Why can't I access the VSTS analytics API service even though I have sufficient permissions

问题

I try to make a call from a powershell script to the analytics API from my private agent, and I get the following error response: [error]Invoke-RestMethod : {"error":{"code":"0","message":"Using this service requires \"View Analytics\" permission on

I checked my security settings for "View analytics" and it says 'Allow'.

The PAT I've set my private agent up with has all scopes enabled.

I can access this API through Postman using another PAT with authorization Basic.

Also, if I change my header in my powershell script from:

$header =  @{Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"}

to:

$header =  @{Authorization = "Basic <hard coded base64 encoded string used in the header for my Postman queries>"}

it works.

Question: What's going on?

回答1:

The System_Accesstoken is the token that generated dynamically during the build/release, it isn’t the token that you used to configure the agent.

The token that you used to configure agent is used only for the initial configuration of the agent.

To grant the permission to the service account for build/release:

1. Go to security page of the team project
2. Type project collection build service in filter users and groups search box and select Project Collection build Service (xxx) user (not group)
3. Set View analytics to allow.

回答2:

You need to grant allow scripts to access the OAuth token. To do this, go to your pipeline, select a stage andon Run on agent enable "Allow scripts to access the OAuth token".

How to Allow scripts to access the OAuth token

Apart of this you have to grant access to user "Project Collection build Service (xxx)" for your desired request, "View analytics" in this case, but it can be edit task group, edit pipeline, etc.

来源：https://stackoverflow.com/questions/48918028/why-cant-i-access-the-vsts-analytics-api-service-even-though-i-have-sufficient