users, or creates a connection using the SPN.
Call GET /v1/connections as the SPN and verify that the required connection is returned.
Configure the connection specifically for this caller:

$body = @{
    source       = "ConfiguredConnection"
    connectionId = $connectionId
} | ConvertTo-Json

$uri = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/myGitCredentials"

Invoke-RestMethod -Method Patch -Uri $uri `
    -Headers $headers -Body $body -ErrorAction Stop

These are the documented steps required before that service principal performs Fabric Git REST operations.^2^

If the SPN has not been added to the Azure DevOps organization/project, an Azure DevOps administrator must add it under Organization settings → Users, then add it to the relevant project team.^6^

If the request still returns 401 after the claims are correct, provide Microsoft Support with the captured errorCode, requestId, UTC timestamp, endpoint, and non-secret claim values. Do not include the Bearer [Token] or client secret.

References

Answer 2

Hi Kakade, Dipali & thx for join me at Q&A platform,

important detail in ur logs is that SPN authentication succeeds, but the Fabric Git status API returns 401. Those are two different checks. Getting a valid JWT doesn't necessarily mean the token is intended for Microsoft Fabric or that the service principal has access to the workspace.

I'd check the token audience first. For Fabric REST APIs, the token needs to target https://api.fabric.microsoft.com, not Azure Resource Manager or Azure DevOps. If you're using Get-AzAccessToken, request it explicitly:

$token = Get-AzAccessToken -ResourceUrl "https://api.fabric.microsoft.com"

$plainToken = [System.Net.NetworkCredential]::new(

"", $token.Token

).Password

$headers = @{

Authorization = "Bearer $plainToken"

"Content-Type" = "application/json"

}

$gitStatus = Invoke-RestMethod -Method GET `

-Uri "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/status" `

-Headers $headers

The SecureString message in ur log is worth checking too. If ur script passes the SecureString object directly into the Authorization header instead of converting it to the actual token text, the API won't receive a valid bearer token.

Next, check Fabric Admin portal > Tenant settings > Developer settings > Service principals can call Fabric public APIs. Make sure it's enabled and that ur service principal belongs to an allowed security group if the setting is restricted.

The Git status endpoint does support service principals, but the SPN needs at least Contributor access to the Fabric workspace. Also, Fabric Git integration has its own authentication configuration. For service principals, the Git credential source should be ConfiguredConnection, not Automatic, and the SPN needs permission to use that Azure DevOps connection.

You can check the Git credential configuration using:

Invoke-RestMethod -Method GET `

-Uri "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/myGitCredentials" `

-Headers $headers

If that returns "source": "None" or "Automatic", you'll need to configure an appropriate Azure DevOps cloud connection and associate it with the SPN using the Update My Git Credentials API.

I'd also try a simpler Fabric API request, such as GET https://api.fabric.microsoft.com/v1/workspaces, using the same token. If that fails with 401 too, focus on the token, tenant configuration, and Authorization header. If it succeeds but Git status fails, investigate workspace access and Git credentials.

One more thing: decode the JWT locally and inspect its aud, tid, and appid/azp claims. Don't paste the full token into pipeline logs, tho. Also capture the response body and x-ms-request-id from the failed request if available.

Could u share the PowerShell section where you're obtaining the token and constructing the Authorization header (with secrets removed)? That would help determine whether the 401 is caused by token handling or Fabric permissions.

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer

Kakade, Dipali 0 Reputation points

2026-10-22T13:28:24.9266667+00:00

# GIT STATUS # ========================================== $statusUrl = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/status" Write-Host "" Write-Host "Getting Git Status..." Write-Host $statusUrl try { $statusResponse = Invoke-RestMethod ` -Uri $statusUrl ` -Method GET ` -Headers $headers Write-Host "Git Status Response:" $statusResponse | ConvertTo-Json -Depth 20 $workspaceHead = $statusResponse.workspaceHead $remoteCommitHash = $statusResponse.remoteCommitHash Write-Host "WorkspaceHead: $workspaceHead" Write-Host "RemoteCommitHash: $remoteCommitHash" } catch { Write-Host "Git Status API Failed" if ($_.Exception.Response) { $reader = New-Object System.IO.StreamReader( $_.Exception.Response.GetResponseStream() ) $responseBody = $reader.ReadToEnd() Write-Host $responseBody } throw }