Pnpjs: accessDenied error when using @pnp/sp/taxonomy v2.0.8 with taxonomy api v2.1

[alexabramkin]

_api/v2.1/termstore/groups/.../sets/.../terms
Error: Error making HttpClient request in queryable [403] Forbidden ::> {"error":{"code":"accessDenied","message":"End point cannot be called by the current user"}}

• [X] Bug

Version

"@pnp/sp": "^2.0.8"
Please specify what version(s) of SharePoint you are targeting: SharePoint Online Commercial and GCC tenants

Expected / Desired Behavior / Question

Up till today (8/12/20) new taxonomy calls against v2.1 were working on both commercial and GCC tenants

Observed Behavior

As of 8/12/20 403 error above on both commercial and GCC tenants

Steps to Reproduce

import { sp } from "@pnp/sp";
import '@pnp/sp/taxonomy';
import { ITermInfo } from "@pnp/sp/taxonomy";
....
sp.termStore.groups.getById("...").sets.getById("...").terms().then(...

[patrick-rodgers]

We haven't made any changes to the library and I am not aware of changes in the service - but always possible. The API is "beta" so perhaps some updates got rolled out. Will have to look.

Starting today all calls to the api are failing or just for specific users?

[alexabramkin]

All calls are failing no matter the user

[CyrilLacroix]

I have the same issue, even with admin rights on the term store.
I noticed that it's still possible to fetch one term with the id (_api/v2.1/termstore/groups/{groupId}/sets/{termsetId}/terms/{termId})

[Ofer-Gal]

I have the same issue with @pnp/sp": "^2.0.4",
And I am the Term Set owner and store admin.
This is possibly an issue with SPO changes to the term store application.

[adrichema]

I have the same issue with @pnp/sp": "^2.0.7" from our SPFX webpart and the user is store admin. Getting term groups or the termset it self is working fine. Only the terms are giving issues.

[Ofer-Gal]

I use graph REST and it works fine. so I guess the issue is @pnp/sp

[tomverhoeff]

Hi, not a pnpjs user here, but facing the same issue when calling the Taxonomy API from a Power Automate flow.

While researching I ran into the newly released specs for the Taxonomy API that will be part of the Graph API. The specs do not include the /terms endpoint we're using, but does offer a /children endpoint that is fairly similar. Unfortunately it only returns the first level of children, so depending on the depth of the taxonomy it requires some extra calls, but you should be able to get all the data you need,.
See https://docs.microsoft.com/en-us/graph/api/termstore-term-list-children?view=graph-rest-beta

I am able to call this API through the SP endpoint as well: https://<tenant>.sharepoint.com/sites/<site>/_api/v2.1/termStore/groups/<groupid>/sets/<setid>/children

[patrick-rodgers]

Thanks @tomverhoeff - that seems like a good place to start. Haven't had a chance to dive into this issue yet but I remember when I was figuring out the API both children and terms existed, it looks like they have switched up how it works. Appreciate the idea - will aim to have this resolved in the next release.

[patrick-rodgers]

Confusing but I think the "terms" property no longer works to access the collection. It still appears in the metadata doc, but seems to always just throw access denied as everyone has noted. However, it does work for accessing terms directly as noted by @CyrilLacroix. Terms _used_ to work when we first implemented this but is now blocked by the hard coded access denied message.

Also, "children" works to get child terms from a term set BUT does not work to access those terms, you have to use "terms" in the path.

works:
/terms/{guid}
/children

fails
/children/{guid}
/terms

Super inconsistent and not easy to model within a fluent api without getting hacky. I have no explanation for the design decision but it is what we have to work with.

Edit: I should add we are trying to come up with a reasonable way to have our library hide this silliness and "just work", issue remains open.

[Ofer-Gal]

There is an easy Graph beta solution
https://graph.microsoft.com/beta/termStore/sets/${DocumentTypeTermSet}/children?$select=id,labels

[patrick-rodgers]

@Ofer-Gal - unsure on your point or how that helps us here, but that has the exact same issue as we are discussing? You have to swap terms and children in the url and the path is inconsistent when accessing the collection or an individual term?

[patrick-rodgers]

Making some changes to address this and updating the docs accordingly.

• Adding a getTermById method to term sets
• Removing the terms property of term sets
• Updating children to only be a queryable collection
• Also taking this opportunity to remove the duplications and collapse on the sets and groups properties and removing termGroups and termSets props.

I understand this a breaking change, but as noted already in the docs this API was beta when we first implemented on it so changes could occur. Changes occurred so we are doing our best to realign and will continue to do so as needed.