Graph API List Channel Messages Returnng UnknownError after Protected API Request Approved

Keffeler, Miclain 1

I am unable to get a good response, and having hard time finding Docs. Can't find a way to lookup the inner error code at all either. I get a token using curl -L -X POST 'https://login.microsoftonline.com/51bcb6e4-b738-4e87-a795-768e3f13b94f/oauth2/v2.0/token' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id=5bbd5786-31d3-4d84-a8d0-a0dac6522f93' \ --data-urlencode 'scope=https://graph.microsoft.com/.default' \ --data-urlencode 'client_secret=<secret>' \ --data-urlencode 'grant_type=client_credentials' and then take the access_token value, and do this curl -L -X GET 'https://graph.microsoft.com/v1.0/teams/d89133ea-bf32-4957-8300-aa5e083f45c1/channels/19:5b075a993aee4b3fa8f23be2cbb3b514@thread.skype/messages' \ -H 'Authorization: Bearer <token value from above>' But I get this error 403: { "error": { "code": "UnknownError", "message": "", "innerError": { "date": "2021-03-09T19:15:23", "request-id": "c9a8cf3a-b914-44a8-a66a-506634f09d77", "client-request-id": "c9a8cf3a-b914-44a8-a66a-506634f09d77" } } } how can I troubleshoot? the url for the GET seems right, based on all my research. we are using resource specific consent permissions, but the app is installed in the channel that I am trying to list messages. from

Deva-MSFT 2,256 Reputation points Microsoft Employee

2021-03-14T03:38:32.883+00:00

Adding right tags/teams to assist.
Deva-MSFT 2,256 Reputation points Microsoft Employee

2021-03-14T03:43:07.733+00:00
I see that you're doing curl. Outside of your application you can repro the issue (with graph explorer or postman) as well?

Starting when you're seeing the issue.?
Keffeler, Miclain 1 Reputation point

2021-03-17T15:57:14.1+00:00

i exported the curls from postman, so yeah im reproducing it with postman still right now

Keffeler, Miclain 1

also weird, I get the same error

{
    "error": {
        "code": "UnknownError",
        "message": "",
        "innerError": {
            "date": "2021-03-17T15:58:12",
            "request-id": "9a567a4b-ed3a-4b6c-92c6-228a4a1d8a86",
            "client-request-id": "9a567a4b-ed3a-4b6c-92c6-228a4a1d8a86"
        }
    }
}

when I use the graph explorer myself, to list channel messages from the same channel. I have access to view this channel through teams already, so not sure why that would be.

2 answers

Mamatha-MSFT 156 Reputation points

2021-03-22T05:27:58.307+00:00

@Keffeler, Miclain Can you please confirm have you added RSC permissions in your manifest and to list channel messages you need to add ChannelMessage.Read.All permission.
Please sign in to rate this answer.
Keffeler, Miclain 1 Reputation point

2021-03-22T14:25:09.347+00:00

Screenshot below confirming i have the permission, I believe I just use the .default scope, and it is supposed to grant that for my token.

Additionally, find a screenshot showing that my app did request and obtain the RSC permission on the team/team channel that I am trying to read messages from, as can be seen by listing permissionGrants. Additionally I attached a screenshot confirming the app ID of the app in the portal is the same listed when I list permissionGrants.

Mamatha-MSFT 156 Reputation points

2021-03-23T07:58:00.637+00:00

@Keffeler, Miclain Are you facing this issue in Postman as well.

Keffeler, Miclain 1 Reputation point

2021-03-23T12:26:29.937+00:00

Yes, the curl commands I shared were exported from postman. I am reproducing in postman.
Sign in to comment
Keffeler, Miclain 1 Reputation point

2021-03-23T13:58:15.757+00:00
I am trying to rule out issues. I added the Channel.ReadBasic.All permission in azure, see screenshot.

Then, I authenticated and tried this call to list channels in a team

GET https://graph.microsoft.com/v1.0/teams/af746e47-d762-4574-b0eb-e966db88d7d1/channels

and got back

{ "error": { "code": "UnknownError", "message": "", "innerError": { "date": "2021-03-23T13:56:54", "request-id": "e92fb816-b37f-467c-8dc6-2feb406784e7", "client-request-id": "e92fb816-b37f-467c-8dc6-2feb406784e7" } } }

I am trying to rule out a larger graph api issue for this client, as opposed to this one thing. not sure if this is helpful.
Please sign in to rate this answer.
Keffeler, Miclain 1 Reputation point

2021-03-24T16:10:02.17+00:00

Is there a faster way to get support? we are an enterprise customer and have been troubleshooting for almost 2 weeks.

Mamatha-MSFT 156 Reputation points

2021-03-25T05:28:26.06+00:00

@Keffeler, Miclain To list channel please provide these permissions
ChannelSettings.Read.Group*, ChannelSettings.ReadWrite.Group*, Channel.ReadBasic.All, ChannelSettings.Read.All, ChannelSettings.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All.

And for List channel messages I am unable to repro the issue, It is working fine. Taking this for internal discussion with team, I will update you with resolution.

Mamatha-MSFT 156 Reputation points

2021-03-25T09:38:02.473+00:00

@Keffeler, Miclain - Please check the roles for your access token in https://jwt.io/ and check in the response whether all the assigned permissions are displaying or not.

Keffeler, Miclain 1 Reputation point

2021-03-25T14:27:25.207+00:00

no roles listed

Mamatha-MSFT 156 Reputation points

2021-03-25T14:37:03.177+00:00

@Keffeler, Miclain That is the reason you are unable to list the channel messages, the access token you are using have no permissions.
Try to get new access token using new client Id and client secret by adding required permissions.

Keffeler, Miclain 1 Reputation point

2021-03-25T14:38:53.657+00:00

what does that mean? this client we are using has RSC permissions granted, do I need to use a different scope? do I need to create a new secret and use that new secret to authenticate? I have been getting new acceess tokens every time I test.

Mamatha-MSFT 156 Reputation points

2021-03-29T12:25:50.36+00:00

@Keffeler, Miclain Please get a new access token and check if that token has required permissions or not.

Keffeler, Miclain 1 Reputation point

2021-03-29T13:40:33.247+00:00

I have been logging in fresh each time we do a test. I logged in again this morning, new token, same issue.

Keffeler, Miclain 1 Reputation point

2021-03-29T14:10:08.563+00:00

Okay so I ended up going back to reference some examples, and found the GUID I had for tenant ID to login to was different than I expected. I changed tenant ID when logging in, and that worked. So somehow the GUID I was using, documented above as 51bcb6e4-b738-4e87-a795-768e3f13b94f was letting me get a token with no access, and then I had no roles in that tenant.

As of now this is working, and I do see I have the roles listed in RSC, and it works as expected.
Sign in to comment