0

I'm trying to query application insights via their REST API. I'm stuck on getting a token.

I have created an API key using the API Access blade in Azure Application Insights:

enter image description here

That gives you an Application ID and an API Key.

I have populated postman with the following:

url: https://login.microsoftonline.com/<Our Tenant ID>/oauth2/token
tenant: <Our Tenant ID>
client_id: <The Application ID from the API Access screen>
scope: https://api.applicationinsights.io/.default
client_secret: <The API Key from the API Access screen>
grant_type: client_credentials

All of this is taken from their documentation page here: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#get-a-token

The error is as follows:

"error": "unauthorized_client",
"error_description": "AADSTS700016: Application with identifier '<application ID from API Access screen>' was not found in the directory '<My Company Name>'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: 57f78a92-fe94-40e3-a183-e3002be32801\r\nCorrelation ID: 0ab8e3ec-655d-44aa-93fa-4d3941862d11\r\nTimestamp: 2022-11-30 15:04:20Z",

I checked with the Azure Admin for our company and I'm definitely sending this to the right tenant. Also he created another key for me so it's not that either.

Thanks.

Sridevi
  • 10,599
  • 1
  • 4
  • 17
FunkMonkey33
  • 1,956
  • 2
  • 16
  • 24
  • I think the steps you followed is just one of two (or more), Authentication, missing is the Authorization part, what can you do, setup role, managed identity,.. here take at this doc,https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identities-status – MZM Nov 30 '22 at 15:47
  • I may have worded my question poorly. I'm not trying to authenticate my API against an identity. I only want to use the API key that I set up in Application Insights using the API access blade. Is that possible? – FunkMonkey33 Nov 30 '22 at 18:09
  • with the proper role, yes, see this tutorial I used sometime ago, see the section on role assignment, https://www.c-sharpcorner.com/article/how-to-use-azure-application-insights-in-the-azure-portal-configuration-and-se/ – MZM Nov 30 '22 at 20:12

1 Answers1

1

I tried to reproduce the same in my environment and got below results:

I created an API key from API Access blade in Azure Application Insights like below:

enter image description here

When I tried to acquire the token via Postman with below parameters, I got same error as below:

POST https://login.microsoftonline.com/<TenantID>/oauth2/token
client_id: <Application ID from API Access screen>
grant_type:client_credentials
client_secret: <API Key from API Access screen>
scope: https://api.applicationinsights.io/.default

Response:

enter image description here

There is no need to generate token separately if you want to query Application insights using API key.

Without including token, you can directly query Application insights by including x-api-key header like below:

GET https://api.applicationinsights.io/v1/apps/{Application ID from API Access screen}/metadata
x-api-key: <API Key from API Access screen>

Response:

enter image description here

The process you are currently following works only if you want to authenticate your API via Azure AD. In that case, you can generate the access token by granting required roles and scopes to registered Azure AD application.

But if your requirement is using API key, you can run any query by simply including x-api-key header for Authorization purpose.

Sridevi
  • 10,599
  • 1
  • 4
  • 17
  • This looks very promising. Can you access production logs this way? This link: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview (second paragraph) seems to indicate that you cannot. – FunkMonkey33 Dec 02 '22 at 00:40
  • As mentioned in that doc, you need to use **`Azure AD`** authentication to access **production logs** as `API key` works only for non-production environment. Check this reference for [Azure AD authentication.](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api#set-up-authentication) – Sridevi Dec 02 '22 at 02:55