Permission issues trying to add projecetserver scope or access _api/ProjectData/* via HTML Requests using Bearer Token

Question

• Our server has Single-Sign-On, when I manually login, and go to below URL (in chrome) I am to get Projects XML OData Feed https://{server}.sharepoint.com/sites/pwa/_api/ProjectServer/Projects
• I need to take this data and manually save the file to run my python scripts. This becomes a nightmare as I need to download all the relational data (resources, assignment, etc. ) to get the full scope of things
• I would like to do this via python GET requests. I have done the below steps, but now stuck with the following error and don't know how to overcome it:
• HTTP RESPONSE: 403
  {'odata.error': {'code': '-2147024891, Microsoft.Office.Project.Server.Exceptions.ProjectServerUnauthorizedAccessException', 'message': {'lang': 'en-US', 'value': 'User could not be authenticated because logon permission has not been granted'}}}

Steps I've taken to get REST API Access:

1. PWA is set to "Project Permission Mode"
2. Use the following site to create AppId: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appregnew.aspx
3. Register the application and define the scope using the following url: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appinv.aspx
4. The Request XML I used is the following: <AppPermissionRequests AllowAppOnlyPolicy="true"><AppPermissionRequest Scope="http://sharepoint/projectserver" Right="Manage" /></AppPermissionRequests> however, when I press CREATE, I am presented with the following landing page: "Sorry, you don't have access"
5. I tried scopes: Scope="http://sharepoint/projectserver/project" Right="Read", same issue as above
6. Finally, I applied: <AppPermissionRequests><AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl"/></AppPermissionRequests> and the App was registered
7. However when it came time to accessing the URL for the project. I am presented with the HTML response I outline above. (Please note that I am getting the Bearer Token successfully, as I am able to hit the following url and get the web list: https://{server}.sharepoint.com/sites/pwa/_api/web Response: 200)
8. I assume whatever permission is preventing me to register the projectserver scope is what is causing me the error. However, I have added myself to all the Permission groups, but still not able to add the projectserver scope.
9. Are you able to highlight some steps, and possible issues I might be able to take to our sharepoint team to resolve?

Answer 1

What I have done to set up Project Web App for rest calls is:

1. Set up a tenant in Azure:

• Visit https://portal.azure.com/ and navigate to App Registrations
• Create a new registration and name it, set the supported account types and redirect URI accordingly, I am using single tenant and localhost:3000/redirect.html as an example. Keep note of the Application (client) Id.
• Navigate to “Certificates and Secrets” under “Manage” and create a new client secret. Make sure to keep note of the value that is generated.
• Navigate to “API Permissions” under “Manage” and Add Permissions for Project.Read, Project.Write, and ProjectWebApp.FullControl, under Sharepoint -> Delegated Permissions

2. Make sure that project permissions are set correctly (you will have to be a site admin to do this)

• Go to your project web app settings by clicking on the gear in the top right corner of your Project Web App and clicking on "PWA Settings"
• Under the Operational Policies heading, click Additional Server Settings
• In the Permission Management section ensure that you have Project Permission mode selected

3. Get an authentication code:

• Visit:

https://login.microsoftonline.com/common/oauth2/authorize?resource=https%3a%2f%2fexample.sharepoint.com&response_type=code&state=&client_id=clientId&scope=&redirect_uri=https%3A%2F%2Flocalhost%3A3000%2Fredirect.html

• where resource is your Sharepoint domain, is your client Id from your Azure app registration, and redirect_uri is also from your Azure app registration.
• After you grant access to the add in, it will redirect you to your redirect uri with a code value in the URL parameters. Hold on to this value for later.

4. Make the http request to get an access token:

• URL:

https://login.microsoftonline.com/common/oauth2/token

• Headers:

Accept: */*
Content-Type: application/x-www-form-urlencoded

• Body (www-form-urlencoded):

grant_type: authorization_code
code: <code from previous call>
redirect_uri: <redirect uri from registration>
client_id: <client id from registration>
client_secret: <client secret from registration>

• Make sure all values are properly formatted in this call. These are just the values that you need to include

• Use the Access token in your rest calls!

There are a couple of ways that I have read about doing this however this is the only way I can consistently get to work

Answer 2

I've seen you ask this question all over the place and was wondering if you ever got an answer. I have ran into the exact same problem and have tried all the same stuff you have. At this point even an arrow in the right direction would help. If you haven't found anything, I would suggest you try registering your app in azure and granting it API permissions for Project Web App under the Sharepoint tab! The only issue with this approach is that each user has to be approved by a global admin in azure, and that is a step that I am trying to avoid.