• Our server has Single-Sign-On, when I manually login, and go to below URL (in chrome) I am to get Projects XML OData Feed https://{server}.sharepoint.com/sites/pwa/_api/ProjectServer/Projects
  • I need to take this data and manually save the file to run my python scripts. This becomes a nightmare as I need to download all the relational data (resources, assignment, etc. ) to get the full scope of things
  • I would like to do this via python GET requests. I have done the below steps, but now stuck with the following error and don't know how to overcome it:
    {'odata.error': {'code': '-2147024891, Microsoft.Office.Project.Server.Exceptions.ProjectServerUnauthorizedAccessException', 'message': {'lang': 'en-US', 'value': 'User could not be authenticated because logon permission has not been granted'}}}

Steps I've taken to get REST API Access:

  1. PWA is set to "Project Permission Mode"
  2. Use the following site to create AppId: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appregnew.aspx
  3. Register the application and define the scope using the following url: https://{server}.sharepoint.com/sites/pwa/_layouts/15/appinv.aspx
  4. The Request XML I used is the following: <AppPermissionRequests AllowAppOnlyPolicy="true"><AppPermissionRequest Scope="http://sharepoint/projectserver" Right="Manage" /></AppPermissionRequests> however, when I press CREATE, I am presented with the following landing page: "Sorry, you don't have access"
  5. I tried scopes: Scope="http://sharepoint/projectserver/project" Right="Read", same issue as above
  6. Finally, I applied: <AppPermissionRequests><AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl"/></AppPermissionRequests> and the App was registered
  7. However when it came time to accessing the URL for the project. I am presented with the HTML response I outline above. (Please note that I am getting the Bearer Token successfully, as I am able to hit the following url and get the web list: https://{server}.sharepoint.com/sites/pwa/_api/web Response: 200)
  8. I assume whatever permission is preventing me to register the projectserver scope is what is causing me the error. However, I have added myself to all the Permission groups, but still not able to add the projectserver scope.
  9. Are you able to highlight some steps, and possible issues I might be able to take to our sharepoint team to resolve?

2 Answers 2


What I have done to set up Project Web App for rest calls is:

  1. Set up a tenant in Azure:
  • Visit https://portal.azure.com/ and navigate to App Registrations
  • Create a new registration and name it, set the supported account types and redirect URI accordingly, I am using single tenant and localhost:3000/redirect.html as an example. Keep note of the Application (client) Id.
  • Navigate to “Certificates and Secrets” under “Manage” and create a new client secret. Make sure to keep note of the value that is generated.
  • Navigate to “API Permissions” under “Manage” and Add Permissions for Project.Read, Project.Write, and ProjectWebApp.FullControl, under Sharepoint -> Delegated Permissions
  1. Make sure that project permissions are set correctly (you will have to be a site admin to do this)
  • Go to your project web app settings by clicking on the gear in the top right corner of your Project Web App and clicking on "PWA Settings"
  • Under the Operational Policies heading, click Additional Server Settings
  • In the Permission Management section ensure that you have Project Permission mode selected
  1. Get an authentication code:
  • Visit:


  • where resource is your Sharepoint domain, is your client Id from your Azure app registration, and redirect_uri is also from your Azure app registration.
  • After you grant access to the add in, it will redirect you to your redirect uri with a code value in the URL parameters. Hold on to this value for later.
  1. Make the http request to get an access token:
  • URL:


  • Headers:
Accept: */*
Content-Type: application/x-www-form-urlencoded
  • Body (www-form-urlencoded):
grant_type: authorization_code
code: <code from previous call>
redirect_uri: <redirect uri from registration>
client_id: <client id from registration>
client_secret: <client secret from registration>
  • Make sure all values are properly formatted in this call. These are just the values that you need to include

  • Use the Access token in your rest calls!

There are a couple of ways that I have read about doing this however this is the only way I can consistently get to work

  • On step 2, how can you set project permissions for an app in PWA? Nov 4, 2021 at 21:32

I've seen you ask this question all over the place and was wondering if you ever got an answer. I have ran into the exact same problem and have tried all the same stuff you have. At this point even an arrow in the right direction would help. If you haven't found anything, I would suggest you try registering your app in azure and granting it API permissions for Project Web App under the Sharepoint tab! The only issue with this approach is that each user has to be approved by a global admin in azure, and that is a step that I am trying to avoid.

  • No I never got the answer to this. I'm using selenium and manually entering 2FA token to login. It's real ugly but gets me half way there . Does getting Azure Active Directory and registering with SharePoint access allow you to get ProjectData? Were you able to do Post requests this way as well? I'll give this a shot.
    – Karun
    Jul 15, 2021 at 23:21
  • I haven't ran into any permissions issues yet with my ReST calls, I've been able to get project data and post new projects and project tasks just with the API Permissions I granted. Let me know if you need a more detailed guide to setting that up.
    – Joe Klug
    Jul 19, 2021 at 18:37
  • Do you know what endpoints I should use for Sharepoint ProjectData via AAD? I get the following error when I try to get xxxx.sharepoint.com/sites/pwa/_api/ProjectData/…'{"error_description":"Exception of type \'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException\' was thrown."}
    – Karun
    Jul 28, 2021 at 13:26
  • I have used the same endpoints and it has worked fine for me. you do have to request approval in a browser however. This will then redirect to your redirect URI which you will likely have to create a website for. Once the website redirects, you can grab the auth code from the URL params and close the browser. I realize I should have included this when I suggested this solution as it can be difficult to accomplish this depending on the language you use for your project
    – Joe Klug
    Aug 2, 2021 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.