I'm currently trying to access a sharepoint site through the REST api using an external user from another organization.

The user has been added to the Site Members group with the Edit rights successfully. Tho, after retrieving an access token, I'm constantly getting this response:

GET https://<my-site>/_api/web # And all the other routes
  "error_description": "Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."

I allowed sharing on this site through the office 365 admin center but it seems like it's impossible to access it anyway.

I've been searching for this on google for a few hours now and I still can't get any results. I tried tweaking the settings in the Sharepoint admin center but nothing worked. Also, after going through the Sharepoint REST API documentation I couldn't find anything about this particular use case.

Is it possible to access the REST API of a site using a user that is external to the organization itself?

  • 1
    For accessing rest API with external user, Site must be shared with that user with minimum read permission. and please replace ajax call '_api/web/webinfos' instead of '_api/web/webs'.
    – Akshay
    Feb 14, 2018 at 6:58

1 Answer 1


I know my answer is kinda late, but I hope it will help people that have the same problem with you and (previously).

When you need to get a token, you need to build a resource as a parameter. The resource format is:


For example:


Note: 00000003-0000-0ff1-ce00-000000000000 is static audience ID for Sharepoint. Check it out at Microsoft Docs.

From my experience, I was wrong defined host value. Please check your host again.

The host value cannot contain protocol and path, it's a really pure hostname. Even when you are using custom site collection like as https://tenant.sharepoint.com/sites/application, you just need the hostname (tenant.sharepoint.com) without path or slash in the end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.