REST API External user access

Question

I'm currently trying to access a sharepoint site through the REST api using an external user from another organization.

The user has been added to the Site Members group with the Edit rights successfully. Tho, after retrieving an access token, I'm constantly getting this response:

GET https://<my-site>/_api/web # And all the other routes
{
  "error_description": "Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."
}

I allowed sharing on this site through the office 365 admin center but it seems like it's impossible to access it anyway.

I've been searching for this on google for a few hours now and I still can't get any results. I tried tweaking the settings in the Sharepoint admin center but nothing worked. Also, after going through the Sharepoint REST API documentation I couldn't find anything about this particular use case.

Is it possible to access the REST API of a site using a user that is external to the organization itself?

Answer 1

I know my answer is kinda late, but I hope it will help people that have the same problem with you and (previously).

When you need to get a token, you need to build a resource as a parameter. The resource format is:

AudienceID/host@realm

For example:

00000003-0000-0ff1-ce00-000000000000/tenant.sharepoint.com@17db9dca-542b-4942-9964-4816e2b6e26a

Note: 00000003-0000-0ff1-ce00-000000000000 is static audience ID for Sharepoint. Check it out at Microsoft Docs.

From my experience, I was wrong defined host value. Please check your host again.

The host value cannot contain protocol and path, it's a really pure hostname. Even when you are using custom site collection like as https://tenant.sharepoint.com/sites/application, you just need the hostname (tenant.sharepoint.com) without path or slash in the end.