Allowing external application permission to use Sharepoint search REST API?

Question

How do you allow an external application to use the search REST API? This is for Sharepoint online, not self hosted. Both SP and the external app use the same Azure AD/MS Graph to login. So the users are the same, and have access to both.

I get a 403 forbidden response when calling sharepoint.example.com/sites/ExampleSite/_api/search/query?querytext='some thing'

In Azure, the app registration of the external app, I have given it "Sites.ReadWrite.All" - tried it both delegated and application level.

For the OAuth login, I have configured it to request the same permission:

      authorization: {
        params: {
          scope: 'openid email profile Sites.ReadWrite.All',
          prompt: 'consent',
        },
      },

And it does pop up the "Do you want to allow this app to do ... " dialog when logging in.

And after login succeeds, it returns an access_token that looks something like

ey...really really long string ... Q

And finally when I call the REST API, I pass that access token back:

    const result = await fetch(`${sharepointUrl}/_api/search/query?querytext='${searchtext}'`, {
      headers: {
        Bearer: `ey.......Q`,
        Accept: 'application/json;odata=verbose',
        'odata-version': '',
      },
    })

But the result is 403 Forbidden. Obviously I've missed something, but what?

Response {
      requestIncludesCredentials: true,
      type: 'default',
      status: 403,
      statusText: 'Forbidden',
    },
  }

I am an admin on the Sharepoint, and I am creating this app so I have full permissions inside Azure for both.

Answer 1

1. You give the Graph permission in app, but you want to use the SharePoint Search api. And your administrator has not yet consented to the application’s permissions.
2. If you need to grant access to SP Rest api via Azure AD App, you need to use a certificate to request access. Take a look at this :https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

Updated: