CRUD operations in custom PBI Visuals. Possible?

[mikeclemmens]

Hi all,

We've been told that due to the nature of PBI Visuals (sandboxed iframes) - we cannot make any POST, DELETE or PUT calls to an API hosted on an external server. Is this true and is there any workarounds?

Thanks,

Mike.

cc: @dm-p 

[dm-p]

Hi @mikeclemmens,

If you want to certify your visual, then this would not be permitted, but comms are certainly possible, if you're prepared to make some concessions with your endpoint (although you will need to assess this for risks accordingly).

You can make calls if your endpoint allows access from any domain. I have a brief overview of it here.

Regards,

Daniel

[mikeclemmens]

Thanks for confirming Daniel, that's a relief. What concessions are you referring to specifically that we should consider?

If we wanted to add an additional security layer to our API requests by passing an access token or similar to our backend which can validate against PBI for session validity - is that even possible?

Also, do you know if PBI is planning to change this acceptance criteria in the future for certified visuals?

Thanks for helping out,

Mike

[dm-p]

Hi @mikeclemmens,

Power BI visuals have a null origin (due to the sandboxing), so you can't check for things like the domain that requests come from. Your best best might be to ensure that you have a valid license key as one of your visual properties that can be used to authenticate server-side, or similar. From what I've seen of other folks' visuals, this seems to be the case, but this isn't really an area I'm used to exploring in custom visuals, as I've never had the need (and as I develop my visuals in my own time, I don't have an R&D budget for it 😛 ).

Your best bet might be to request support from the team (pbicvsupport@microsoft.com) around this for guidance. I would advise the same about whether the external comms requirement would be lifted re: certification, as this is something I don't have visibility of either.

Regards,

Daniel