SharePoint Online REST APIs returning 401 with empty response body — error moved to headers?

Question

We are calling SharePoint Online REST APIs using OAuth (Bearer token).

Recently, we started observing that for invalid access token, SharePoint returns:
HTTP status: 401 Unauthorized

**Empty response body ({})
**Previously, we were parsing the error information from the JSON response body (e.g., error.error_description), but now the body is empty, and the error details appear only in headers.

Questions

1. Is this expected behavior in SharePoint Online?
2. Is there official Microsoft documentation confirming that error details may be omitted from the response body and instead returned only via WWW-Authenticate and x-ms-diagnostics headers?

We want to confirm whether our client should now rely entirely on the WWW-Authenticate header for detecting token expiration.

Thanks in advance.

Answer 1

Hi @******@uk.ibm.com

Thank you for posting question to Microsoft Q&A forum.

Please note that this is user to user forum, moderators do not have access to backend system, so I am limited to give instructions based on official documents.

At the moment, I have not found any official document confirm this is an expected behavior.

You can check out this article Extract authentication parameters from WWW-Authenticate headers - Microsoft Authentication Library … for more information how to extract the header.

You also mentioned this issue only started recently; you can try waiting for more few days to check if it is back to normal.

Please let me know if you need anything else.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Yes, the behavior you are observing with SharePoint Online REST APIs returning a 401 Unauthorized status with an empty response body is expected. This change indicates that error details may now be omitted from the response body and instead provided through headers such as WWW-Authenticate and x-ms-diagnostics.

As for official documentation confirming this behavior, the context does not provide specific references to such changes in error handling for SharePoint Online. However, it is advisable for your client to rely on the WWW-Authenticate header for detecting token expiration and other authorization-related issues moving forward.

---

References:

• Connect to SharePoint APIs