Calling Sharepoint APIs with Sites.ReadWrite.All - which token to use?

Question

When calling a Sharepoint REST API, which token do I need to pass and in which header?

Currently I am doing:

const result = await fetch(`${sharepointUrl}/_api/search/query?querytext='${searchtext}'`, {
      headers: {
        Bearer: token,
        Accept: 'application/json;odata=verbose',
        'odata-version': '',
      },
    })

Where token is the value that was returned by the OAuth login. I am using NextAuth with the azure-ad provider (https://next-auth.js.org/providers/azure-ad). Which works fine and the users can login without any problem using their Azure AD/Entra ID account. This gives me these fields - screenshot below. I am using next_auth_account.access_token as the bearer token. I have also tried next_auth_session.sessionToken

However I am getting 403 Forbidden as the result. So, am I using the wrong header field name? The wrong field to get the token from? The wrong something else? I am logging in as myself to test, and I do have access to the Sharepoint that I am searching.

And I have setup the Sites.ReadWrite.All permission in Azure:

The response from Sharepoint is:

Response {
    [Symbol(realm)]: null,
    [Symbol(state)]: {
      aborted: false,
      rangeRequested: false,
      timingAllowPassed: true,
      requestIncludesCredentials: true,
      type: 'default',
      status: 403,
      timingInfo: [Object],
      cacheState: '',
      statusText: 'Forbidden',
      headersList: [HeadersList],
      urlList: [Array],
      body: [Object]
    },
    [Symbol(headers)]: HeadersList {
      cookies: null,
      [Symbol(headers map)]: [Map],
      [Symbol(headers map sorted)]: null
    }
  }

Answer 1

Hi @OM,

You can use this article to get the access token of your REST API.

Get access without a user

Note that in the second section of this article, when configuring permissions, select SharePoint instead of Graph APIs. Select SharePoint to set permissions for the Rest API. The other steps are the same.

After you successfully apply for an access token, it should be placed in the Authorization header when you use REST API.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @OM,

I'm sorry I didn't understand your question properly.

For your question:

1. Yes, the access token returned by your login is correct and you need to use it when using the SharePoint API.
2. You can also use the "Bearer" header, which fills in the access token just like "Authorization" hear.

If you continue to encounter 403 issues, I recommend that you first parse your request token into this widget and check that the permissions recorded in your SCP section match the permissions you should be granted.

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link. 

You can also share the result of this analysis with me, which will help me solve your problem better.

Thank you for your time and efforts in advance.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi @OM,

Sorry for getting back to you late, as I took a moment to find the answer.

I asked my colleague who specializes in the Microsoft Graph API and the problem came up with us confusing the SharePoint Rest API with the Microsoft Graph API!

That's why you have permission but still get a 403 error.

This article details how we can get the access token for the SharePoint Rest API via Postman, and you can try to get the access token again and see if the problem persists.

Access SharePoint Online data using postman tool

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.