Unable to Create Custom Entity in Purview – Permission Issu

Question

Unable to Create Custom Entity in Purview – Permission Issu

Nagaraja Kumari Pittu 0

I am attempting to create a custom entity in Microsoft Purview using the Atlas REST API. However, I consistently receive an ATLAS-403 authorization error stating that I am not authorized to perform the create operation for the custom type.

I have already created the custom type successfully and verified that I am using a valid Bearer token with the correct scope (https://purview.azure.net/.default). I have also ensured that the collectionId is correct and that my user/service principal has been assigned the Data Curator role on the relevant collection.

Despite refreshing the access token and validating permissions, the issue persists. This is blocking my ability to programmatically ingest and manage custom metadata entities in Purview.

I would like assistance in identifying whether this issue is related to permissions, role assignment scope, API requirements, or any additional configuration needed for creating entities of custom types.

https://purview.microsoft.com/datamap/governance/main/catalog/collectionAssets?tid=9ac44c96-980a-481b-ae23-d8f56b82c605&collectionId=sdh16d

I have data curator role and admin also for this collection.

note:

{
    "entity": {
        "typeName":"custom_type_parent",
        "status": "ACTIVE",
        "version": 1,
        "collectionId": "sdh16d",
         "attributes":{
            "name": "First_parent_object",
            "description": "This is the first asset of type custom_type_parent",
            "qualifiedName": "custom//custom_type_parent:First_parent_object"
         }

    }
}


{
    "requestId": "15d26a38-c05b-4a36-892b-6adbf338f0eb",
    "errorCode": "ATLAS-403-00-001",
    "errorMessage": "3f49e6ff-1c64-4b12-a2a3-15d24a0ee3f6 is not authorized to perform create entity: type=custom_type_parent"
}

post-

Nagaraja Kumari Pittu 0 Reputation points

2026-06-19T13:21:26.81+00:00

Not usefull

1 answer

Your answer

Nagaraja Kumari Pittu 0 Reputation points

2026-06-19T13:21:26.81+00:00

Not usefull

Answer 1

The ATLAS-403 error when creating a custom entity indicates that the caller doesn’t have sufficient data-plane permissions in Microsoft Purview to perform the create entity operation for that type in the specified collection.

From the documented requirements:

Data-plane role is required for entity create
For creating assets and lineage via the REST APIs, the caller must have Data Curator and Data Reader roles on the relevant collection in the Data Map. The lineage tutorial explicitly states that these APIs (including Create Entity) require these roles:

“The use of these APIs requires Data Curator and Data Reader roles.”
Service principal / user must be correctly assigned in the new Purview portal
In the new Microsoft Purview portal, the service principal must be:
- Added to a group in Entra ID.
- That group must be added to the Data Curator role group for Purview so it can add entities.
The documented steps are:
- Add the service principal to a group.
- Add that group to the data curator role group in Purview using the permissions page.
Collection scoping matters
When using collection-scoped permissions, all API operations are constrained to the collections where the principal has roles. If the principal only has permissions on a different collection (or a parent/child mismatch), create calls for a collection outside that scope will fail with authorization errors.
Propagation delay
The documentation notes that for newly created users or updated permissions in Entra ID, it can take some time for permissions to propagate even after correct permissions are applied. During this window, authorization failures can occur despite apparently correct configuration.
Checklist based on documentation Based on the above, the following must all be true for the create to succeed:
- The caller is using a valid bearer token for the correct tenant and Purview account (already confirmed in the question).
- The principal is in a group that is a member of the Data Curator role group in the new Purview portal.
- The principal also has Data Reader role where required for the APIs being used.
- The role assignment is scoped to the collection identified by collectionId (here, sdh16d), or to a parent collection that grants access to that collection.
- Enough time has passed for role and permission changes to propagate.

If any of these conditions are not met (for example, missing Data Reader role, role group not correctly configured in the new portal, or collection scope mismatch), the result will be an ATLAS-403 authorization error when calling the entity create API for the custom type.

References: