Unable to authenticate against Azure DevOps _apis/distributedtask/variablegroups using PAT

Question

I'm running a simple call to Azure DevOps API using Powershell:

$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f "{USER}","{PAT}")))
$url = "https://dev.azure.com/{ORG_NAME}/{PROJECT_NAME}/_apis/distributedtask/variablegroups/{ID}?api-version=5.0-preview.1"
Invoke-RestMethod -Uri $url -Method Get -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

The error is shown after:

Invoke-RestMethod: Response status code does not indicate success: 401 (Unauthorized).

Trying to figure out what's wrong, all is configured according to this and this articles.

The strange is that running a call against API without specifying the project is processed without errors:

$url2 = "https://dev.azure.com/{ORG_NAME}/_apis/projects?api-version=2.0" 
Invoke-RestMethod -Uri $url2 -Method Get -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

Response:

count value
----- -----
    5 {@{id=xxxxxxx-89f3-46b0-af7e-xxxxxxx; name=Xxxxx; description=F…

Looks like they are only base64 encoding the username here and then putting the PAT token in after the colon. The resulting string can then be provided as an HTTP header in the following format: Authorization: Basic BASE64USERNAME:PATSTRING. The C# examples then go on to provide an empty string for the username. Couple of things to try. — Ash
– Ash, Commented May 6, 2020 at 21:45
Hmm, not sure as I tried first to use only encoded PAT token and there was an error. After switching to full encoding (username:PAT) I was able to authenticate. — Sergey
– Sergey, Commented May 7, 2020 at 4:26

Levi Lu-MSFT · Accepted Answer · 2020-05-07 03:02:23Z

1

It seems your PAT is not authorized to access the Variable groups.

You can go to your PAT edit page to check if the PAT was assigned at least the Read permission for Variable groups. See below screenshot.

Grant the proper permission scope for your PAT, and try calling the rest api again.

answered May 7, 2020 at 3:02

Levi Lu-MSFT

30.8k3 gold badges42 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sergey Over a year ago

Indeed. I wasn't aware of such precise tailoring of PATs. Thanks.

Collectives™ on Stack Overflow

Unable to authenticate against Azure DevOps _apis/distributedtask/variablegroups using PAT

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related