Graph API: Adding app to Microsoft Teams chat returns 403 Forbidden

Question

I have an app fully configured and working. I use Graph API to perform different actions from behalf this app.

One of my use-cases is using Graph API to add app to chat as described in this docs.

This request worked good yesterday (with 201 Created response):

POST https://graph.microsoft.com/v1.0/chats/{chatId}/installedApps

{"******@odata.bind": "https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/{appId}"}

But today in most cases I'm recieving this 403 Forbidden error:

{
    "error": {
        "code": "Forbidden",
        "message": "Caller is not authorized.",
        "innerError": {
            "date": "2024-10-30T09:28:09",
            "request-id": "c4a81d43-4681-4aa1-adb8-d16f874fc948",
            "client-request-id": "c4a81d43-4681-4aa1-adb8-d16f874fc948"
        }
    }
}

I tried to make it with different chat IDs.

I also tested this behavior by sending this request more times (with delays to prevent limits hitting) - sometimes it returns 201 Created, but probability of successful response is about 1%.

I did not change any scopes or permissions or policies for my app.

I have TeamsAppInstallation.ReadWriteSelfForChat.All permission granted and not revoked to my app.

Also I checked my client secret in Azure / Certificates & secrets - and my secret is not expired.

Can someone explain me what else can I check? Or maybe it's an issue on the MS side?

Answer 1

1. Make sure u have enabled these permissions (delegated and application) https://graph.microsoft.com/Chat.ReadWrite https://graph.microsoft.com/ChatMember.ReadWrite https://graph.microsoft.com/User.Read https://graph.microsoft.com/TeamsAppInstallation.ReadWriteAndConsentSelfForChat.
2. Use a delegated access token in the add app to chat api. get the access token by doing a Oauth2.0 with your bot app . (note: dont use the bot access token which wont work in most cases).
3. also check if u are having any rsc permissions in your manifest.json
4. also make sure that the delegated access token of the user you are using is already added in the teams group chat