Communication between two workspaces

[flynnpham920]

Hi everyone, our team is implementing an application utilizing the Databricks App (in AzureDatabricks) to deploy a website in workspace A (sea). This web calls an API to the Databricks Dashboards in workspace B (jpe) to get a token to embed the dashboard in our website, following these instructions. It works perfectly locally, but when we test on the website deployed in workspace A, it got the error: {"error_code":403,"message": "Cert validation failed. Both workspace comparison and snp system trusted checks did not pass. [ReqId: cfd61829-172b-4ca8-a43e-0f43ad15c770]"} when the workspace A tries to call the API to get the dashboard embedded token from the workspace B. We all use a Service Principal to generate the OAuth token for every step. We try to investigate the error and assume that it's related to the network problem between the two workspaces, and it's not our expertise. Could you guys please help us to solve this problem? Thank you very much.

[nayan_wylde · Accepted solution]

The specific error message is a known symptom of Databricks network-policy enforcement for cross-workspace calls, not (only) an OAuth/service-principal problem.

403 Cert validation failed. Both workspace comparison and snp system trusted checks did not pass
This shows up when the request originates from an environment Databricks doesn’t treat as a “trusted network path” to the other workspace — most commonly when Private Link / VNet injection / restricted egress is involved and the two workspaces can’t establish a policy-approved route.

The error is strongly consistent with cross-workspace access blocked by network policies (often Private Link / VNet constraints).https://community.databricks.com/t5/data-engineering/cross-workspace-rest-api-access-denied-due-to-n...
Fix typically involves private connectivity (VNet peering/hub-spoke) + NSG rules, or using a proxy.
Also ensure Workspace B embedding policy allows the App’s domain. https://learn.microsoft.com/en-us/azure/databricks/ai-bi/admin/embed

[flynnpham920]

Thank you so much. We'll follow your recommendation.