Azure Microsoft Graph API - Subscription - validation request failed

Question

Azure Microsoft Graph API - Subscription - validation request failed

Leo Lee 11

I try to set up a notification for changes in Azure user data (https://learn.microsoft.com/en-us/graph/api/subscription-post-subscriptions?view=graph-rest-1.0&tabs=http)

Post request from Azure:

validationToken :Validation: Testing client application reachability for subscription Request-Id: 10b2280a-8ddf-4c1b-954b-451b0bb4e101

Is it a correct validationToken?

I try response with this validationToken (Validation: Testing client application reachability for subscription Request-Id: 10b2280a-8ddf-4c1b-954b-451b0bb4e101) and set 200 (OK) status code, The content type as text/plain. And i got the error -- Subscription validation request failed. Response must exactly match validationToken query parameter.

Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-23T23:05:16.003+00:00

@LeoLee-1198 Can you please provide details like - Which endpoint you are using to get the token ? Also what is the authentication flow you are using ?
Leo Lee 11 Reputation points

2020-06-24T01:46:24.537+00:00

Thanks SaurabhSharma-msft,

https://graph.microsoft.com/v1.0/subscriptions

{
"changeType": "created,updated",
"notificationUrl": "https://xx/team/callback",
"resource": "me/events",
"expirationDateTime":"2020-06-24T18:23:45.9356913Z",
"clientState": "secretClientState"
}

Authentication :
https://login.microsoftonline.com/organizations/oauth2/v2.0/token

grant_type password
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-24T23:12:17.987+00:00

@LeoLee-1198 The problem is with your notificationUrl endpoint. As mentioned in the documentation notificationUrl must be capable of responding to the validation request. Also, you need to make sure that the validation token returns as plain/text. Please refer to the Notification endpoint validation document for details.
Leo Lee 11 Reputation points

2020-06-25T03:38:42.437+00:00

Thanks SaurabhSharma-msft,

I have provided a response with the following characteristics within 10 seconds:

A 200 (OK) status code.
The content type set text/plain.
The body include the validation token provided by Microsoft Graph.

But i got the validationToken value is Validation: Testing client application reachability for subscription Request-Id: 10b2280a-8ddf-4c1b-954b-451b0bb4e101.

The post request from Azure.

Is it a correct validationToken?

If i should response this body ?
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-26T23:32:09.41+00:00

@LeoLee-1198 Yes, validationToken is correct. I have used a sample to validate the same and the code displays the same -

I was able to create the subscription without any issues -

It worked fine with Graph Explorer as well.

Your issues looks similar to this issue and you need to make sure that validationToken is properly decoded by the client as it is a query parameter and returns plain text -
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-01T16:31:38.827+00:00

@Leo Lee Following up to know if you have any other questions.

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.
Leo Lee 11 Reputation points

2020-07-13T02:46:31.657+00:00

I am apologize for can't reply you in time.

I tried send post request to my server in POSTMAN.

It should response the correct value, but still show error 'Subscription validation request failed. Response must exactly match validationToken query parameter.'
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-13T23:24:12.083+00:00

@LeoLee-1198 I have tried using the Postman using ROPC authentication flow and able to create a subscription.

Are you using client credentials flow? Please can you try using ROPC passing username and password of the person owning the mailbox while fetching the access token and use the same token for subscription creation.

Leo Lee 11

I did it, i did using the Postman using ROPC authentication flow .

The error is same :

{
    "error": {
        "code": "InvalidRequest",
        "message": "Subscription validation request failed. Response must exactly match validationToken query parameter.",
        "innerError": {
            "date": "2020-07-14T03:46:06",
            "request-id": "de01bd34-1761-4a15-86a6-e854add0d65e"
        }
    }
}

Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-15T22:39:17.503+00:00

@Leo Lee weird.. Not sure what is causing this but I will try to figure out the issue. Have you tried this with any other user having mailbox enabled ?
Robin Malik 1 Reputation point

2020-07-25T15:16:55.243+00:00

I'm having the same problem following the documentation. Making a POST request to create the subscription and I can see the response from Microsoft as they POST back to my web server:

ValidationToken=Validation%3a+Testing+client+application+reachability+for+subscription+Request-Id%3a+70c3baa0-b27a-4419-8b49-6357acc279cd

When returning this (decoded), it says:

Subscription validation request failed. Response must exactly match validationToken query parameter.
Sakti Mohapatra 41 Reputation points

2020-07-27T21:43:25.467+00:00

I am facing the same issue. Please let know if you got a solution.
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-31T22:00:24.197+00:00

@RobinMalik-9597 I just realized that a new line character being appended to the value of the validation token. This might be causing the issue. See below the difference between your returned value and mine.

Robin's Validation response

My Validation Response (Doesn't contain a new line character at the end)

Please can you check your code which returns the validation token. It must be adding an additional character at the end.

@Sakti Mohapatra FYI. Please let me know if this resolves your issue.
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-08-13T17:48:04.143+00:00

@RobinMalik-9597 @Sakti Mohapatra Please let me know if still are having issues or any questions.

