How do you allow an external application to use the search REST API? Both SP and the external app use the same Azure AD/MS Graph to login. So the users are the same, and have access to both.

I get a 403 forbidden response when calling sharepoint.example.com/sites/ExampleSite/_api/search/query?querytext='some thing'

In Azure, the app registration of the external app, I have given it "Sites.ReadWrite.All" - tried it both delegated and application level.

For the OAuth login, I have configured it to request the same permission:

      authorization: {
        params: {
          scope: 'openid email profile Sites.ReadWrite.All',
          prompt: 'consent',
        },
      },

And it does pop up the "Do you want to allow this app to do ... " dialog when logging in.

And after login succeeds, it returns an access_token that looks something like

ey...really really long string ... Q

And finally when I call the REST API, I pass that access token back:

    const result = await fetch(`${sharepointUrl}/_api/search/query?querytext='${searchtext}'`, {
      headers: {
        Bearer: `ey.......Q`,
        Accept: 'application/json;odata=verbose',
        'odata-version': '',
      },
    })

But the result is 403 Forbidden. Obviously I've missed something, but what?

Response {
      requestIncludesCredentials: true,
      type: 'default',
      status: 403,
      statusText: 'Forbidden',
    },
  }

I am an admin on the Sharepoint, and I am creating this app so I have full permissions inside Azure for both.

How do you allow an external application to use the search REST API? This is for Sharepoint online, not self hosted. Both SP and the external app use the same Azure AD/MS Graph to login. So the users are the same, and have access to both.

I get a 403 forbidden response when calling sharepoint.example.com/sites/ExampleSite/_api/search/query?querytext='some thing'

In Azure, the app registration of the external app, I have given it "Sites.ReadWrite.All" - tried it both delegated and application level.

For the OAuth login, I have configured it to request the same permission:

      authorization: {
        params: {
          scope: 'openid email profile Sites.ReadWrite.All',
          prompt: 'consent',
        },
      },

And it does pop up the "Do you want to allow this app to do ... " dialog when logging in.

And after login succeeds, it returns an access_token that looks something like

ey...really really long string ... Q

And finally when I call the REST API, I pass that access token back:

    const result = await fetch(`${sharepointUrl}/_api/search/query?querytext='${searchtext}'`, {
      headers: {
        Bearer: `ey.......Q`,
        Accept: 'application/json;odata=verbose',
        'odata-version': '',
      },
    })

But the result is 403 Forbidden. Obviously I've missed something, but what?

Response {
      requestIncludesCredentials: true,
      type: 'default',
      status: 403,
      statusText: 'Forbidden',
    },
  }

I am an admin on the Sharepoint, and I am creating this app so I have full permissions inside Azure for both.