Symptom
Error "403 forbidden Authenticated user is not permitted to perform the requested operation" occurred when using below APIs to run or get logs of Task Chain:
https://<tenant_url>/api/v1/datasphere/tasks/chains/<space_id>/run/<objectid>
https://<tenant_url>/api/v1/datasphere/tasks/logs/<space_id><logid>
https://<tenant_url>/api/v1/datasphere/tasks/logs/<space_id>/objects/<objectid>
Environment
SAP Datasphere
Reproducing the Issue
- Create an OAuth client configured with "API Access" purpose.
- Use the OAuth client in the third part tools, like Postman and use APIs to run or get logs of Task Chain:
https://<tenant_url>/api/v1/datasphere/tasks/chains/<space_id>/run/<objectid>
https://<tenant_url>/api/v1/datasphere/tasks/logs/<space_id><logid>
https://<tenant_url>/api/v1/datasphere/tasks/logs/<space_id>/objects/<objectid>
- Error occurs.
Cause
API to run or get logs of Task Chain cannot be executed by the OAuth Client with the "API Access" purpose. More information is available here:
Create OAuth2.0 Clients to Authenticate Against SAP Datasphere
Resolution
Create and use an OAuth client with the "Technical User " purpose:
See Also
Keywords
KBA , DS-API , SAP Datasphere APIs , DS-SEC-AUTN , Authentication: SSO/SAML, OAuth Client , Problem
SAP Knowledge Base Article - Public