1 answer

Your answer

Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-23T23:05:16.003+00:00

@LeoLee-1198 Can you please provide details like - Which endpoint you are using to get the token ? Also what is the authentication flow you are using ?
Leo Lee 11 Reputation points

2020-06-24T01:46:24.537+00:00

Thanks SaurabhSharma-msft,

https://graph.microsoft.com/v1.0/subscriptions

{
"changeType": "created,updated",
"notificationUrl": "https://xx/team/callback",
"resource": "me/events",
"expirationDateTime":"2020-06-24T18:23:45.9356913Z",
"clientState": "secretClientState"
}

Authentication :
https://login.microsoftonline.com/organizations/oauth2/v2.0/token

grant_type password
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-24T23:12:17.987+00:00

@LeoLee-1198 The problem is with your notificationUrl endpoint. As mentioned in the documentation notificationUrl must be capable of responding to the validation request. Also, you need to make sure that the validation token returns as plain/text. Please refer to the Notification endpoint validation document for details.
Leo Lee 11 Reputation points

2020-06-25T03:38:42.437+00:00

Thanks SaurabhSharma-msft,

I have provided a response with the following characteristics within 10 seconds:

A 200 (OK) status code.
The content type set text/plain.
The body include the validation token provided by Microsoft Graph.

But i got the validationToken value is Validation: Testing client application reachability for subscription Request-Id: 10b2280a-8ddf-4c1b-954b-451b0bb4e101.

The post request from Azure.

Is it a correct validationToken?

If i should response this body ?
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-06-26T23:32:09.41+00:00

@LeoLee-1198 Yes, validationToken is correct. I have used a sample to validate the same and the code displays the same -

I was able to create the subscription without any issues -

It worked fine with Graph Explorer as well.

Your issues looks similar to this issue and you need to make sure that validationToken is properly decoded by the client as it is a query parameter and returns plain text -
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-01T16:31:38.827+00:00

@Leo Lee Following up to know if you have any other questions.

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.
Leo Lee 11 Reputation points

2020-07-13T02:46:31.657+00:00

I am apologize for can't reply you in time.

I tried send post request to my server in POSTMAN.

It should response the correct value, but still show error 'Subscription validation request failed. Response must exactly match validationToken query parameter.'
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-13T23:24:12.083+00:00

@LeoLee-1198 I have tried using the Postman using ROPC authentication flow and able to create a subscription.

Are you using client credentials flow? Please can you try using ROPC passing username and password of the person owning the mailbox while fetching the access token and use the same token for subscription creation.
Leo Lee 11 Reputation points

2020-07-14T03:52:35.63+00:00

I did it, i did using the Postman using ROPC authentication flow .

The error is same :

{ "error": { "code": "InvalidRequest", "message": "Subscription validation request failed. Response must exactly match validationToken query parameter.", "innerError": { "date": "2020-07-14T03:46:06", "request-id": "de01bd34-1761-4a15-86a6-e854add0d65e" } } }
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-15T22:39:17.503+00:00

@Leo Lee weird.. Not sure what is causing this but I will try to figure out the issue. Have you tried this with any other user having mailbox enabled ?
Robin Malik 1 Reputation point

2020-07-25T15:16:55.243+00:00

I'm having the same problem following the documentation. Making a POST request to create the subscription and I can see the response from Microsoft as they POST back to my web server:

ValidationToken=Validation%3a+Testing+client+application+reachability+for+subscription+Request-Id%3a+70c3baa0-b27a-4419-8b49-6357acc279cd

When returning this (decoded), it says:

Subscription validation request failed. Response must exactly match validationToken query parameter.
Sakti Mohapatra 41 Reputation points

2020-07-27T21:43:25.467+00:00

I am facing the same issue. Please let know if you got a solution.
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-07-31T22:00:24.197+00:00

@RobinMalik-9597 I just realized that a new line character being appended to the value of the validation token. This might be causing the issue. See below the difference between your returned value and mine.

Robin's Validation response

My Validation Response (Doesn't contain a new line character at the end)

Please can you check your code which returns the validation token. It must be adding an additional character at the end.

@Sakti Mohapatra FYI. Please let me know if this resolves your issue.
Saurabh Sharma 23,866 Reputation points Microsoft Employee Moderator

2020-08-13T17:48:04.143+00:00

@RobinMalik-9597 @Sakti Mohapatra Please let me know if still are having issues or any questions.

Answer 1

Martin Bullman 26

For the last week or so I was encountering the same issue when trying to create a subscription utilising the MS graph API.

The following stack overflow thread helped me resolve the issue: https://stackoverflow.com/questions/53857198/notification-endpoint-validation-not-working-with-laravel-endpoint

Basically I was sending back the validation token but my PHP framework was adding a new line character in the response body prior to the validation token being added. This meant MS Graph would always fail to validate my notification endpoint.

Adding ob_clean() before returning the token resolved the issue for me.

Hope it can help someone else out here!

Ognjen 0 Reputation points

2023-10-30T11:31:46.1133333+00:00

Martin, thank you!

Share via

Azure Microsoft Graph API - Subscription - validation request failed

1 answer

Your answer