调用Databricks创建令牌接口报400 Invalid resource ID错误

返回400 Invalid resource ID是因为请求头X-Databricks-Azure-Workspace-Resource-Id传值不符合要求。该字段不能仅传入数字格式的工作区ID，必须传入完整的ARM规范工作区资源ID。

完整资源ID的格式为：
/subscriptions/<Azure订阅ID>/resourceGroups/<工作区所属资源组名>/providers/Microsoft.Databricks/workspaces/<Databricks工作区名称>

原脚本除了资源ID传值错误外，还存在请求体未显式序列化为JSON的潜在问题，修正后的可运行脚本如下：

# 替换为实际环境参数
$subscriptionId = "你的Azure订阅ID"
$resourceGroupName = "Databricks工作区所在资源组名称"
$workspaceName = "Databricks工作区名称"
$ADB_WORKSPACE_URL = "adb-<你的工作区标识>.<区域编号>.azuredatabricks.net"

# 构造合规的完整工作区资源ID
$ADB_WORKSPACE_RESOURCE_ID = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Databricks/workspaces/$workspaceName"

# 获取两类访问令牌
$adbGlobalToken = (az account get-access-token --resource 2ff814a6-3304-4ab8-85cb-cd0e6f879c1d | ConvertFrom-Json).accessToken
$azureApiToken = (az account get-access-token --resource "https://management.core.windows.net/" | ConvertFrom-Json).accessToken

# 构造请求头
$headers = @{
    "Authorization" = "Bearer $adbGlobalToken"
    "X-Databricks-Azure-SP-Management-Token" = $azureApiToken
    "X-Databricks-Azure-Workspace-Resource-Id" = $ADB_WORKSPACE_RESOURCE_ID
}

# 构造请求体并提前序列化为JSON格式
$body = @{
    "comment" = "This is an example token"
    "lifetime_seconds" = 300
} | ConvertTo-Json

$uri = "https://$ADB_WORKSPACE_URL/api/2.0/token/create"
Write-Host $uri

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$json = Invoke-RestMethod -Method Post -Uri $uri -Headers $headers -ContentType "application/json" -Body $body  

Write-Host $json

• 执行脚本前需通过az login完成Azure CLI登录，确认当前账号对目标Databricks工作区拥有对应操作权限
• 需保证登录账号所属Azure AD租户与Databricks工作区所属租户一致，避免出现跨租户权限错误

内容的提问来源于stack exchange，提问作者Wim