Permission issues trying to add projecetserver scope or access _api/ProjectData/* via HTTP Requests using Bearer Token

Question

Our server has Single-Sign-On, when I manually login, and go to below URL (in chrome) I am to get Projects XML OData Feed https://{server}.sharepoint.com/sites/pwa/_api/ProjectServer/Projects
I need to take this data and manually save the file to run my python scripts. This becomes a nightmare as I need to download all the relational data (resources, assignment, etc. ) to get the full scope of things
I would like to do this via python GET requests. I have done the below steps, but now stuck with the following error and do not know how to overcome it:
HTTP RESPONSE: 403
{'odata.error': {'code': '-2147024891, Microsoft.Office.Project.Server.Exceptions.ProjectServerUnauthorizedAccessException', 'message': {'lang': 'en-US', 'value': 'User could not be authenticated because logon permission has not been granted'}}}

Steps I've taken to get REST API Access:

PWA is set to "Project Permission Mode"
Use the following site to create AppId: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appregnew.aspx
Register the application and define the scope using the following url: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appinv.aspx
The Request XML I used is the following: however, when I press CREATE, I am presented with the following landing page: "Sorry, you don't have access"
I tried scopes: Scope="http://sharepoint/projectserver/project" Right="Read", same issue as above
Finally, I applied: and the App was registered
However when it came time to accessing the URL for the project. I am presented with the HTML response I outline above. (Please note that I am getting the Bearer Token successfully, as I am able to hit the following url and get the web list: https://{server}.sharepoint.com/sites/pwa/_api/web Response: 200)
I assume whatever permission is preventing me to register the projectserver scope is what is causing me the error. However, I have added myself to all the Permission groups, but still not able to add the projectserver scope.
Are you able to highlight some steps, and possible issues I might be able to take to our sharepoint team to resolve?

user_3521261 · Answer

I used the following package and instructions:

https://github.com/areed1192/ms-graph-python-client
with youtube guide: https://www.youtube.com/watch?v=bBslvqBCjAA

and accompanying solution: https://sharepoint.stackexchange.com/questions/294271/permission-issues-trying-to-add-projecetserver-scope-or-access-api-projectdata/295279?noredirect=1#comment312859_295279

  sharepoint_resource_url = 'https://xxxxx.sharepoint.com'
  credential_dir = directory to save refresh token details 

  from ms_graph.client import MicrosoftGraphClient

  graph_client = MicrosoftGraphClient(
      client_id=os.environ['client_id'],
      client_secret=os.environ['client_secret'],
      redirect_uri=os.environ['redirect_uri'],
      scope=[os.environ['sharepoint_resource_url'] + '/.default'],
      account_type=os.environ['tenent_id'],
      credentials=os.environ['credential_dir'] + '/ms_graph_state.jsonc'
  )

  graph_client.login()
  headers = dict(authorization='Bearer ' + graph_client.access_token)


  resp = request.get(os.environ['sharepoint_resource_url'] + '/sites/pwa/_api/ProjectData/Projects', headers=headers)

  print(resp.status_code)
  print(resp.content)

Permission issues trying to add projecetserver scope or access _api/ProjectData/* via HTTP Requests using Bearer Token

1 Answers