Search code examples
azure-devopsazure-pipelinesazure-powershellazure-devops-rest-api

How to grant permissions to call Azure DevOps REST API using System.AccessToken?

I want to call the Azure DevOps REST API's Test Suites - Create endpoint from an Azure DevOps Release pipeline.

I am doing this from a PowerShell task and I am using System.AccessToken. When I try to create a test suite, I receive the following response:

"message": "You do not have the appropriate permissions to manage test suites under this area path.",
"typeName": "Microsoft.TeamFoundation.TestManagement.WebApi.AccessDeniedException, Microsoft.TeamFoundation.TestManagement.WebApi",
"typeKey": "AccessDeniedException",

Does anybody know what permissions need to be granted in Azure DevOps?

Notes:

  • Yes, I have enabled the OAuth token in my agent job.
  • Yes, I have granted the Build Service permissions, but it doesn't seem to help. There doesn't seem to be a specific permission for managing test suites anywhere.
  • Yes, I have tried other endpoints (GET, for example) and they work. I just can't create test suites.
Solution

  • When you try to create a test suite, it actually will create the Test Suite to the specified or default area path.

    To create test suites on an area path, as the error message has stated, the users/identities must has the "Manage test suites" permission on the area path.

    For you case, if you want to use the System.AccessToken as the authorization token to call the REST API "Test Suites - Create" in pipelines, you can set the permissions like below:

    1. Go to "Project Settings" > "Project configuration" > "Areas", on the menu item of the area path (or its parent path) which you want to create work items to, select Security to open the Security hub of the area path.

      enter image description here

    2. On the Security hub, search for the following two identities and ensure the permission "Manage test suites" is set to "Allow" for them. See "Job access tokens".

      • Project Collection Build Service ({Organization Name})
      • {Project Name} Build Service ({Organization Name})

      enter image description here

    After above steps, you can use the System.AccessToken as the authorization token to call the REST API in pipelines.