Count unread emails with mail.readbasic permission?

Question

I'd like to use the Outlook mail REST API to count the number of unread emails a user has in their inbox with the most limited scoped permission possible. My understanding is Mail.ReadBasic might be able to do it.

Mail.ReadBasic allows the app to read email in the signed-in user's mailbox, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties. Does not include permissions to search messages.

Is read/unread status available to me with Mail.ReadBasic or is it considered an "extended permission"?

Could I use the User List Messages endpoint with "filter=isRead ne true" or do I need "permission to search messages" to use List Messages with a filter?

Thanks!

Answer 1

isRead property is available with Mail.ReadBasic and I believe you can use it for the purpose. Try the sample below using Graph Explorer and see.

GET https://graph.microsoft.com/v1.0/me/messages?filter=isRead ne true&$select=isRead

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata...,
    "value": [
        {
            "@odata.etag": "W/\"CQAAABYAAAC7HU...\"",
            "id": "AAMkAGFhNjVkOTU3...",
            "isRead": false
        }
    ]
}

Answer 2

Thanks @zemuldo !

I tried the query in graph explorer but I'm confused about the results.

When I run the query without the $select filter, I get the entire message contents. However, the permissions tab says "One of the following permissions is required to run the query" and it lists Mail.ReadBasic as one of those permissions. That makes me think any one of the listed permissions are required, not that I need all the listed permissions.

So, according to the permissions tab, Mail.ReadBasic is enough to run the following query:

https://graph.microsoft.com/v1.0/me/messages?$filter=isRead ne true

But if you look at the results in my screenshot, I got the body tag with the results which shouldn't be allowed with only ReadBasic.

It partially makes sense because I shouldn't need both Mail.Read and Mail.ReadWrite for the results. Either one of those on their own should work but it doesn't make sense that Mail.ReadBasic would be sufficient on its own.

I tried to login and consent to only Mail.ReadBasic but the consent option for ReadBasic is broken. I get a console error "ServerError: The provided value for the input parameter 'scope' is not valid. The scope 'Mail.ReadBasic openid profile' does not exist."

What is my misunderstanding? Thanks for your help!

Answer 3

When I'm not logged in, there's no option to consent (attached screenshot). When I am logged in, the option to consent for Mail.ReadBasic is broken. The popup window that asks me to confirm the consent opens and immediately closes. The console shows this error "ServerError: The provided value for the input parameter 'scope' is not valid. The scope 'Mail.ReadBasic openid profile' does not exist."

However, I'd say your test results are enough for me to confirm that ReadBasic does what I'm looking for. Based on this, I can invest more time in the project and move it forward.

Thanks taking the time to help me confirm how ReadBasic works!